I have malware, but cant download Kaspersky

maui78 · Feb 17, 2008

Hi there.

Its my first time on here, so I want to thank the people who organise and help on this website in advance. I hope you can help me

I have got a virus/malware on my computer. Its one where I first of all started getting directed to a funny website from google and now I cant use i net explorer at all.

I am using a work laptop to download Spybot and Kasper and then adding it to my infected machine in an attempt to get a post on here. I have managed to download S&D, but becuase of the non admin permissons on the work laptop I cannot download Kasper.

Is there anything I can do? Will the info I give you out of S&D be enough to get us started or is it not possible.

I am lost as what to do,

Thanks in advance

Maui

maui78 · Feb 17, 2008

I now have my hijack this code:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:12:21, on 17/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2A493D5F-8914-4D3E-8BF3-767F281862F4} (TraderMediaImgX Control) - http://sell.autotrader.co.uk/uk-ola/common/TraderMediaX.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168032801046
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

--
End of file - 9969 bytes

katana · Feb 24, 2008

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

I apologize for the delay in responding, but as you can probably see the forums are quite busy
and sometimes a post manages to slip by us.
Unfortunately there are far more people needing help than there are helpers.

----------------------------------------------------------------------------------------

When you say that you can't access the net at all, is it just IE that is causing problems ?
Can you update your AV, or does it give you an error.

If it is only IE, then please do the following

Download FireFox and install it.

Either way, please do this

Installed Programs

Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

maui78 · Feb 25, 2008

Hi there.

Thanks for picking up my request for help. I have an exam in just over a weeks time and I really need to computer for research, so I want to get it back ASAP

To answer some of your questions. It is just IE that is not working. I can open it, but when I click on a site it is very very slow and often other windows open. These windows are named "search rtesults.com

One other odd thing I have is that since I installed and ran search and destroy I am getting a warning when I turn machine on saying a reg entry has been changed "do I want to except the changes". I so far have said no as I ma not sure what the reg entry is. Should i except this or just leave it for now?

I have downloaded firefox. I have done this by downloading to external harddrive from my laptop and transferring the programe to the infectted PC. Please let me know what you want me to do with this. Actually whilst writting this I have installewd it. I assuem its another type of IE that the bug I have hasnt infectted, therefore I can access web pages on it.

below is the list of the programmes as requested.
Thanks again Maui

360Share Pro(remove only)
Ace DivX Player
Adobe Flash Player ActiveX
Adobe Photoshop 5.0 Limited Edition
Adobe Reader 8.1.0
Adobe® Photoshop® Album Starter Edition 3.0
Apple Mobile Device Support
Apple Software Update
BBC iPlayer Download Manager
Bonusprint PhotoBook Editor
CC_ccProxyExt
ccCommon
ccPxyCore
HijackThis 2.0.2
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
HP Deskjet 460
HP Deskjet 460 Series
iTunes
J2SE Runtime Environment 5.0 Update 4
Learn2 Player (Uninstall Only)
LimeWire 4.14.10
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Shockwave Player
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2003 Web Components
Microsoft Office InfoPath 2003 SDK
Microsoft Office Professional Edition 2003
Microsoft Office Project Professional 2003
Microsoft Office Visio IFilter 2003
Microsoft Office Visio Professional 2003
Microsoft Office XP Web Components
Microsoft Producer for Microsoft Office PowerPoint 2003
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MP3 WAV Converter 2.65
MSRedist
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Music Manager
Norton AntiSpam
Norton AntiSpam
Norton AntiVirus 2006
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security 2006 (Symantec Corporation)
Norton Protection Center
Norton WMI Update
Norton WMI Update
Packard Bell - Skype 2.0
Photodex Presenter
QuickTime
RealPlayer
Realtek AC'97 Audio
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893066)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Sonic Express Labeler
Sonic MyDVD LE
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
SPBBC
Spybot - Search & Destroy
Symantec KB-DocID:2003093015493306
TomTom HOME
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB900930)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911164)
Viewpoint Media Player
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Media Format Runtime
Windows Media Player 10
Windows Resource Kit Tools
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890546
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891220
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB892627
Windows XP Hotfix - KB893086

katana · Feb 25, 2008

Firefox is an internet browser similar to IE, but many people think it is better

If you install it then it will mean you can download tools directly to the infected machine, and it will be much easier to get the logs back to me.

