PDA

View Full Version : Vundo and other stuff


Sonny
2008-01-13, 02:02
I recently ran a scan with McAfee and it showed that there was Vundo on my computer (which I just bought used off a friend). McAfee wouldn't get rid of it so I tried using VundoFix. VundoFix seemed to get rid of it all, but now I think I need to fix the registry, because I keep getting pop-ups saying that the Vundo files can't be found.

I also decided to scan using the Kaspersky Online Scanner (as advised) just to make sure I got everything and sure enough there was tons of infected files. I downloaded Spybot since McAfee didn't catch anything and that got rid of alot of stuff. I basically just to make sure that I got everything taken care of. Thanks for the help in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:44:47 PM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINNT\System32\svchost.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon .exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB .exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
C:\WINNT\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/sbcydsl/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F3 - REG:win.ini: load=C:\WINNT\system32\vtsqn.exe
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\WINNT\system32\actcontroller.exe,
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [305f0fdc] rundll32.exe "C:\WINNT\system32\ufdfhbfn.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA2776] command /c del "C:\WINNT\system32\vtsqn.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2639] cmd /c del "C:\WINNT\system32\vtsqn.dll_old"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: JT's Blocks - http://download2.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/clients/y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: SBHookSvc - Motive Communications, Inc. - C:\PROGRA~1\SBCSEL~1\SMARTB~1\SBHookSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 10474 bytes
Sonny
2008-01-13, 02:06
Sorry, forgot to mention that the initial Kaspersky scan (before I scanned using Spybot) was too long to include.
Blade81
2008-01-17, 17:45
Hi

Navigate into C:\Program Files\Trend Micro\HijackThis folder and rename HijackThis.exe file -> Sonny.exe. Post a fresh hjt log after renaming is done :)
Sonny
2008-01-18, 00:42
I've ran alot of scans since the first time I posted and Spybot & McAfee have both showed clean results thus far. I've noticed that certain vundo files such as vtsqn.dll seem to keep showing up though...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:39:39 PM, on 1/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINNT\system32\fxssvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\Sonny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: (no name) - {69E60FC8-8454-47B4-AE4E-21AF5A1B1278} - C:\WINNT\system32\vtsqn.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: BndShell3 BHO Class - {875A1348-7674-42aa-ADAC-B4F36A004A2D} - C:\Program Files\QdrDrive\QdrDrive8.dll (file missing)
O2 - BHO: {a51cc1aa-75cc-df1a-8c64-8fb6e7fc170d} - {d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a} - C:\WINNT\system32\odvoxpuq.dll (file missing)
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FFB2B962-836F-4E8C-BC77-77C15F7610CA} - (no file)
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [305f0fdc] rundll32.exe "C:\WINNT\system32\paruhitm.dll",b
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [QdrModule10] "C:\Program Files\QdrModule\QdrModule10.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.att.net
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: JT's Blocks - http://download2.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/clients/y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: SBHookSvc - Motive Communications, Inc. - C:\PROGRA~1\SBCSEL~1\SMARTB~1\SBHookSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 10162 bytes
Blade81
2008-01-18, 07:15
Hi

