Can't remove Win32.Autorun.tmp

alphabet_soup · Sep 5, 2010

Hi there,

I am having problems with a Trojan called Win32.Autorun.tmp. Spybot is able to detect it, and I request that it fixes it each time it does so, but it seems to return every time I run the scan. Very persistent and annoying!

If anyone could help me purge it from my system forever that would be brilliant.

Logs are posted below.

Also I should note that I'm a complete noob, so if anyone can offer me advice, please do it in the most easy-to-understand way possible. Thanks!

DDS (Ver_10-03-17.01) - FAT32x86
Run by Owner at 12:26:02.54 on Sun 05/09/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.209 [GMT 10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\willmonotti\Desktop\dds.scr
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\033.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\089.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\977.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://trinity.unimelb.edu.au/portal
mDefault_Page_URL = hxxp://global.acer.com
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [vgr60] c:\windows\system32\6xc81oz.exe
uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
uRun: [faawmm] c:\windows\system32\3wwriid.exe
uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
uRun: [zaflw] c:\windows\system32\70bxny1.exe
uRun: [cydo8] c:\windows\system32\cttuzf81.exe
uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
uRun: [vqwxin] c:\windows\system32\60niy1p.exe
uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
uRun: [wrmns] c:\windows\system32\60xs0zf.exe
uRun: [cito0] c:\windows\system32\chxd60flvr.exe
uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
uRun: [dzuva] c:\windows\system32\1epqlr8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [LaunchApp] Alaunch
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KTPWare] c:\program files\elantech\ktp.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.search.selectedEngine - Wikipedia (en)
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R? Lbd;Lbd
R? WDC_SAM;WD SCSI Pass Thru driver
R? ywyyitdy;System Monitor
S? vsdatant;vsdatant
S? WDDMService;WD SmartWare Drive Manager
S? WDSmartWareBackgroundService;WD SmartWare Background Service

=============== Created Last 30 ================

2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
2010-09-01 13:53:23 0 d-----w- c:\windows\pss
2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

==================== Find3M ====================

2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

============= FINISH: 12:28:04.40 ===============

jmw3 · Sep 7, 2010

Hello & Welcome to Safer-Networking

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

In the meantime please note the following:

Any recommendations made are for your computer problems only and should NOT be used on any other computer.
Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
If you get stuck or are unsure of something please ask for a further explanation, do not guess.
It will require more than one round to properly clean your system. Continue to respond to this thread until I give you the All Clean! even if symptoms seemingly abate.

Please note that the forum is very busy and if I don't hear from you within four days this thread will be closed.
If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave & if there is no contact for that amount of time I will have to assume you have abandoned your topic.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

Thanks

Safer-Networking P2P Policy
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent

I'd like you to read the File Sharing, otherwise known as Peer To Peer. (P2P).
Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) & any other P2P programs.

DDS
Re-run DDS & post the contents of both logs... copy/pasting the contents will be fine, no need to attach the logs.

Gmer
Download GMER Rootkit Scanner from here & save it to your desktop.

Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
Save it where you can easily find it, such as your desktop, and post it in reply

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Do not run any programs while Gmer is running.

NOTE: If you cannot run GMER as indicated above, save a scan from the initial startup scan.

Before scanning, make sure all other running programs are closed & no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan

Double click the gmer.exe file

The program will begin to run & perform an initial scan. If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No

After the "initial scan" is complete, click on the Save button, save the log file to your desktop & post it in your reply

To post in next reply:
Contents of DDS log
Contents of Attach.txt
Contents of Gmer log

alphabet_soup · Sep 8, 2010

Hey jmw3! Thanks so much for replying and helping me.

The logs you requested are posted below:

"DDS":