Now, for those registry warnings...we need to disable Teatimer as it will stop us being able to fix the problems.

Disable Teatimer
First step:

Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\\Documents and Settings\\Username\\Application Data\\Malwarebytes\\Malwarebytes' Anti-Malware\\Logs\\mbam-log-date (time).txt

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

If you have any questions, don't hesitate to ask :bigthumb:

maui78 · Feb 26, 2008

Hi Again

Is it me or is firefox quicker than IE? You said that some people find i better. Whta is better with it?

I have done all you have asked and here are the logs.

hj this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:59:17, on 26/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2A493D5F-8914-4D3E-8BF3-767F281862F4} (TraderMediaImgX Control) - http://sell.autotrader.co.uk/uk-ola/common/TraderMediaX.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168032801046
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

--
End of file - 9562 bytes

Next one

Malwarebytes' Anti-Malware 1.05
Database version: 408

Scan type: Quick Scan
Objects scanned: 46292
Time elapsed: 15 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\E404.e404mgr (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\foundbadfile1 (Trojan.Zlob) -> Quarantined and deleted successfully.

ComboFix 08-02-25.3 - Matt 2008-02-26 20:38:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.67 [GMT 0:00]
Running from: C:\Documents and Settings\Matt.ML\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Documents and Settings\Matt.ML\Application Data\Malwarebytes
2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-18 20:41 . 2008-02-18 20:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-18 20:41 . 2008-02-18 20:41 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-17 16:55 . 2008-02-17 16:55 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-17 16:49 . 2008-02-17 16:49 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-17 16:49 . 2008-02-17 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 16:18 . 2008-02-17 16:18 <DIR> d-------- C:\Documents and Settings\Matt.ML\Application Data\Skype
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-02-17 16:15 . 2008-02-17 16:15 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-17 14:13 . 2008-02-17 14:32 <DIR> d-------- C:\VundoFix Backups
2008-02-17 13:22 . 2008-02-17 13:51 2,920 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-17 13:19 . 2006-09-04 11:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Program Files\Symantec
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-17 00:15 . 2008-02-16 18:20 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-02-17 00:15 . 2008-02-26 20:14 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-13 21:46 . 2008-02-13 21:46 197 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-12 22:07 . 2008-02-12 22:07 1,152 --a------ C:\WINDOWS\system32\windrv.sys
2008-02-03 18:06 . 2008-02-03 18:06 <DIR> d-------- C:\Program Files\Kontiki
2008-02-03 18:06 . 2008-02-26 20:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kontiki