1. Download this file -
combofix.exe (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your desktop.
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your
next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause
it to stall
Sonny
2008-01-18, 18:48
ComboFix 08-01-18.4 - Elizabeth1 2008-01-19 7:05:18.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.45 [GMT -5:00]
Running from: C:\Documents and Settings\Elizabeth1.ELIZABETH\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-19 07:00 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-19 06:42 . 2008-01-19 06:42 1,158 --a------ C:\WINNT\mozver.dat
2008-01-17 14:39 . 2008-01-19 07:21 325,664 --ahs---- C:\WINNT\system32\drivers\fidbox.dat
2008-01-17 14:39 . 2008-01-19 05:50 4,124 --ahs---- C:\WINNT\system32\drivers\fidbox.idx
2008-01-17 14:27 . 2007-11-14 16:05 75,248 --a------ C:\WINNT\zllsputility.exe
2008-01-17 14:25 . 2007-11-14 16:05 1,086,952 --a------ C:\WINNT\system32\zpeng24.dll
2008-01-17 14:25 . 2008-01-19 05:57 353,366 --a------ C:\WINNT\system32\vsconfig.xml
2008-01-17 11:59 . 2008-01-17 14:15 <DIR> d-------- C:\Program Files\COMODO
2008-01-13 19:21 . 2008-01-13 19:21 24,576 --a------ C:\WINNT\system32\VundoFixSVC.exe
2008-01-12 18:42 . 2008-01-12 18:42 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-12 10:20 . 2008-01-16 05:01 401 --a------ C:\WINNT\wininit.ini
2008-01-12 00:15 . 2008-01-12 17:50 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Spybot - Search & Destroy
2008-01-11 17:58 . 2008-01-11 17:58 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Kaspersky Lab
2008-01-11 17:57 . 2008-01-11 17:57 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-01-08 14:46 . 2008-01-08 14:46 <DIR> d-------- C:\Documents and Settings\Administrator.ELIZABETH.000\Application Data\AVG7
2007-12-30 16:07 . 2007-06-25 10:57 171,240 --a------ C:\WINNT\system32\drivers\mfehidk.sys
2007-12-30 16:07 . 2007-06-25 10:57 37,480 --a------ C:\WINNT\system32\drivers\mfesmfk.sys
2007-12-30 16:07 . 2007-06-25 10:57 34,184 --a------ C:\WINNT\system32\drivers\mfebopk.sys
2007-12-30 16:07 . 2007-06-25 10:57 32,008 --a------ C:\WINNT\system32\drivers\mferkdk.sys
2007-12-30 16:06 . 2007-06-25 14:54 71,496 --a------ C:\WINNT\system32\drivers\mfeavfk.sys
2007-12-30 16:05 . 2007-12-30 16:05 <DIR> d-------- C:\mcafee_mcpr
2007-12-30 16:05 . 2007-03-02 14:16 109,608 --a------ C:\WINNT\system32\drivers\Mpfp.sys
2007-12-30 16:00 . 2007-12-30 16:02 <DIR> d-------- C:\Program Files\McAfee.com
2007-12-30 15:58 . 2008-01-19 05:53 <DIR> d-------- C:\Program Files\McAfee
2007-12-30 15:58 . 2007-12-30 16:06 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-12-30 15:51 . 2007-12-30 15:51 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2007-12-30 15:44 . 2007-12-30 15:44 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\MailFrontier
2007-12-30 15:44 . 2008-01-17 14:34 4,212 ---h----- C:\WINNT\system32\zllictbl.dat
2007-12-30 15:43 . 2004-04-27 04:40 11,264 --a------ C:\WINNT\system32\SpOrder.dll
2007-12-30 15:41 . 2007-12-30 15:41 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\McAfee
2007-12-30 15:40 . 2008-01-17 14:27 <DIR> d-------- C:\WINNT\system32\ZoneLabs
2007-12-30 14:17 . 2007-12-30 14:17 <DIR> d-a------ C:\Program Files\AIM6
2007-12-30 14:16 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\acccore
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Grisoft
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7
2007-12-30 14:14 . 2007-12-30 14:20 <DIR> d-------- C:\Program Files\AOL 9.0b
2007-12-30 14:13 . 2007-12-30 14:13 <DIR> d-a------ C:\Program Files\Common Files\aolshare
2007-12-24 21:33 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7(2)
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdhlp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdGuard(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgtdi(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgclean(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsxp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsw(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7core(2).sys
2007-12-24 20:56 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2021-12-23 01:50 --------- d---a-w C:\Program Files\Electronic Arts
2021-12-21 19:30 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Ahead
2021-12-21 19:18 --------- d--ha-w C:\Program Files\InstallShield Installation Information
2021-12-21 19:18 --------- d---a-w C:\Program Files\Common Files\InstallShield
2021-12-21 18:48 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Microsoft Web Folders
2021-12-21 18:24 --------- d---a-w C:\Program Files\microsoft frontpage
2021-12-21 17:54 32,768 --sha-w C:\VIDEOROM.BIN
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Comodo
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Comodo
2008-01-16 18:06 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL
2008-01-16 17:59 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Viewpoint
2008-01-14 06:12 --------- d---a-w C:\Program Files\Common Files\AOL
2008-01-09 16:02 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\uTorrent
2007-12-30 19:17 --------- d---a-w C:\Program Files\Common Files\Nullsoft
2007-12-30 19:16 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AOL
2007-12-30 19:12 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Grisoft
2007-11-28 18:04 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL OCP
2007-11-28 18:02 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL Downloads
2007-08-26 04:23 271 --sh--w C:\Program Files\desktop.ini
2007-08-26 04:23 21,952 ---ha-w C:\Program Files\folder.htt
.