DDS (Ver_10-03-17.01) - FAT32x86
Run by willmonotti at 13:01:38.37 on Wed 08/09/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.357 [GMT 10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
svchost.exe
C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\willmonotti\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://trinity.unimelb.edu.au/portal
mDefault_Page_URL = hxxp://global.acer.com
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyServer = wwwproxy.student.unimelb.edu.au:8000
uInternet Settings,ProxyOverride = <local>
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mWinlogon: Taskman=c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
uWinlogon: Shell=c:\recycler\s-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe,explorer.exe,c:\recycler\s-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [vgr60] c:\windows\system32\6xc81oz.exe
uRun: [lbhc6y] c:\windows\system32\lr2xd2jk.exe
uRun: [llmcdi] c:\windows\system32\bm5hdyuu.exe
uRun: [rcc86] c:\windows\system32\q1gw1ni13p.exe
uRun: [mcdi3e] c:\windows\system32\bm86y3pl.exe
uRun: [yuupgg] c:\windows\system32\ytkkfwwr.exe
uRun: [zuvqm] c:\windows\system32\kkfwwrii.exe
uRun: [upggbs] c:\windows\system32\dzpplbbxnn.exe
uRun: [wbxxoo3] c:\windows\system32\0xdyep0.exe
uRun: [teea6r] c:\windows\system32\w39ee5v1wb.exe
uRun: [tkkfww] c:\windows\system32\i1eaavmmhy.exe
uRun: [pkkgww] c:\windows\system32\ni1eaavmmh.exe
uRun: [ezqqlcc] c:\windows\system32\oojaavmmhy.exe
uRun: [Google Update] "c:\documents and settings\willmonotti\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [snoejuf] c:\windows\system32\86y2ff6.exe
uRun: [yzpf0w] c:\windows\system32\n20zvfbw.exe
uRun: [nojpk0r] c:\windows\system32\0jff66w.exe
uRun: [falhcc] c:\windows\system32\1qmmhyy.exe
uRun: [xdtyuua] c:\windows\system32\vlw2nyojzav.exe
uRun: [dzuklg2] c:\windows\system32\rsnt66k8708.exe
uRun: [uplbbxc] c:\windows\system32\pff69m1i.exe
uRun: [faawmm] c:\windows\system32\3wwriid.exe
uRun: [mmiyy6k] c:\windows\system32\fwwriiduupg.exe
uRun: [hcyytkk] c:\windows\system32\qlccxoojaa.exe
uRun: [zaflw] c:\windows\system32\70bxny1.exe
uRun: [cydo8] c:\windows\system32\cttuzf81.exe
uRun: [wcxtoeu] c:\windows\system32\70i1zuv.exe
uRun: [akvwx] c:\windows\system32\e1vbg3sn.exe
uRun: [vqwxin] c:\windows\system32\60niy1p.exe
uRun: [qhxiioj] c:\windows\system32\1cdi81u.exe
uRun: [hxdtp] c:\windows\system32\hm2noj081q.exe
uRun: [xsoo8] c:\windows\system32\sndu1klq.exe
uRun: [wrmns] c:\windows\system32\60xs0zf.exe
uRun: [cito0] c:\windows\system32\chxd60flvr.exe
uRun: [dezpq] c:\windows\system32\w2xyt081alm.exe
uRun: [dzuva] c:\windows\system32\1epqlr8.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [LaunchApp] Alaunch
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [KTPWare] c:\program files\elantech\ktp.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pkfgbh60jef.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jjkf08hm.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91whidj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbxx2dtkk.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vrhhxd66u81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86i81uf.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\siy0zpv6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\xnndj66a8.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpfl60ntdz.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tup03g0h.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0wwriid.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gccxoojaav.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hcc6oo6aa81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1tjpvbh.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s8jpvbhnz.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\vwhntjpvgrs.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\glwhidj6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fbwxc81zu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g6w81itup.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\bxx66o86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\86c81o3.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\dzpplbbx.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6kk6ww6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\qqlccxooja.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zvggrchsdez.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m86y81kvw.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w1mns86e3a.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6dtz0fq.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ddtz0fqlc.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjjfvvrh.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\lccxooz870b.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\2bcx081.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\chsdezf6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3cxyy0z.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fl5ccsty.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1yjpfl2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\d0ze81b5cn0.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\0ssneef.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\r1cteeffbw.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\z03q1hn1y.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1bh0xtt.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u87wcx1jj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ieezqqlccx.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfvvrhhd.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\3wwriid.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g1cyytkk.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\m70njee6q.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6yy6kk6.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\pfl2rx2d.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\f66rs1i3.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\di3e1aq1rs.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\hdd66u86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yy13avg86.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\91itupf.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w81itupv2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fq1ghm81.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\jfaq1mc1y.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\aql0ccsi1z.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yo1f70bmsn.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\up084xnn.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\zuklq6rcnoj.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\g3msn0eeu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\kpalmhn2.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\gbrstju1.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\l0ccxytup.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\1vfbwxc.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ll2c5xtop.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\fgb081yopu.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\eezqqlccxo.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\cxyu5ghy.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\94uufq5.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\citzkf253x.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\ekl271it.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\u3l0rx0t26.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\6g0hndd.exe
StartupFolder: c:\docume~1\willmo~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\q81cnojzavl.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\nxtopu81g8.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\w86i81ufgbr.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\yzkfagb081.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\s9efvvrcsxt.exe
StartupFolder: c:\documents and settings\willmonotti\start menu\programs\startup\tjpfvwrhii.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{51fb15f4-ad27-43bc-ad4b-dd0354fb6bbd}\Icon3E5562ED7.ico
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: {A26EB843-3715-4469-B456-842FEF3FC788} = 128.250.66.5,128.250.201.5
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\willmo~1\applic~1\mozilla\firefox\profiles\qtrsc0zj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us
FF - prefs.js: browser.startup.homepage - hxxps://www.trinitycollege.vic.edu.au/portal/today/today.php
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query=
FF - prefs.js: network.proxy.ftp - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ftp_port - 8000
FF - prefs.js: network.proxy.gopher - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.gopher_port - 8000
FF - prefs.js: network.proxy.http - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.http_port - 8000
FF - prefs.js: network.proxy.socks - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.socks_port - 8000
FF - prefs.js: network.proxy.ssl - wwwproxy.unimelb.edu.au
FF - prefs.js: network.proxy.ssl_port - 8000
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\documents and settings\willmonotti\application data\mozilla\firefox\profiles\qtrsc0zj.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\willmonotti\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2009-11-13 110592]
R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-6-21 11520]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 ywyyitdy;System Monitor;c:\windows\system32\svchost.exe -k netsvcs [2005-5-24 14336]