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 16:17 --------- d-----w C:\Program Files\CodeStuff
2008-02-17 13:45 --------- d-----w C:\Documents and Settings\Matt.ML\Application Data\AOL
2008-02-12 22:07 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-02-09 23:23 --------- d-----w C:\Program Files\Windows Live
2008-02-09 20:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-05 19:36 --------- d-----w C:\Documents and Settings\Matt.ML\Application Data\LimeWire
2008-01-21 18:48 --------- d-----w C:\Program Files\Hewlett-Packard
2008-01-19 14:57 --------- d-----w C:\Documents and Settings\Lucy\Application Data\LimeWire
2003-09-08 14:08 653,312 -c--a-w C:\Program Files\WinUI.vsd
2003-08-28 08:19 239,616 -c--a-w C:\Program Files\FluidPwr.vsd
2003-07-28 15:53 600,064 -c--a-w C:\Program Files\OrgChart.vsd
2003-07-28 15:47 388,096 -c--a-w C:\Program Files\Calendar.vsd
2003-07-28 15:46 75,776 -c--a-w C:\Program Files\BFlowcht.vsd
2003-07-28 15:44 115,712 -c--a-w C:\Program Files\Brainstm.vsd
2003-07-28 13:28 577,024 -c--a-w C:\Program Files\UML.vsd
2003-07-28 13:27 249,344 -c--a-w C:\Program Files\Database.vsd
2003-07-28 11:07 156,672 -c--a-w C:\Program Files\Timeline.vsd
2003-07-28 11:01 161,280 -c--a-w C:\Program Files\EECtrl.vsd
2003-07-28 10:54 371,712 -c--a-w C:\Program Files\ProcEng.vsd
2003-07-25 15:33 1,236,480 -c--a-w C:\Program Files\BldgPlan.vsd
2003-07-25 09:50 411,648 -c--a-w C:\Program Files\MeetRoom.vsd
2003-07-25 07:44 151,040 -c--a-w C:\Program Files\WebDsgn.vsd
2003-07-24 14:47 342,016 -c--a-w C:\Program Files\WebSite.vsd
2003-07-24 14:11 285,184 -c--a-w C:\Program Files\Rack.vsd
2003-07-24 13:51 560,640 -c--a-w C:\Program Files\DNetwork.vsd
2003-07-24 13:10 176,640 -c--a-w C:\Program Files\BNetwork.vsd
2003-07-24 09:47 50,176 -c--a-w C:\Program Files\BlkDiagm.vsd
2003-07-24 09:22 205,312 -c--a-w C:\Program Files\ActvDir.vsd
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}]
2006-07-04 22:48 206552 --a------ C:\Program Files\RXToolBar\sfcont.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2008-01-25 10:08 1032376]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-01-18 19:05 19417640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 21:19 52840]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 22:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 22:50 81920]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2004-07-27 22:50 221184]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-04 10:25 98304]
"SNM"="C:\Program Files\SpyNoMore\SNM.exe" [ ]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42 212992]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-09-04 10:24 26112]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2004-04-08 14:38 496752]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-03-19 20:17 78960]

Thanks again.

katana · Feb 26, 2008

Firefox is considered safer than IE because (at the moment ) there are less attacks aimed at it.

There isn't much showing in your log that would be causing problems,

Please can you post the Combofix log again, it looks like it got cut off

Your Java and Adobe is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java and Adobe components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u4 from http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Update Adobe Acrobat Reader

Please go to this link Adobe Acrobat Reader Download Link
Cllick Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

Now close all windows, including your browser.
Double click on the Java installation that you downloaded and follow the prompts.

Remove Programs
Now click Start---Control Panel. Double click Add or Remove Programs. If any of the following programs are listed there,
click on the program to highlight it, and click on remove.

J2SE Runtime Environment 5.0 Update 4

Now close the Control Panel.

Reboot your machine.

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

LimeWire 4.14.10

I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.

My recommendation is you go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
Please note: you must NOT use this whilst we are cleaning your machine.

maui78 · Feb 27, 2008

Katanna

I am work art the moment. But I thought I would write you a quick response. You say that you see nothing that should be causing me a problem. I will jsut let you know what problems I ma getting still

If i open IE and type in a http address another window opens (firefox currenlty as its my default)then it stallas and nothing happens, or if it does it is very slow.

Also when I click on the IE shortcut on my desktop it auto creates another shortcut. The one in the task bar works fine, and opne IE.

My machine is also taking along time to shut down. I would say around 4 time longer than usual.

I will post an update of my log and update the programmes you suggestted when I get home this evening.

maui78 · Feb 27, 2008

I have problems trying to donwload the java stuff. I went to donwload and opne in the usual way on firefox. The it said unable to open sun donwload manager. Whta should I do about this?

Here is my combo log you asked for

ComboFix 08-02-25.3 - Matt 2008-02-26 20:38:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.67 [GMT 0:00]
Running from: C:\Documents and Settings\Matt.ML\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\_000007_.tmp.dll
C:\WINDOWS\system32\_000010_.tmp.dll
C:\WINDOWS\system32\_000011_.tmp.dll
C:\WINDOWS\system32\_000012_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-26 to 2008-02-26 )))))))))))))))))))))))))))))))
.