<pre>
----a-w 919,016 2008-01-14 21:42:09 C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69E60FC8-8454-47B4-AE4E-21AF5A1B1278}]
C:\WINNT\system32\vtsqn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
C:\Program Files\QdrDrive\QdrDrive8.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a}]
C:\WINNT\system32\odvoxpuq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-30 15:51 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB2B962-836F-4E8C-BC77-77C15F7610CA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-30 15:51 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-01-14 16:43 4670968]
"Aim6"="" []
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-14 16:42 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 07:00 143360 C:\WINNT\system32\mobsync.exe]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [ ]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2008-01-14 16:41 132496]
"HostManager"="C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe" [2008-01-14 16:41 50736]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-14 16:41 40048]
"305f0fdc"="C:\WINNT\system32\paruhitm.dll" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 07:00 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 07:00 44544]

C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Startup\
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2007-04-13 21:54:00]
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-10-01 18:52:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=
"LoadAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;C:\WINNT\system32\DRIVERS\DLKRTS.SYS [2001-10-17 03:03]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-30 21:03:10 C:\WINNT\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe%
"2008-01-01 07:14:09 C:\WINNT\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 07:21:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 7:28:23
ComboFix2.txt 2008-01-17 02:34:47
.
2008-01-14 22:25:00 --- E O F ---
Blade81
2008-01-18, 20:20
Hi

Generate an Uninstall List

* Open HijackThis
* Click on Open Misc Tools Section
* Click on Open Uninstall Manager
* Click on Save list
* Save it to your Desktop
* Post it on your next reply.


After that let's install recovery console.
Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System
http://img.photobucket.com/albums/v666/sUBs/KB310994.gif

Download the file & save it as it's originally named, next to ComboFix.exe.

http://img.photobucket.com/albums/v666/sUBs/rc1.gif


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.
Sonny
2008-01-19, 00:16
530TX+
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
AIM 6
AOL Uninstaller (Choose which Products to Remove)
AT&T Self Support Tool
AT&T Yahoo! Applications
ATT-AACE
AVG Anti-Spyware 7.5
EasyJob Resume Builder 4.00.1974
HijackThis 2.0.2
Java(TM) 6 Update 2
Kaspersky Online Scanner
Magic ISO Maker v5.4 (build 0251)
McAfee SecurityCenter
Mozilla Firefox (2.0.0.11)
Nintendo Wi-Fi USB Connector Registration Tool
Spybot - Search & Destroy
Windows Installer 3.1 (KB893803)
WinZip 11.1
ZoneAlarm
ZoneAlarm Spy Blocker

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\="Microsoft Windows"
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Blade81
2008-01-19, 01:28
Hi

Are you using McAfee protection only? In uninstall list there isn't AVG7 entry but according to the log there are still some folders left belonging to AVG7.

Start hjt, do a system scan, check:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Close browsers and other windows. Click fix checked.

Open notepad and copy/paste the text in the quotebox below into it:



File::
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69E60FC8-8454-47B4-AE4E-21AF5A1B1278}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB2B962-836F-4E8C-BC77-77C15F7610CA}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QdrModule10"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"305f0fdc"=-



Save this as
CFScript


http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Please download FindAWF (http://noahdfear.geekstogo.com/FindAWF.exe) and save it to your desktop

Double-click FindAWF.exe to start the tool.
Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.

**Do not run any other option unless directed to do so.**

List of logs to be posted:

results of awf.txt
ComboFix log
a fresh hjt log
Sonny
2008-01-19, 04:08
I uninstalled AVG awhile back, but I still use AVG Anti-Spy. Not sure if that has anything to do with it or not. Anyway, here's the AWF report and the Combo Fix report.

Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Sat 01/19/2008
The current time is: 20:58:39.92