=============== Created Last 30 ================

2010-09-06 04:43:12 0 d-sh--w- C:\FOUND.027
2010-09-03 13:25:36 0 d-sh--w- C:\FOUND.026
2010-09-02 12:08:00 0 d-sh--w- C:\FOUND.025
2010-09-01 13:56:04 0 d-----w- c:\program files\Safer Networking
2010-09-01 13:53:23 0 d-----w- c:\windows\pss
2010-09-01 04:55:38 0 d-sh--w- C:\FOUND.024
2010-08-31 13:58:24 0 d-sh--w- C:\FOUND.023
2010-08-31 09:41:40 0 d-sh--w- C:\FOUND.022
2010-08-27 11:22:10 0 d-sh--w- C:\FOUND.021
2010-08-26 13:15:04 0 d-sh--w- C:\FOUND.020

==================== Find3M ====================

2008-10-16 01:46:40 700 ----a-w- c:\program files\studentVPN.pcf
2008-08-29 04:00:22 1073 ----a-w- c:\program files\sig.dat
2008-08-29 04:00:20 1099 ----a-w- c:\program files\vpnclient_setup.ini
2008-08-29 04:00:18 52224 ----a-w- c:\program files\vpnclient_jp.mst
2008-08-29 04:00:06 10935808 ----a-w- c:\program files\vpnclient_setup.msi
2008-08-29 04:00:04 51200 ----a-w- c:\program files\vpnclient_fc.mst
2008-08-29 04:00:00 819 ----a-w- c:\program files\vpnclient_setup.sms
2008-08-29 04:00:00 640 ----a-w- c:\program files\vpnclient_setup.pdf
2008-08-29 04:00:00 1822520 ----a-w- c:\program files\instmsiw.exe
2008-08-29 04:00:00 1708856 ----a-w- c:\program files\instmsi.exe
2008-08-29 03:59:58 56832 ----a-w- c:\program files\vpnclient_setup.exe
2008-08-29 03:58:04 221315 ----a-w- c:\program files\installservice.exe
2008-08-29 03:57:32 16505 ----a-w- c:\program files\DelayInst.exe
2004-08-03 19:00:00 160603 --sh--r- c:\windows\system32\gnhnveo.dll

============= FINISH: 13:01:54.54 ===============

"Attach":

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/02/2009 6:39:55 AM
System Uptime: 9/07/2010 10:28:54 PM (1455 hours ago)

Motherboard: Acer | | Mimid
Processor: Intel(R) Pentium(R) M processor 1.73GHz | uFCPGA | 1313/133mhz