2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Documents and Settings\Matt.ML\Application Data\Malwarebytes
2008-02-26 20:06 . 2008-02-26 20:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-18 20:41 . 2008-02-18 20:41 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-18 20:41 . 2008-02-18 20:41 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-17 16:55 . 2008-02-17 16:55 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-17 16:49 . 2008-02-17 16:49 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-17 16:49 . 2008-02-17 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 16:18 . 2008-02-17 16:18 <DIR> d-------- C:\Documents and Settings\Matt.ML\Application Data\Skype
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-02-17 16:17 . 2008-02-17 16:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-02-17 16:15 . 2008-02-17 16:15 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-17 14:13 . 2008-02-17 14:32 <DIR> d-------- C:\VundoFix Backups
2008-02-17 13:22 . 2008-02-17 13:51 2,920 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-17 13:19 . 2006-09-04 11:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Program Files\Symantec
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-02-17 00:16 . 2008-02-17 00:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-17 00:15 . 2008-02-16 18:20 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-02-17 00:15 . 2008-02-26 20:14 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-13 21:46 . 2008-02-13 21:46 197 --a------ C:\WINDOWS\system32\MRT.INI
2008-02-12 22:07 . 2008-02-12 22:07 1,152 --a------ C:\WINDOWS\system32\windrv.sys
2008-02-03 18:06 . 2008-02-03 18:06 <DIR> d-------- C:\Program Files\Kontiki
2008-02-03 18:06 . 2008-02-26 20:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kontiki

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 16:17 --------- d-----w C:\Program Files\CodeStuff
2008-02-17 13:45 --------- d-----w C:\Documents and Settings\Matt.ML\Application Data\AOL
2008-02-12 22:07 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-02-09 23:23 --------- d-----w C:\Program Files\Windows Live
2008-02-09 20:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-05 19:36 --------- d-----w C:\Documents and Settings\Matt.ML\Application Data\LimeWire
2008-01-21 18:48 --------- d-----w C:\Program Files\Hewlett-Packard
2008-01-19 14:57 --------- d-----w C:\Documents and Settings\Lucy\Application Data\LimeWire
2003-09-08 14:08 653,312 -c--a-w C:\Program Files\WinUI.vsd
2003-08-28 08:19 239,616 -c--a-w C:\Program Files\FluidPwr.vsd
2003-07-28 15:53 600,064 -c--a-w C:\Program Files\OrgChart.vsd
2003-07-28 15:47 388,096 -c--a-w C:\Program Files\Calendar.vsd
2003-07-28 15:46 75,776 -c--a-w C:\Program Files\BFlowcht.vsd
2003-07-28 15:44 115,712 -c--a-w C:\Program Files\Brainstm.vsd
2003-07-28 13:28 577,024 -c--a-w C:\Program Files\UML.vsd
2003-07-28 13:27 249,344 -c--a-w C:\Program Files\Database.vsd
2003-07-28 11:07 156,672 -c--a-w C:\Program Files\Timeline.vsd
2003-07-28 11:01 161,280 -c--a-w C:\Program Files\EECtrl.vsd
2003-07-28 10:54 371,712 -c--a-w C:\Program Files\ProcEng.vsd
2003-07-25 15:33 1,236,480 -c--a-w C:\Program Files\BldgPlan.vsd
2003-07-25 09:50 411,648 -c--a-w C:\Program Files\MeetRoom.vsd
2003-07-25 07:44 151,040 -c--a-w C:\Program Files\WebDsgn.vsd
2003-07-24 14:47 342,016 -c--a-w C:\Program Files\WebSite.vsd
2003-07-24 14:11 285,184 -c--a-w C:\Program Files\Rack.vsd
2003-07-24 13:51 560,640 -c--a-w C:\Program Files\DNetwork.vsd
2003-07-24 13:10 176,640 -c--a-w C:\Program Files\BNetwork.vsd
2003-07-24 09:47 50,176 -c--a-w C:\Program Files\BlkDiagm.vsd
2003-07-24 09:22 205,312 -c--a-w C:\Program Files\ActvDir.vsd
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}]
2006-07-04 22:48 206552 --a------ C:\Program Files\RXToolBar\sfcont.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2008-01-25 10:08 1032376]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-01-18 19:05 19417640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2005-03-08 02:33 53248 C:\WINDOWS\system32\VTTimer.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 21:19 52840]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 22:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 22:50 81920]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2004-07-27 22:50 221184]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-04 10:25 98304]
"SNM"="C:\Program Files\SpyNoMore\SNM.exe" [ ]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 20:42 212992]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-09-04 10:24 26112]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2004-04-08 14:38 496752]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [2004-03-19 20:17 78960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 12:00 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\AOL 9.0\\waol.exe"=
"C:\\APPS\\Powercinema\\PowerCinema.exe"=
"C:\\APPS\\Powercinema\\PCMService.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