bak folders found
~~~~~~~~~~~



Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~



end of report


ComboFix 08-01-18.4 - Elizabeth1 2008-01-19 19:57:12.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.48 [GMT -5:00]
Running from: C:\Documents and Settings\Elizabeth1.ELIZABETH\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Elizabeth1.ELIZABETH\Desktop\CFScript.txt

FILE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

.
((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))
.

2008-01-19 16:55 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-01-19 16:55 . 2007-09-20 20:17 233 --a------ C:\Boot.bak
2008-01-19 07:00 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-19 06:42 . 2008-01-19 06:42 1,158 --a------ C:\WINNT\mozver.dat
2008-01-17 14:39 . 2008-01-19 20:15 413,728 --ahs---- C:\WINNT\system32\drivers\fidbox.dat
2008-01-17 14:39 . 2008-01-19 05:50 4,124 --ahs---- C:\WINNT\system32\drivers\fidbox.idx
2008-01-17 14:27 . 2007-11-14 16:05 75,248 --a------ C:\WINNT\zllsputility.exe
2008-01-17 14:25 . 2007-11-14 16:05 1,086,952 --a------ C:\WINNT\system32\zpeng24.dll
2008-01-17 14:25 . 2008-01-19 17:07 353,366 --a------ C:\WINNT\system32\vsconfig.xml
2008-01-17 11:59 . 2008-01-17 14:15 <DIR> d-------- C:\Program Files\COMODO
2008-01-13 19:21 . 2008-01-13 19:21 24,576 --a------ C:\WINNT\system32\VundoFixSVC.exe
2008-01-12 18:42 . 2008-01-12 18:42 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-12 10:20 . 2008-01-16 05:01 401 --a------ C:\WINNT\wininit.ini
2008-01-12 00:15 . 2008-01-12 17:50 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Spybot - Search & Destroy
2008-01-11 17:58 . 2008-01-11 17:58 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Kaspersky Lab
2008-01-11 17:57 . 2008-01-11 17:57 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-01-08 14:46 . 2008-01-08 14:46 <DIR> d-------- C:\Documents and Settings\Administrator.ELIZABETH.000\Application Data\AVG7
2007-12-30 16:07 . 2007-06-25 10:57 171,240 --a------ C:\WINNT\system32\drivers\mfehidk.sys
2007-12-30 16:07 . 2007-06-25 10:57 37,480 --a------ C:\WINNT\system32\drivers\mfesmfk.sys
2007-12-30 16:07 . 2007-06-25 10:57 34,184 --a------ C:\WINNT\system32\drivers\mfebopk.sys
2007-12-30 16:07 . 2007-06-25 10:57 32,008 --a------ C:\WINNT\system32\drivers\mferkdk.sys
2007-12-30 16:06 . 2007-06-25 14:54 71,496 --a------ C:\WINNT\system32\drivers\mfeavfk.sys
2007-12-30 16:05 . 2007-12-30 16:05 <DIR> d-------- C:\mcafee_mcpr
2007-12-30 16:05 . 2007-03-02 14:16 109,608 --a------ C:\WINNT\system32\drivers\Mpfp.sys
2007-12-30 16:00 . 2007-12-30 16:02 <DIR> d-------- C:\Program Files\McAfee.com
2007-12-30 15:58 . 2008-01-19 05:53 <DIR> d-------- C:\Program Files\McAfee
2007-12-30 15:58 . 2007-12-30 16:06 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-12-30 15:51 . 2007-12-30 15:51 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2007-12-30 15:44 . 2007-12-30 15:44 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\MailFrontier
2007-12-30 15:44 . 2008-01-17 14:34 4,212 ---h----- C:\WINNT\system32\zllictbl.dat
2007-12-30 15:43 . 2004-04-27 04:40 11,264 --a------ C:\WINNT\system32\SpOrder.dll
2007-12-30 15:41 . 2007-12-30 15:41 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\McAfee
2007-12-30 15:40 . 2008-01-17 14:27 <DIR> d-------- C:\WINNT\system32\ZoneLabs
2007-12-30 14:17 . 2007-12-30 14:17 <DIR> d-a------ C:\Program Files\AIM6
2007-12-30 14:16 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\acccore
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Grisoft
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7
2007-12-30 14:14 . 2007-12-30 14:20 <DIR> d-------- C:\Program Files\AOL 9.0b
2007-12-30 14:13 . 2007-12-30 14:13 <DIR> d-a------ C:\Program Files\Common Files\aolshare
2007-12-24 21:33 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7(2)
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdhlp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdGuard(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgtdi(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgclean(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsxp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsw(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7core(2).sys
2007-12-24 20:56 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2021-12-23 01:50 --------- d---a-w C:\Program Files\Electronic Arts
2021-12-21 19:30 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Ahead
2021-12-21 19:18 --------- d--ha-w C:\Program Files\InstallShield Installation Information
2021-12-21 19:18 --------- d---a-w C:\Program Files\Common Files\InstallShield
2021-12-21 18:48 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Microsoft Web Folders
2021-12-21 18:24 --------- d---a-w C:\Program Files\microsoft frontpage
2021-12-21 17:54 32,768 --sha-w C:\VIDEOROM.BIN
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Comodo
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Comodo
2008-01-16 18:06 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL
2008-01-16 17:59 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Viewpoint
2008-01-14 06:12 --------- d---a-w C:\Program Files\Common Files\AOL
2008-01-09 16:02 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\uTorrent
2007-12-30 19:17 --------- d---a-w C:\Program Files\Common Files\Nullsoft
2007-12-30 19:16 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AOL