==== Disk Partitions =========================

C: is FIXED (FAT32) - 75 GiB total, 3.589 GiB free.
D: is CDROM ()
F: is CDROM (UDF)
G: is FIXED (NTFS) - 465 GiB total, 396.211 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 6.0
Adobe Shockwave Player 11.5
AIM 7
AIM Search
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audacity 1.3.9 (Unicode)
Bonjour
Cisco Systems VPN Client 5.0.04.0300
DC++ 0.7091
Download Updater (AOL LLC)
ERUNT 1.1j
First Principles of Business Law
foobar2000 v0.9.6.9
Google Chrome
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB915865)
Intel(R) Graphics Media Accelerator Driver for Mobile
iTunes
Java Auto Updater
Java(TM) 6 Update 20
KTP Ware PS/2-WDM 5.0.1.2
LAME v3.98.2 for Audacity
Last.fm 1.5.4.24567
Microsoft .NET Framework 2.0
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Ultimate 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6.3)
NTI Backup NOW! 4
NTI CD & DVD-Maker
OGG MP3 Converter 3.2 build 827
Protected Music Converter 1.0.0.21
QuickTime
Realtek AC'97 Audio
RunAlyzer
Safari
Skills-Task 2 Feedback
SMSC IrCC V5.1.3600.5 SP2
SoftV90 Data Fax Modem with SmartCP
Spybot - Search & Destroy
Total Commander (Remove or Repair)
Trillian
Universal Soccer Manager 2
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
WD SmartWare
WebFldrs XP
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Installer 3.1 (KB893803)
Windows XP Hotfix - KB885855
WinRAR archiver
WinZip
Xiph QuickTime Components

==== Event Viewer Messages From Past Week ========

4/09/2010 12:29:49 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer B38EF8B56EAF41E that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C0. The master browser is stopping or an election is being forced.
4/09/2010 10:10:04 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
4/09/2010 1:01:15 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service.
2/09/2010 7:47:08 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
2/09/2010 4:28:20 PM, error: Service Control Manager [7000] - The Ati HotKey Poller service failed to start due to the following error: The system cannot find the file specified.
2/09/2010 12:17:58 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ERIC-SINCLAIR that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
2/09/2010 11:08:44 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer H203-28-242-83 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09. The master browser is stopping or an election is being forced.
1/09/2010 7:48:08 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Lbd
1/09/2010 7:48:08 PM, error: Service Control Manager [7023] - The System Monitor service terminated with the following error: A dynamic link library (DLL) initialization routine failed.
1/09/2010 3:03:54 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer REICHART-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-41. The master browser is stopping or an election is being forced.
1/09/2010 2:58:56 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
1/09/2010 2:56:09 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
1/09/2010 2:03:25 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SOPHIEBOUCAUT that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-. The master browser is stopping or an election is being forced.
1/09/2010 1:00:01 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SCOTT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-4150-. The master browser is stopping or an election is being forced.

==== End Of File ===========================

"GMER":

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-08 13:23:22
Windows 5.1.2600 Service Pack 2
Running: umsywfnu.exe; Driver: C:\DOCUME~1\WILLMO~1\LOCALS~1\Temp\ugldqpod.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xAA773930]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xAA77EA80]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xAA773F20]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xAA77F6E0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xAA77F440]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xAA77F8B0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xAA773D70]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xAA780250]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xAA77FCB0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xAA780080]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xAA774120]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xAA77F140]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 4 Bytes JMP D25AAA77
? System32\Drivers\hiber_WMILIB.SYS The system cannot find the path specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[320] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 0165ADCD
.text C:\WINDOWS\System32\svchost.exe[320] NETAPI32.dll!NetpwPathCanonicalize 5B86A259 5 Bytes JMP 0165AD64
.text C:\WINDOWS\system32\svchost.exe[432] ntdll.dll!NtQueryInformationProcess 7C90E01B 5 Bytes JMP 008CADCD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1620] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2320] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + 6 7C90D688 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtCreateFile + B 7C90D68D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 1 Byte [28]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + 6 7C90DC5B 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtMapViewOfSection + B 7C90DC60 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + 6 7C90DD03 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenFile + B 7C90DD08 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + 6 7C90DD81 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcess + B 7C90DD86 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + 6 7C90DD96 4 Bytes CALL 7B90F39C
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessToken + B 7C90DD9B 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + 6 7C90DDAB 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenProcessTokenEx + B 7C90DDB0 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + 6 7C90DDFF 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThread + B 7C90DE04 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + 6 7C90DE14 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadToken + B 7C90DE19 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + 6 7C90DE29 4 Bytes CALL 7B90F430
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtOpenThreadTokenEx + B 7C90DE2E 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + 6 7C90DEE6 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryAttributesFile + B 7C90DEEB 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + 6 7C90DFB8 4 Bytes CALL 7B90F5BD
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtQueryFullAttributesFile + B 7C90DFBD 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + 6 7C90E5DF 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationFile + B 7C90E5E4 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + 6 7C90E648 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtSetInformationThread + B 7C90E64D 1 Byte [E2]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 1 Byte [68]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + 6 7C90E966 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2664] ntdll.dll!NtUnmapViewOfSection + B 7C90E96B 1 Byte [E2]

