Virtumonde and Trojan help

[brett101]

Logfile of Trend Micro HijackThis v2.0.2
Scan 11/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6e59842c-da3f-496b-8425-275d87dc89e1} - C:\WINDOWS\system32\cragxvj.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {B628D3DE-738E-465F-A84B-9E209B9459BD} - C:\WINDOWS\system32\qommk.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [40fc908e] rundll32.exe "C:\WINDOWS\system32\mfuklkdk.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [WebBuying] C:\Program Files\Web Buying\v1.8.3\webbuying.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\kpdsrngr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\Internet Explorer\rtejeja.html

--
End of file - 7555 bytes

-------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 18, 2007
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 19/11/2007
Kaspersky Anti-Virus database records: 461380
-------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 36872
Number of viruses found: 14
Number of infected objects: 39
Number of suspicious objects: 0
Duration of the scan process: 00:43:15

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\NetworkMonitor1.zip/netmon.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\NetworkMonitor1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip/popinstall.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip/qomnkll.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Virtumonde1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinpop.zip/b122.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinpop.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinpop1.zip/winpop.exe Infected: not-a-virus:AdWare.Win32.Rond.c skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinpop1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinPop3.zip/UnInstall.exe Infected: Trojan.Win32.Small.oa skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\VirtumondeWinPop3.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.3/webbuying.exe Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant2.zip/v1.8.3/webbuying.exe Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentqt.zip/retadpu1000106.exe Infected: Trojan-Downloader.Win32.Agent.djj skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentqt.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch1.zip/kpdsrngr.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch1.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch2.zip/dwdsrngt.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch4.zip/qwinqldt.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.r skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZenoSearch4.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/BnnnnBaa.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/VaannnaaBaa.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/Bnnnnn.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Crystal Seeman\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\ mon009.log Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\P9HB1ZH4\main_banner_v2b[1].swf Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\QJO07LXN\main_banner_v2b[2].swf Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\UVLWL6BD\main_banner_v2b[1].swf Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Program Files\Internet Explorer\rtejeja.html Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP127\A0012170.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012211.exe Infected: not-a-virus:AdWare.Win32.Agent.ta skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012223.exe/data0004 Infected: Trojan-Clicker.Win32.Small.jf skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012223.exe/data0005 Infected: Trojan-Clicker.HTML.IFrame.dn skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012223.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP133\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\capcam\nab22011.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\WINDOWS\system32\capcam\nab22011.exe NSIS: infected - 1 skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mnwqxehx.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\WINDOWS\system32\vduyalbl.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\xwvoplbr.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5d8.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\unp209308667.tmp Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[steamwiz]

Hi

Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
1. Double-click VundoFix.exe to run it.
2. When VundoFix re-opens, click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click "YES".
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will reboot your computer, click "OK".

7. Please post the contents of C:\vundofix.txt

If vundofix cannot delete a file, it will try to delete it during a reboot, after the reboot vundofix will open again, you must run vundofix again, from "Click the Scan for Vundo button" ... and you must keep running vundofix until it does delete the file... I've known a stubborn vundo file take 5 or 6 reboots before it is deleted...

Keep running vundofix untill it gives you the message "no infected files were found"


THEN ...

Download Superantispyware.

http://www.superantispyware.com/

Once downloaded and installed update the definitions
and then run a full system scan quarantine what it finds!

* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)

http://www.superantispyware.com/definitions.html

* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.

THEN ...

Please download Combofix: http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
and save to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.

Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.

Please remember to post :-

1. C:\vundofix.txt
2. SUPERAntiSpyware Scan Log
3. C:\ComboFix.txt
4. a new hijackthis log.( run after everything else)

steam

[brett101]

I ran the vundofix and it found 1 thing. After I clicked on to remove it, the vundo page went away so I don't have a log to post. I clicked on your link for the ComboFix, but the link said it was outdated and to get a newer version, which I don't know how to do. But I have included a log of the superantispyware and a new hijackthis log. Thanks for your help.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/18/2007 at 08:37 PM

Application Version : 3.9.1008

Core Rules Database Version : 3346
Trace Rules Database Version: 1347

Scan type : Complete Scan
Total Scan Time : 00:36:46

Memory items scanned : 403
Memory threats detected : 0
Registry items scanned : 5006
Registry threats detected : 38
File items scanned : 26110
File threats detected : 63