2007-12-30 19:12 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Grisoft
2007-11-28 18:04 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL OCP
2007-11-28 18:02 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL Downloads
2007-08-26 04:23 271 --sh--w C:\Program Files\desktop.ini
2007-08-26 04:23 21,952 ---ha-w C:\Program Files\folder.htt
.
C:\WINNT\system32\svchost.exe ... Infected -- Win32.Qhost !!
----a-w 14,336 2004-08-04 12:00:00 C:\WINNT\system32\svchost.exe
-c--a-w 14,336 2004-08-04 12:00:00 C:\WINNT\system32\dllcache\svchost.exe

Entries: 2 (2)
Directories: 0 Files: 2
Bytes: 28,672 Blocks: 56


((((((((((((((((((((((((((((( snapshot@2008-01-19_ 7.25.47.95 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-19 12:02:19 1,417,216 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-20 00:53:48 1,417,216 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-19 12:02:19 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-20 00:53:48 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-19 12:02:20 6,520,832 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-20 00:53:49 6,524,928 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-19 12:02:20 151,552 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-20 00:53:50 151,552 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-19 12:02:21 1,441,792 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-20 00:53:50 1,441,792 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-19 12:02:21 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-20 00:53:50 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 19:30:22 16,384 ----atw C:\WINNT\Temp\Perflib_Perfdata_ec.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69E60FC8-8454-47B4-AE4E-21AF5A1B1278}]
C:\WINNT\system32\vtsqn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]
C:\Program Files\QdrDrive\QdrDrive8.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a}]
C:\WINNT\system32\odvoxpuq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-30 15:51 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB2B962-836F-4E8C-BC77-77C15F7610CA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-30 15:51 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-01-14 16:43 4670968]
"Aim6"="" []
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-14 16:42 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 07:00 143360 C:\WINNT\system32\mobsync.exe]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [ ]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2008-01-14 16:41 132496]
"HostManager"="C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe" [2008-01-14 16:41 50736]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-14 16:41 40048]
"305f0fdc"="C:\WINNT\system32\paruhitm.dll" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 07:00 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 07:00 44544]

C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Startup\
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2007-04-13 21:54:00]
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-10-01 18:52:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;C:\WINNT\system32\DRIVERS\DLKRTS.SYS [2001-10-17 03:03]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-30 21:03:10 C:\WINNT\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe%
"2008-01-01 07:14:09 C:\WINNT\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 20:15:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 20:22:37
ComboFix-quarantined-files.txt 2008-01-20 01:22:19
ComboFix2.txt 2008-01-19 12:28:26
ComboFix3.txt 2008-01-17 02:34:47
.
2008-01-14 22:25:00 --- E O F ---
Sonny
2008-01-19, 04:17
Here's the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:15:39 PM, on 1/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINNT\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Sonny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.att.net
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: JT's Blocks - http://download2.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/clients/y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v6.cab
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: SBHookSvc - Motive Communications, Inc. - C:\PROGRA~1\SBCSEL~1\SMARTB~1\SBHookSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 9013 bytes
Blade81
2008-01-19, 19:39
Hi

Upload following file to http://virusscan.jotti.org or http://www.virustotal.com and post back the results:
c:\windows\system32\svchost.exe

Disable Spybot's TeaTimer
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode

On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer


Start hjt, do a system scan, check:
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/game...ploader_v6.cab
O20 - AppInit_DLLs:
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)

Close browsers and other windows. Click fix checked.

Open notepad and copy/paste the text in the quotebox below into it:



Driver::
Avg7Alrt
Avg7UpdSvc
AVGEMS

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69E60FC8-8454-47B4-AE4E-21AF5A1B1278}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB2B962-836F-4E8C-BC77-77C15F7610CA}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QdrModule10"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"=-
"305f0fdc"=-

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"=-