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\svchost.exe (*** hidden *** ) [AUTO] ywyyitdy <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000b6b5d6d42
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@DisplayName System Monitor
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000b6b5d6d42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@DisplayName System Monitor
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Type 32
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Start 2
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy@Description Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\ywyyitdy\Parameters@ServiceDll C:\WINDOWS\system32\gnhnveo.dll

---- EOF - GMER 1.0.15 ----

Thanks again!

jmw3 · Sep 8, 2010

Hmmm.... We've got some work to do.
Windows XP Service Pack 2 & no Anti-Virus software. This is no doubt why you are so heavily infected.
First up, some warnings advice you should seriously take heed of.

WARNING!!!

You are running a version of Windows that is no longer supported. You need to be aware that once an operating system is no longer supported there will be no further Microsoft Updates issued for that operating system. If you are running XP SP2, or running Vista with no Service Packs installed, be forewarned that those unpatched operating systems will soon become prime targets for malware infestations unless you take steps to bring them up to date by installing the required Service Pack for your system.

http://windows.microsoft.com/en-us/windows/help/what-does-end-of-support-mean

Support for Windows Vista without any service packs ended on April 13, 2010. To continue support, make sure you've installed Windows Vista SP2.

Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010. To continue support, make sure you've installed Windows XP Service Pack 3 (SP3).

IMPORTANT: The above mentioned Service Packs should only be installed on a malware free computer.
So wait until I have given the All Clean.

NOTE: 64 bit Windows XP SP2 will still receive security updates as there is no SP3 for 64 bit XP.

Support for Windows XP SP1 ended on October 10, 2006.

No Anti-virus
You don't have any evidence of anti-virus software.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Download a free anti-virus software from one these excellent vendors NOW:

1) Microsoft Security Essentials - Microsoft Security Essentials provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
2) Antivir PersonalEdition Classic- Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
3) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.

Your computer must have only ONE anti-virus program installed at any time. Having more than one anti-virus program installed & active will cause program conflicts, false virus alerts, and system crashes.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. If you have a problem with one step, just move to the next.

Create A System Restore Point
Create a new System Restore point which you can use in case of any problems that may occur:
Press Start->All Programs->Accessories->System Tools->System Restore
Select Create a restore point, then Next, type a name like Pre-Cleaning then press the Create button and once it's done press Close

TFC (Temp File Cleaner)
Download TFC (Temp File Cleaner) by Old Timer Here & save it to your desktop.

Save any unsaved work. TFC Cleaner will close all open application windows
Double-click TFC.exe to run the program, your desktop will temporarily disappear
If prompted, click Yes to reboot

Note: Save your work.. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take any longer than a couple of minutes & may only take a few seconds. Only if needed will you be prompted to reboot.

ComboFix
Download ComboFix from one of these locations (DO NOT download ComboFix from anywhere else but one of the provided links):
Link 1
Link 2

**IMPORTANT !!! Save ComboFix.exe to your Desktop**

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
A guide to do this can be found here
Double click on ComboFix.exe & follow the prompts
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply

A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
ComboFix log
Update on how the computer is running

alphabet_soup · Sep 8, 2010

Hi there

thanks again for your post and assistance

I started running Combo Fix and it asked me if I needed to download the Microsoft Windows Recovery Console, I selected "Yes", then it came up with this message:

So I pressed "OK" and this came up:

I'm not sure how to proceed, have you any idea? Should I re-download Combo Fix?

Cheers

jmw3 · Sep 8, 2010

Hi

jmw3 said:
# As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
# Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

No need to re-download, but allow it to install the Recovery Console

jmw3 · Sep 8, 2010

Sorry... misread what you said.

Yes, delete the copy of ComboFix you have & re-download it. before saving it rename it to commy.exe, then try running it.

alphabet_soup · Sep 8, 2010

Hmmm...still didn't work!