Adware.WebBuying Assistant/Resident
HKLM\Software\Classes\CLSID\{6e59842c-da3f-496b-8425-275d87dc89e1}
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}\InprocServer32
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\CRAGXVJ.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6e59842c-da3f-496b-8425-275d87dc89e1}

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}\InprocServer32
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\QOMMK.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B628D3DE-738E-465F-A84B-9E209B9459BD}

Adware.k8l
C:\PROGRAM FILES\INTERNET EXPLORER\RTEJEJA.HTML
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Source
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#SubscribedURL
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#FriendlyName
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Flags
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Position
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#CurrentState
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#OriginalStateInfo
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#RestoredStateInfo

Adware.Tracking Cookie
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@www.incentaclick[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@statsgod[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-pcsecurityshield.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal seeman@CA9IUAX6.txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ads.diet[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@richmedia.yahoo[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@media.adrevolver[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@directtrack[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal seeman@CAR8MEVH.txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@stats2.reliablestats[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ads.adbrite[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@affiliate.fyctracker[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[10].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[11].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[4].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[5].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[6].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[7].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[8].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[9].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[10].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[11].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[4].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[5].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[6].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[7].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[8].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[9].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@sparknetworks.112.2o7[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.espn.adsonar[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.monster[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.pointroll[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@advertising[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@atdmt[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@bs.serving-sys[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@cpvfeed[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@doubleclick[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ehg-dig.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@hitbox[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@imrworldwide[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@questionmarket[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@server.iad.liveperson[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@serving-sys[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@sexbuddies[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@windowsmedia[1].txt

Trojan.NetMon/DNSChange
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc

Trojan.cmdService
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#DeviceDesc

Adware.Web Buying
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\WebBuying

Adware.WebBuying Assistant-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP127\A0012170.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012194.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012211.EXE

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012188.VBS
C:\WINDOWS\Q3J5C3RHBCBTZWVTYW4\KALCWAL1VF1NTQPQSQB.VBS

Adware.RAC
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012223.EXE

Trojan.Downloader-Gen/DDC
C:\WINDOWS\SYSTEM32\MNWQXEHX.EXE
C:\WINDOWS\SYSTEM32\VDUYALBL.EXE
C:\WINDOWS\SYSTEM32\XWVOPLBR.EXE


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/18/2007 at 08:37 PM

Application Version : 3.9.1008

Core Rules Database Version : 3346
Trace Rules Database Version: 1347

Scan type : Complete Scan
Total Scan Time : 00:36:46

Memory items scanned : 403
Memory threats detected : 0
Registry items scanned : 5006
Registry threats detected : 38
File items scanned : 26110
File threats detected : 63

Adware.WebBuying Assistant/Resident
HKLM\Software\Classes\CLSID\{6e59842c-da3f-496b-8425-275d87dc89e1}
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}\InprocServer32
HKCR\CLSID\{6E59842C-DA3F-496B-8425-275D87DC89E1}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\CRAGXVJ.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6e59842c-da3f-496b-8425-275d87dc89e1}

Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}\InprocServer32
HKCR\CLSID\{B628D3DE-738E-465F-A84B-9E209B9459BD}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\QOMMK.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B628D3DE-738E-465F-A84B-9E209B9459BD}

Adware.k8l
C:\PROGRAM FILES\INTERNET EXPLORER\RTEJEJA.HTML
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Source
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#SubscribedURL
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#FriendlyName
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Flags
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#Position
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#CurrentState
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#OriginalStateInfo
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\Microsoft\Internet Explorer\Desktop\Components\0#RestoredStateInfo

Adware.Tracking Cookie
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@www.incentaclick[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@statsgod[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@angleinteractive.directtrack[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-pcsecurityshield.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal seeman@CA9IUAX6.txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ads.diet[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@richmedia.yahoo[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@media.adrevolver[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@directtrack[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal seeman@CAR8MEVH.txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@stats2.reliablestats[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ads.adbrite[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@affiliate.fyctracker[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[10].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[11].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[2].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[4].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[5].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[6].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[7].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[8].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@ehg-kasperskylab.hitbox[9].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[10].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[11].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[3].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[4].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[5].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[6].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[7].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[8].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@hitbox[9].txt
C:\Documents and Settings\Crystal Seeman\Cookies\crystal_seeman@sparknetworks.112.2o7[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.espn.adsonar[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.monster[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ads.pointroll[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@advertising[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@atdmt[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@bs.serving-sys[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@cpvfeed[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@doubleclick[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@ehg-dig.hitbox[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@hitbox[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@imrworldwide[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@questionmarket[1].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@server.iad.liveperson[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@serving-sys[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@sexbuddies[2].txt
C:\Documents and Settings\Crystal Seeman\Local Settings\Temp\Cookies\crystal_seeman@windowsmedia[1].txt