Save this as
CFScript (overwrite previous one)


http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe
Post resultant log & a fresh hjt log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
Sonny
2008-01-20, 02:03
I wasn't able to find the file you specified. I was however able to find it in c:winnt\system32\svchost so I tried scanning that one.

The first link you gave me has been busy every time I've tried to upload the file. The second link start to scan, but stops after a few minutes and tells me that "the file has expired or does not exist". I still have the log report saved if you still need to see it. I'll also continue trying to scan the file throughout the day.

ComboFix 08-01-18.4 - Elizabeth1 2008-01-20 17:49:52.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.72 [GMT -5:00]
Running from: C:\Documents and Settings\Elizabeth1.ELIZABETH\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Elizabeth1.ELIZABETH\Desktop\CFScript.txt
* Created a new restore point
.
ADS - svchost.exe: deleted 88 bytes in 2 streams.

((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))
.

2008-01-19 16:55 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-01-19 16:55 . 2007-09-20 20:17 233 --a------ C:\Boot.bak
2008-01-19 07:00 . 2000-08-31 08:00 51,200 --a------ C:\WINNT\NirCmd.exe
2008-01-19 06:42 . 2008-01-19 06:42 1,158 --a------ C:\WINNT\mozver.dat
2008-01-17 14:39 . 2008-01-20 18:15 501,792 --ahs---- C:\WINNT\system32\drivers\fidbox.dat
2008-01-17 14:39 . 2008-01-20 18:08 6,908 --ahs---- C:\WINNT\system32\drivers\fidbox.idx
2008-01-17 14:27 . 2007-11-14 16:05 75,248 --a------ C:\WINNT\zllsputility.exe
2008-01-17 14:25 . 2007-11-14 16:05 1,086,952 --a------ C:\WINNT\system32\zpeng24.dll
2008-01-17 14:25 . 2008-01-20 18:15 353,366 --a------ C:\WINNT\system32\vsconfig.xml
2008-01-17 11:59 . 2008-01-17 14:15 <DIR> d-------- C:\Program Files\COMODO
2008-01-13 19:21 . 2008-01-13 19:21 24,576 --a------ C:\WINNT\system32\VundoFixSVC.exe
2008-01-12 18:42 . 2008-01-12 18:42 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-12 10:20 . 2008-01-16 05:01 401 --a------ C:\WINNT\wininit.ini
2008-01-12 00:15 . 2008-01-12 17:50 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Spybot - Search & Destroy
2008-01-11 17:58 . 2008-01-11 17:58 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Kaspersky Lab
2008-01-11 17:57 . 2008-01-11 17:57 <DIR> d-------- C:\WINNT\system32\Kaspersky Lab
2008-01-08 14:46 . 2008-01-08 14:46 <DIR> d-------- C:\Documents and Settings\Administrator.ELIZABETH.000\Application Data\AVG7
2007-12-30 16:07 . 2007-06-25 10:57 171,240 --a------ C:\WINNT\system32\drivers\mfehidk.sys
2007-12-30 16:07 . 2007-06-25 10:57 37,480 --a------ C:\WINNT\system32\drivers\mfesmfk.sys
2007-12-30 16:07 . 2007-06-25 10:57 34,184 --a------ C:\WINNT\system32\drivers\mfebopk.sys
2007-12-30 16:07 . 2007-06-25 10:57 32,008 --a------ C:\WINNT\system32\drivers\mferkdk.sys
2007-12-30 16:06 . 2007-06-25 14:54 71,496 --a------ C:\WINNT\system32\drivers\mfeavfk.sys
2007-12-30 16:05 . 2007-12-30 16:05 <DIR> d-------- C:\mcafee_mcpr
2007-12-30 16:05 . 2007-03-02 14:16 109,608 --a------ C:\WINNT\system32\drivers\Mpfp.sys
2007-12-30 16:00 . 2007-12-30 16:02 <DIR> d-------- C:\Program Files\McAfee.com
2007-12-30 15:58 . 2008-01-19 05:53 <DIR> d-------- C:\Program Files\McAfee
2007-12-30 15:58 . 2007-12-30 16:06 <DIR> d-------- C:\Program Files\Common Files\McAfee
2007-12-30 15:51 . 2007-12-30 15:51 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2007-12-30 15:44 . 2007-12-30 15:44 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\MailFrontier
2007-12-30 15:44 . 2008-01-17 14:34 4,212 ---h----- C:\WINNT\system32\zllictbl.dat
2007-12-30 15:43 . 2004-04-27 04:40 11,264 --a------ C:\WINNT\system32\SpOrder.dll
2007-12-30 15:41 . 2007-12-30 15:41 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\McAfee
2007-12-30 15:40 . 2008-01-17 14:27 <DIR> d-------- C:\WINNT\system32\ZoneLabs
2007-12-30 14:17 . 2007-12-30 14:17 <DIR> d-a------ C:\Program Files\AIM6
2007-12-30 14:16 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\acccore
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Grisoft
2007-12-30 14:15 . 2007-12-30 14:15 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7
2007-12-30 14:15 . 2007-12-30 14:16 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7
2007-12-30 14:14 . 2007-12-30 14:20 <DIR> d-------- C:\Program Files\AOL 9.0b
2007-12-30 14:13 . 2007-12-30 14:13 <DIR> d-a------ C:\Program Files\Common Files\aolshare
2007-12-24 21:33 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AVG7(2)
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdhlp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\cmdGuard(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgtdi(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avgclean(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsxp(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7rsw(2).sys
2007-12-24 20:57 . 2007-12-24 20:57 0 --a------ C:\WINNT\system32\drivers\avg7core(2).sys
2007-12-24 20:56 . 2007-12-30 14:12 <DIR> d-------- C:\Documents and Settings\All Users.WINNT\Application Data\Avg7(2)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2021-12-23 01:50 --------- d---a-w C:\Program Files\Electronic Arts
2021-12-21 19:30 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Ahead