After pressing OK again when I got the message about the Licence Agreement, this is what came up

Then I pressed "close" and the same error message showed up again.

jmw3 · Sep 8, 2010

OK... Leave ComboFix for a bit. We'll try & get rid of some the crap that's on your computer to see if it makes any difference.

Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here & save to your desktop.

Double-click mbam-setup.exe & follow the prompts to install the program
At the end, be sure a checkmark is placed next to:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish
If an update is found, it will download and install the latest version
Once the program has loaded, select Perform full scan, then click Scan
When the scan is complete, click OK, then Show Results to view the results
Check all items except items in the C:\System Volume Information folder... then click on Remove Selected
When completed, a log will open in Notepad. Please copy & paste the log back into your next reply
Note:
The log is automatically saved by Malwarebytes' Anti-Malware & can be viewed by clicking the Logs tab

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either & let Malwarebytes' Anti-Malware proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
If you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once & does not need to be reported unless it returns on future reboots.

alphabet_soup · Sep 8, 2010

Swell...ok here's the Malwarebytes log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

8/09/2010 10:35:06 PM
mbam-log-2010-09-08 (22-35-06).txt

Scan type: Full scan (C:\|)
Objects scanned: 176360
Time elapsed: 22 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 8
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\.pox (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\pofile (Rogue.FixTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Miracle (PUP.PerfectOptimizer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Application (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Files Infected:
C:\RECYCLER\S-1-5-21-9624512614-5829467475-673620608-5226\rundll32.exe (Worm.P2P) -> Delete on reboot.
C:\RECYCLER\S-1-5-21-7356296101-1933998588-915145784-2179\yv8g67.exe (Worm.Autorun.B) -> Delete on reboot.
C:\Program Files\Perfect Optimizer\PerfectOptimizer.ini (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

jmw3 · Sep 8, 2010

Hi

OK good. But the Database version you used to run Malwarebytes' Anti-Malware was woefully out of date. The current Database version is 4570 (at the time of this post).

Can you run Malwarebytes' again, ensuring you click the Update tab then Check for Updates before conducting the scan. Then post the log.

Cheers

alphabet_soup · Sep 8, 2010

I tried updating but got this error message:

Any ideas? Thanks again

alphabet_soup · Sep 8, 2010

EDIT: Never mind - just realised I needed to change the proxy settings! Running the scan again now

jmw3 · Sep 8, 2010

OK, good

alphabet_soup · Sep 9, 2010

Hey, sorry, the scan was running really slowly last night so I abandoned it and tried again this morning - much faster.

Anyway, here's the log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4576

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

9/09/2010 10:16:30 AM
mbam-log-2010-09-09 (10-16-30).txt

Scan type: Full scan (C:\|)
Objects scanned: 195308
Time elapsed: 19 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 136