Trojan.NetMon/DNSChange
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR\0000#DeviceDesc

Trojan.cmdService
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE\0000#DeviceDesc

Adware.Web Buying
HKU\S-1-5-21-725345543-1682526488-854245398-1004\Software\WebBuying

Adware.WebBuying Assistant-Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP127\A0012170.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012194.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012211.EXE

Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012188.VBS
C:\WINDOWS\Q3J5C3RHBCBTZWVTYW4\KALCWAL1VF1NTQPQSQB.VBS

Adware.RAC
C:\SYSTEM VOLUME INFORMATION\_RESTORE{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP128\A0012223.EXE

Trojan.Downloader-Gen/DDC
C:\WINDOWS\SYSTEM32\MNWQXEHX.EXE
C:\WINDOWS\SYSTEM32\VDUYALBL.EXE
C:\WINDOWS\SYSTEM32\XWVOPLBR.EXE

[brett101]

Sorry, I think I cut and pasted the superantispyware log twice, and didn't post the hijack log. So here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:33, on 11/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: TA_Start.lnk = C:\WINDOWS\system32\kpdsrngr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7171 bytes

[steamwiz]

HI

You'll find the vundofix log here :-

C:\vundofix.txt

What do you mean by " I clicked on your link for the ComboFix, but the link said it was outdated and to get a newer version"

Don't you get a download box for the Combofix.exe file ? ... I've just checked the link & I do ...

steam

[brett101]

Hello,
OK, so now the link works. Thank you for your help. Here are the vundofix and combofix logs:


VundoFix V6.5.8

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 4:00:15 PM 9/10/2007

Listing files found while scanning....

C:\windows\system32\qomnkll.dll

Beginning removal...

Attempting to delete C:\windows\system32\qomnkll.dll
C:\windows\system32\qomnkll.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.8

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 4:08:39 PM 9/10/2007

Listing files found while scanning....

No infected files were found.


VundoFix V6.5.8

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 9:41:32 PM 9/10/2007

Listing files found while scanning....

C:\windows\system32\dgforkxr.ini
C:\WINDOWS\system32\rxkrofgd.dll

Beginning removal...

Attempting to delete C:\windows\system32\dgforkxr.ini
C:\windows\system32\dgforkxr.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\rxkrofgd.dll
C:\WINDOWS\system32\rxkrofgd.dll Could not be deleted.

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 7:21:06 PM 11/18/2007

Listing files found while scanning....

C:\WINDOWS\system32\mvusyfdb.dll

Beginning removal...

Performing Repairs to the registry.
Done!

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 7:40:31 PM 11/18/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 4:07:38 PM 11/19/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

Beginning removal...


ComboFix 07-11-19.3 - Crystal Seeman 2007-11-21 17:45:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.144 [GMT -9:00]
Running from: C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\0KUI6AQR\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\Documents and Settings\Crystal Seeman\Start Menu\Programs\Startup\ta_start.lnk
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\D2
C:\WINDOWS\system32\f02WtR

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-10-22 to 2007-11-22 )))))))))))))))))))))))))))))))
.