2021-12-21 19:18 --------- d--ha-w C:\Program Files\InstallShield Installation Information
2021-12-21 19:18 --------- d---a-w C:\Program Files\Common Files\InstallShield
2021-12-21 18:48 --------- d-----w C:\Documents and Settings\Elizabeth1\Application Data\Microsoft Web Folders
2021-12-21 18:24 --------- d---a-w C:\Program Files\microsoft frontpage
2021-12-21 17:54 32,768 --sha-w C:\VIDEOROM.BIN
2008-01-20 18:45 14,336 ----a-w C:\WINNT\system32\svchost.exe
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\Comodo
2008-01-17 19:15 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Comodo
2008-01-16 18:06 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL
2008-01-16 17:59 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Viewpoint
2008-01-14 06:12 --------- d---a-w C:\Program Files\Common Files\AOL
2008-01-09 16:02 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\uTorrent
2007-12-30 19:17 --------- d---a-w C:\Program Files\Common Files\Nullsoft
2007-12-30 19:16 --------- d-----w C:\Documents and Settings\Elizabeth1.ELIZABETH\Application Data\AOL
2007-12-30 19:12 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\Grisoft
2007-11-28 18:04 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL OCP
2007-11-28 18:02 --------- d-----w C:\Documents and Settings\All Users.WINNT\Application Data\AOL Downloads
2007-08-26 04:23 271 --sh--w C:\Program Files\desktop.ini
2007-08-26 04:23 21,952 ---ha-w C:\Program Files\folder.htt
.

((((((((((((((((((((((((((((( snapshot@2008-01-19_ 7.25.47.95 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-19 12:02:19 1,417,216 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-20 22:48:33 1,417,216 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-19 12:02:19 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-20 22:48:33 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-19 12:02:20 6,520,832 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-20 22:48:34 6,533,120 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-19 12:02:20 151,552 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-20 22:48:34 151,552 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-19 12:02:21 1,441,792 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-20 22:48:35 1,441,792 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-19 12:02:21 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-20 22:48:35 8,192 ----a-w C:\WINNT\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2004-08-04 12:00:00 14,336 -c--a-w C:\WINNT\system32\dllcache\svchost.exe
+ 2008-01-20 18:45:54 14,336 -c--a-w C:\WINNT\system32\dllcache\svchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69E60FC8-8454-47B4-AE4E-21AF5A1B1278}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{875A1348-7674-42aa-ADAC-B4F36A004A2D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d071cf7e-6bf8-46c8-a1fd-cc57aa1cc15a}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2007-12-30 15:51 262144 --a------ C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB2B962-836F-4E8C-BC77-77C15F7610CA}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2007-12-30 15:51 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2008-01-14 16:43 4670968]
"Aim6"="" []
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 07:00 143360 C:\WINNT\system32\mobsync.exe]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [ ]
"Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2008-01-14 16:41 132496]
"HostManager"="C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe" [2008-01-14 16:41 50736]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" [ ]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-14 16:41 40048]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"combofix"="C:\WINNT\system32\cmd.exe" [2004-08-04 07:00 388608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 07:00 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 07:00 44544]

C:\Documents and Settings\All Users.WINNT\Start Menu\Programs\Startup\
AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2007-04-13 21:54:00]
Run Nintendo Wi-Fi USB Connector Registration Tool.lnk - C:\Program Files\WiFiConnector\NintendoWFCReg.exe [2007-10-01 18:52:36]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;C:\WINNT\system32\DRIVERS\DLKRTS.SYS [2001-10-17 03:03]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-30 21:03:10 C:\WINNT\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2008-01-01 07:14:09 C:\WINNT\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 18:17:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-20 18:25:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-20 23:25:23
ComboFix2.txt 2008-01-20 01:23:52
ComboFix3.txt 2008-01-19 12:28:26
ComboFix4.txt 2008-01-17 02:34:47
.
2008-01-14 22:25:00 --- E O F ---
Sonny
2008-01-20, 02:03
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:01:33 PM, on 1/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Sonny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1188906965\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.att.net
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: JT's Blocks - http://download2.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/clients/y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: SBHookSvc - Motive Communications, Inc. - C:\PROGRA~1\SBCSEL~1\SMARTB~1\SBHookSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 7923 bytes
Blade81