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0d82acd6-a652-4496-a298-2bde705f4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025e484-d4b0-441a-9f0b-69063bd679ce} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258b35c-05b8-4c0e-9525-9bccc70f8f2d} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{a89256ad-ec17-4a83-bef5-4b8bc4f39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7} (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults\preferences (Adware.BarDiscover) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\willmonotti\Local Settings\Temp\709.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\621.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\047.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\421.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\188.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\995.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temp\889.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\C1IJGD6N\vewmknm[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\C1IJGD6N\fekoikj[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0P2BWPI3\fewmok[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0P2BWPI3\fewmkojk[1].exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\G9MBOXE3\fewmi[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\G9MBOXE3\jmokjo1[1].exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Local Settings\Temporary Internet Files\Content.IE5\0DE3S56V\dfwemklm[1].exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\pkfgbh60jef.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jjkf08hm.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91whidj.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gbxx2dtkk.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\vrhhxd66u81.exe (Trojan.DDox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\86i81uf.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\siy0zpv6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\xnndj66a8.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\kpfl60ntdz.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\tup03g0h.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0wwriid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gccxoojaav.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hcc6oo6aa81.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1tjpvbh.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\s8jpvbhnz.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\vwhntjpvgrs.exe (Worm.Autorun) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\glwhidj6.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fbwxc81zu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g6w81itup.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\bxx66o86.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\86c81o3.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\dzpplbbx.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6kk6ww6.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\qqlccxooja.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zvggrchsdez.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\m86y81kvw.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w1mns86e3a.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6dtz0fq.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ddtz0fqlc.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\tjjfvvrh.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\lccxooz870b.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2bcx081.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\chsdezf6.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\3cxyy0z.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fl5ccsty.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1yjpfl2.exe (BackDoor.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\d0ze81b5cn0.exe (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0ssneef.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\r1cteeffbw.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\z03q1hn1y.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1bh0xtt.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\u87wcx1jj.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ieezqqlccx.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jfvvrhhd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\3wwriid.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g1cyytkk.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\m70njee6q.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6yy6kk6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\pfl2rx2d.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\f66rs1i3.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\di3e1aq1rs.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hdd66u86.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\yy13avg86.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91itupf.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w81itupv2.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fq1ghm81.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\jfaq1mc1y.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\aql0ccsi1z.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\yo1f70bmsn.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\up084xnn.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zuklq6rcnoj.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\g3msn0eeu.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\kpalmhn2.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\gbrstju1.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\l0ccxytup.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1vfbwxc.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ll2c5xtop.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fgb081yopu.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\eezqqlccxo.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\cxyu5ghy.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\94uufq5.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\citzkf253x.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ekl271it.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\u3l0rx0t26.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6g0hndd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\q81cnojzavl.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\nxtopu81g8.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w86i81ufgbr.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\s9efvvrcsxt.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\hcdi81fabg.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w1n70jzf.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\c86o81almhx.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2y5tpkl.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\mhn60pvfbw.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\91mxytz.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\2too6aa.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\r0xtoo6aa.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\wriiduupgg.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\riiduupggbs.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1wssnee.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\a1wssneezq.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\rmm6yy6kk.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\llhxxtjjfvv.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\1t703a0.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\i6y86k81w.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\j70qqgw1n7.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0oojffb.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\0uk0ggb.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ggbssnee.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fbrrnddz.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\70lhcc6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\nnjzup6rhhd.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6qq6cc6.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\neezqqlccxo.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\avmmhddz.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\6mxyytk.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\fa1whi0eez.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\zavlmhs8.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\081cnoj.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\lr66i86u.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\w6m81yjkf.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\mc0dtz66q8.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\sxnt60vblh.exe (Trojan.Refroso.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\rnn2tppll2r.exe (Trojan.Refroso) -> Quarantined and deleted successfully.
C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\q3cxd601v7.exe (Trojan.Lethic) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001383.exe (Worm.P2P) -> Not selected for removal.
C:\System Volume Information\_restore{7800EBD7-CFEF-41F0-BA9C-926303D6447E}\RP2\A0001384.exe (Trojan.Agent) -> Not selected for removal.
C:\FOUND.022\FILE0001.CHK (Trojan.Ddox) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\install.rdf (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome.manifest (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\chrome\bardiscover.jar (Adware.BarDiscover) -> Quarantined and deleted successfully.
C:\Program Files\Mozilla Firefox\extensions\{AC57FCAF-E6FC-4BE9-ADC0-D00129C4C1E7}\defaults\preferences\prefs.js (Adware.BarDiscover) -> Quarantined and deleted successfully.

jmw3 · Sep 9, 2010

Hi

That looks better. Let's try ComboFix again. Delete the version of ComboFix you have & download it again:
Link 1
Link 2

Run it following instructions previously posted & post the resulting log.

alphabet_soup · Sep 9, 2010

alphabet_soup said:
Hmmm...still didn't work!

After pressing OK again when I got the message about the Licence Agreement, this is what came up

Then I pressed "close" and the same error message showed up again.

^^^ Unfortunately I'm still getting this error...

jmw3 · Sep 9, 2010

Hi

Leave ComboFix for the time being.

OTL
Download OTL by Old Timer from Here & save it to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed & to let it run uninterrupted
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop - Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying Click Ok to load a custom scan from a file or Cancel to cancel
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt & click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long
- When the scan completes, it will open two notepad windows OTL.Txt & Extras.Txt. These are saved in the same location as OTL
- Copy/paste the contents of these files, one at a time & post them in your next reply

To post in next reply:
Contents of OTL.txt
Contents of Extras.txt
These are large logs, so one log per post please

jmw3 · Sep 9, 2010

What happens if you click Ignore on that message?

alphabet_soup · Sep 9, 2010

jmw3 said:
What happens if you click Ignore on that message?

I haven't tried it; I assumed it would start running the scan without the Recovery Console?

Will do the OTL stuff now

Can't remove Win32.Autorun.tmp

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member

New member