2007-11-18 19:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\Crystal Seeman\Application Data\SUPERAntiSpyware.com
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-18 19:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 16:29 620,174 ---hs---- C:\WINDOWS\system32\kdklkufm.ini
2007-11-12 16:29 89,664 --a------ C:\WINDOWS\system32\mfuklkdk.dll
2007-11-09 11:50 625,570 ---hs---- C:\WINDOWS\system32\wygahumo.ini
2007-11-07 17:37 639,009 ---hs---- C:\WINDOWS\system32\wgoxsmqe.ini
2007-11-07 16:42 979,525 ---hs---- C:\WINDOWS\system32\yjptxdxk.ini
2007-10-29 16:42 506,904 ---hs---- C:\WINDOWS\system32\ewfxadsk.ini
2007-10-28 15:48 478,964 ---hs---- C:\WINDOWS\system32\rmibagnw.ini
2007-10-27 15:50 484,219 ---hs---- C:\WINDOWS\system32\xuusaflw.ini
2007-10-24 15:05 693,628 ---hs---- C:\WINDOWS\system32\htowpbmw.ini
2007-10-23 15:04 693,508 ---hs---- C:\WINDOWS\system32\qrvdjxps.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 01:26 472,535 --sh--w C:\WINDOWS\system32\kmmoq.bak2
2007-10-03 00:43 --------- d-----w C:\Program Files\Trend Micro
2007-10-02 23:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-23 00:56 2,003,941 --sh--w C:\WINDOWS\system32\kmmoq.bak1
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2006-07-23 20:07 43,744 ----a-w C:\Documents and Settings\Crystal Seeman\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 07:24]
"BackupNotify"="C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 03:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" []
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 18:55]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 08:15]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 08:15]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-29 23:46]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-29 23:33]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 09:32]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-04-21 10:28]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-04 15:04]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-07-30 07:33]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 00:01]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2006-07-04 15:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 01:06]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 04:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-28 22:36:18]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


.
Contents of the 'Scheduled Tasks' folder
"2007-11-22 02:51:15 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-21 17:50:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?????? ???B???????????????B? ??????

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-21 17:52:13 - machine was rebooted
.
--- E O F ---

[steamwiz]

Please download Combofix to your desktop Then run it again & post a new log ...

You are running it from the net ...


Running from: C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\0KUI6AQR\ComboFix[1].exe

It must be on the desktop for you to do what I need you to do next ... you have a lot of bad files which we need to remove ...

steam

[brett101]

Thank you,
Here is the new log run from the desktop:


ComboFix 07-11-19.3 - Crystal Seeman 2007-11-24 17:08:34.2 - NTFSx86
Running from: C:\Documents and Settings\Crystal Seeman\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-10-25 to 2007-11-25 )))))))))))))))))))))))))))))))
.

2007-11-18 19:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\Crystal Seeman\Application Data\SUPERAntiSpyware.com
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-18 19:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-12 16:29 620,174 ---hs---- C:\WINDOWS\system32\kdklkufm.ini
2007-11-12 16:29 89,664 --a------ C:\WINDOWS\system32\mfuklkdk.dll
2007-11-09 11:50 625,570 ---hs---- C:\WINDOWS\system32\wygahumo.ini
2007-11-07 17:37 639,009 ---hs---- C:\WINDOWS\system32\wgoxsmqe.ini
2007-11-07 16:42 979,525 ---hs---- C:\WINDOWS\system32\yjptxdxk.ini
2007-10-29 16:42 506,904 ---hs---- C:\WINDOWS\system32\ewfxadsk.ini
2007-10-28 15:48 478,964 ---hs---- C:\WINDOWS\system32\rmibagnw.ini
2007-10-27 15:50 484,219 ---hs---- C:\WINDOWS\system32\xuusaflw.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 01:26 472,535 --sh--w C:\WINDOWS\system32\kmmoq.bak2
2007-10-03 00:43 --------- d-----w C:\Program Files\Trend Micro
2007-10-02 23:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-23 00:56 2,003,941 --sh--w C:\WINDOWS\system32\kmmoq.bak1
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2006-07-23 20:07 43,744 ----a-w C:\Documents and Settings\Crystal Seeman\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-21_17.50.51.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-22 02:33:47 52,962 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-25 02:04:44 52,962 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-22 02:33:47 380,588 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-25 02:04:44 380,588 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-25 02:00:30 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_63c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 07:24]
"BackupNotify"="C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 03:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" []
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 18:55]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 08:15]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 08:15]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-29 23:46]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-29 23:33]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 09:32]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-04-21 10:28]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-04 15:04]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-07-30 07:33]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 00:01]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2006-07-04 15:10]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 01:06]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 04:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-28 22:36:18]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


.
Contents of the 'Scheduled Tasks' folder
"2007-11-25 02:01:28 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-24 17:10:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?P???? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-24 17:11:07
C:\ComboFix2.txt ... 2007-11-21 17:52
.
--- E O F ---

[steamwiz]

Hi

You are running an out-of-date version of java

Go to add/remove programs and uninstall any earlier versions ...( in your case j2re1.4.2_03)

Then You can go here and install the latest version of Java.

http://java.sun.com/javase/downloads/index.jsp

Scroll down the page to 'Java Runtime Environment (JRE) 6 Update 3' and press the 'Download' button.