2008-01-20, 18:29
Hi

No need to scan that file anymore :)

Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

After that run Kaspersky online scanner and post its report (upload it to http://rapidshare.com if it doesn't fit in your post).
Sonny
2008-01-21, 00:35
Yikes. I'm not sure how Spybot and McAfee missed all these....

http:// http://rapidshare.com/files/85286816/virus_scan.txt.html (http://rapidshare.com/files/85286816/virus_scan.txt.html)
Blade81
2008-01-21, 08:16
Hi

Most bad items are in system restore. We'll clean that a bit later.


* Download OTMoveIt.exe from here and place it on your desktop:
http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe

* Open OTMoveIt.exe.
In the left pane where it says:
Paste List of Files/Folders to be Moved
, copy and paste next part:

C:\1E4.tmp
C:\Documents and Settings\Elizabeth1\My Documents\Awaiting Upload\tri-peaks-solitaire-to-go-setup.exe
C:\Program Files\Outlook Express\diso.html

Then click the MoveIt button below.
In case you get a
Bad Image
error, just click OK at the promt. It will move the file anyway.
When done, it will create a log (********_******.log -- * stands for date and time) in next folder: C:\_OTMoveIt\MovedFiles.
Copy and paste this log in your next reply with a new hijackthis log.
Sonny
2008-01-21, 19:08
I have a question. I don't use AOL anymore, but I noticed the following:

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

I noticed that it still shows up under my add/remove programs as well. If I click remove, it just brings up an uninstaller, but with no versions of AOL to remove. It's not that big of a problem, just more annoying than anything else.

C:\1E4.tmp moved successfully.
C:\Documents and Settings\Elizabeth1\My Documents\Awaiting Upload\tri-peaks-solitaire-to-go-setup.exe moved successfully.
C:\Program Files\Outlook Express\diso.html moved successfully.

Created on 01/22/2008 11:52:31


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:35 PM, on 1/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Sonny.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.att.net
O15 - Trusted Zone: http://*.att.net
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: JT's Blocks - http://download2.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download2.games.yahoo.com/games/clients/y/mjst4_x.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: SBHookSvc - Motive Communications, Inc. - C:\PROGRA~1\SBCSEL~1\SMARTB~1\SBHookSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
End of file - 7393 bytes
Blade81
2008-01-21, 19:25
I have a question. I don't use AOL anymore, but I noticed the following:

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

I noticed that it still shows up under my add/remove programs as well. If I click remove, it just brings up an uninstaller, but with no versions of AOL to remove. It's not that big of a problem, just more annoying than anything else.
I don't have any experience of AOL things so don't want to take risk a here by breaking something. Maybe you should ask at a place like PcPitstop forums (http://forums.pcpitstop.com) since this is not malware related issue and we're mainly helping with malware removing only. I believe someone at PCPitstop can help you with AOL removing :)



Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis




Next we remove all used tools.


Double-click OTMoveIt.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet, please allow it to do so.


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6 Update 4 (http://java.sun.com/javase/downloads/index.jsp).
Scroll down to where it says
The J2SE Runtime Environment (JRE) allows end-users to run Java applications.

Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.

The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u4-windows-i586-p.exe to install the newest version.


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

Comodo BOCLEAN (http://www.comodo.com/boclean/boclean.html) <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
Download Adaware
Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial (http://www.bleepingcomputer.com/forums/index.php?showtutorial=48)
The program is available for download here (http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10319876.html?tag=lst-0-1)
Download SpywareBlaster
Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
kill bits
in the registry, so that certain activex controls can't install.
If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)
You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.php?id=2859&file=11&evp=61b0e8ad41924a03c37615f4682b4cef)
SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html)

Download iespyad
It puts many bad webpages on your restricted zones list. This means that you can still view the
bad
webpages, but the webpages cannot do certain things (such as use javascripts and cookies).
If you need help understanding how it works, there is a tutorial here (http://www.bleepingcomputer.com/tutorials/tutorial53.html)
Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe)

hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok



Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:
Sonny
2008-01-21, 21:39
Everything seems to be running smooth! I really appreciate the help! Thanks a lot!
Blade81
2008-01-21, 22:02
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.