Running an out-of-date version of java is an infection risk.

THEN ...

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the code box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)


File::
C:\WINDOWS\system32\kdklkufm.ini
C:\WINDOWS\system32\mfuklkdk.dll
C:\WINDOWS\system32\wygahumo.ini
C:\WINDOWS\system32\wgoxsmqe.ini
C:\WINDOWS\system32\yjptxdxk.ini
C:\WINDOWS\system32\ewfxadsk.ini
C:\WINDOWS\system32\rmibagnw.ini
C:\WINDOWS\system32\xuusaflw.ini
C:\WINDOWS\system32\htowpbmw.ini
C:\WINDOWS\system32\qrvdjxps.ini
C:\WINDOWS\system32\kmmoq.bak2
C:\WINDOWS\system32\kmmoq.bak1



Save this as "CFScript.txt"

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

steam

[brett101]

Here is the combofix log and the hijack this log:

ComboFix 07-11-19.3 - Crystal Seeman 2007-11-27 19:29:38.3 - NTFSx86
Running from: C:\Documents and Settings\Crystal Seeman\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Crystal Seeman\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\ewfxadsk.ini
C:\WINDOWS\system32\htowpbmw.ini
C:\WINDOWS\system32\kdklkufm.ini
C:\WINDOWS\system32\kmmoq.bak1
C:\WINDOWS\system32\kmmoq.bak2
C:\WINDOWS\system32\mfuklkdk.dll
C:\WINDOWS\system32\qrvdjxps.ini
C:\WINDOWS\system32\rmibagnw.ini
C:\WINDOWS\system32\wgoxsmqe.ini
C:\WINDOWS\system32\wygahumo.ini
C:\WINDOWS\system32\xuusaflw.ini
C:\WINDOWS\system32\yjptxdxk.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\ewfxadsk.ini
C:\WINDOWS\system32\htowpbmw.ini
C:\WINDOWS\system32\kdklkufm.ini
C:\WINDOWS\system32\kmmoq.bak1
C:\WINDOWS\system32\kmmoq.bak2
C:\WINDOWS\system32\mfuklkdk.dll
C:\WINDOWS\system32\qrvdjxps.ini
C:\WINDOWS\system32\rmibagnw.ini
C:\WINDOWS\system32\wgoxsmqe.ini
C:\WINDOWS\system32\wygahumo.ini
C:\WINDOWS\system32\xuusaflw.ini
C:\WINDOWS\system32\yjptxdxk.ini

.
((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 )))))))))))))))))))))))))))))))
.

2007-11-27 19:02 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-27 19:01 <DIR> d-------- C:\Program Files\Java
2007-11-27 19:01 5,329 --a------ C:\WINDOWS\system32\jupdate-1.6.0_03-b05.log
2007-11-27 18:56 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-18 19:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\Crystal Seeman\Application Data\SUPERAntiSpyware.com
2007-11-18 19:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-18 19:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-03 00:43 --------- d-----w C:\Program Files\Trend Micro
2007-10-02 23:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2006-07-23 20:07 43,744 ----a-w C:\Documents and Settings\Crystal Seeman\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2007-11-21_17.50.51.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-07-05 00:10:59 24,681 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-25 07:30:28 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-07-05 00:10:59 28,779 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-25 07:30:30 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-25 08:31:42 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2007-11-22 02:33:47 52,962 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-11-28 03:00:07 52,962 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-11-22 02:33:47 380,588 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 03:00:07 380,588 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-11-28 04:33:25 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_610.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 07:24]
"BackupNotify"="C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 03:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 03:00]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" []
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 18:55]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 08:15]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 08:15]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-29 23:46]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-29 23:33]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 09:32]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-04-21 10:28]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-07-04 15:04]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-07-30 07:33]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 00:01]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 01:06]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 14:54]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 04:19:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-28 22:36:18]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll


.
Contents of the 'Scheduled Tasks' folder
"2007-11-28 04:35:23 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-27 19:34:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???????????????|?P???? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-27 19:36:06 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-24 17:11
C:\ComboFix3.txt ... 2007-11-21 17:52
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:42, on 11/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BackupNotify] C:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7315 bytes

[steamwiz]

Hi

combofix & hijackthis are now clean ...

Please do this now :-

First ...

clean out the Spybot backups...

1. Run Spybot
2. Click on "Recovery" on the left side
3. Place a checkmark in all of the boxes on the right side
4. From the top menu click on "Purge items"
5. This will remove those backups.

Second...

Follow the instructions here for how to clear your java cache...

http://www.java.com/en/download/help/5000020300.xml

Third...

This will clear all your infected restore points...

Turn off (Disable) System Restore in XP :-

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer.

Then...

Turn on (enable) System Restore :-

Follow the same procedure, but this time uncheck Turn off System Restore

if you have any problem with this... here's a link to instructions :-


Disabling or enabling Windows XP System Restore >

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

Fourth...

Run a new KASPERSKY ONLINE SCAN & post the report please ...

steam

[brett101]

Hello,
Here is the Kaspersky log:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, November 28, 2007 19:50
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 29/11/2007
Kaspersky Anti-Virus database records: 467978
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 32048
Number of viruses found: 3
Number of infected objects: 8
Number of suspicious objects: 0
Duration of the scan process: 00:40:23

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/BnnnnBaa.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/VaannnaaBaa.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip/Bnnnnn.class Infected: Trojan.Java.ClassLoader.as skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-75cb33ca.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-75cb33ca.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Crystal Seeman\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\History\History.IE5\MSHist012007112820071129\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP1\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\capcam\nab22011.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\WINDOWS\system32\capcam\nab22011.exe NSIS: infected - 1 skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_63c.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[steamwiz]

HI

Did you follow the directions to purge your java cache ? because you still have infected applets ...

Try this way ... follow the path ... & delete the entries below in Bold


C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\cnte-dhncgts.jar-7fc746a8-7576a2d7.zip

C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0e0e-75cb33ca.zip

Then delete this file :-

C:\WINDOWS\system32\capcam\nab22011.exe

After you have done that, post a new Kaspersky log

steam

[brett101]

Hello,
I followed the directions in the link to java, but the screen shots they showed were different than what came up on my computer, so maybe that's why the infected files weren't deleted. Then I tried to follow the path that you wrote, but after I clicked on the "Crystal Seeman" file, there is no "Application Data" file, so I couldn't delete two of the files. Here is the Kaspersky log, though:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, December 04, 2007 6:26:33 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/12/2007
Kaspersky Anti-Virus database records: 472733
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 32007
Number of viruses found: 1
Number of infected objects: 2
Number of suspicious objects: 0
Duration of the scan process: 00:39:57

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\History\History.IE5\MSHist012007120420071205\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Crystal Seeman\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP1\A0000064.exe/data0004 Infected: not-a-virus:AdWare.Win32.TTC.c skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP1\A0000064.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{74E9D7AC-923E-4361-8488-E8CEF4D9FDF5}\RP2\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{F9AD7393-A4A8-4F9E-8697-4C5F38FCB578}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_670.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[steamwiz]

Hello,
I followed the directions in the link to java, but the screen shots they showed were different than what came up on my computer, so maybe that's why the infected files weren't deleted. Then I tried to follow the path that you wrote, but after I clicked on the "Crystal Seeman" file, there is no "Application Data" file, so I couldn't delete two of the files. Here is the Kaspersky log, though:


The "Application Data" is a hidden folder ...

When you need to view hidden folders ... go to Start > my computer >

Click "tools" then "folder options" ... click the "view" tab

scroll down to & put a checkmark in show hidden files & folders

Click apply then OK

---
Another way to find those files you were looking for would be to paste C:\Documents and Settings\Crystal Seeman\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ ... in to your address bar & click GO ...

However those entries are no longer showing ...

There are just 2 infected restore points ...

So just clear your restore points again as you did in post #11

steam

[brett101]

Thank you very much! I appreciate all your help. The kaspersky scan came out clean, so I don't believe that I need to post it. But if I'm wrong, or if there is anything else I need to do, please let me know. Otherwise, just know that your help is greatly appreciated.

[steamwiz]

Hi

No... I don't need to see the scan log ..

If you have no further questions or concerns ... you're good to go

Happy surfing

steam