S3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-28 11:42:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-08-01 19:58:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\WINDOWS\system32\cleanmgr.exe
"2006-12-28 23:39:40 C:\WINDOWS\Tasks\HDReg.job"
- c:\Apps\HDReg\HDRegRem.exe
"2007-12-14 20:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Lucy Scott.job"
- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:
"2006-09-04 10:32:46 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-26 20:42:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = ?IKI.DLL

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-26 20:45:44
ComboFix-quarantined-files.txt 2008-02-26 20:45:41
.
2008-02-13 21:46:24 --- E O F ---

Cheers

Maui

katana · Feb 27, 2008

Have you tried using Windows Update to get IE 7 ? see if that stops some of the problems.

There is nothing at all showing in your logs yet, that would be causing the trouble you describe.

Deckard's System Scanner (DSS)

Please download Deckard's System Scanner (DSS) to your Desktop.
Note: You must be logged onto an account with administrator privileges.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

We can sort the Java issue after you are running properly.

maui78 · Feb 28, 2008

Deckard's System Scanner v20071014.68
Run by Matt on 2008-02-28 21:09:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
66: 2008-02-28 21:09:23 UTC - RP274 - Deckard's System Scanner Restore Point
65: 2008-02-28 19:23:08 UTC - RP273 - Installed Windows Internet Explorer 7.
64: 2008-02-28 19:21:13 UTC - RP272 - Installed Windows IDNMitigationAPIs.
63: 2008-02-28 19:20:25 UTC - RP271 - Installed Windows NLSDownlevelMapping.
62: 2008-02-28 19:19:10 UTC - RP270 - Installed Windows XP KB915865.

-- First Restore Point --
1: 2007-12-02 13:21:38 UTC - RP209 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

Percentage of Memory in Use: 79% (more than 75%).
Total Physical Memory: 448 MiB (512 MiB recommended).

-- HijackThis (run as Matt.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:12:04, on 28/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Matt.ML\Desktop\dss.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Matt.exe
C:\Program Files\Norton Internet Security\CfgWiz.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SNM] C:\Program Files\SpyNoMore\SNM.exe /startup
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2A493D5F-8914-4D3E-8BF3-767F281862F4} (TraderMediaImgX Control) - http://sell.autotrader.co.uk/uk-ola/common/TraderMediaX.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by116fd.bay116.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168032801046
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://express.foto.com/NewUploader/ImageUploader4.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

--
End of file - 10163 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 ASCTRM - c:\windows\system32\drivers\asctrm.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

S3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\progra~1\belkin\f5d9050\gtndis5.sys (file missing)
S3 StreamSurge (StreamSurge Driver (miniport)) - c:\windows\system32\drivers\ss.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 CLCapSvc (CyberLink Background Capture Service (CBCS)) - "c:\apps\powercinema\kernel\tv\clcapsvc.exe" <Not Verified; ; CLCapSvc Module>
R2 CLSched (CyberLink Task Scheduler (CTS)) - "c:\apps\powercinema\kernel\tv\clsched.exe" <Not Verified; ; CLSched Module>
R2 CyberLink Media Library Service - "c:\apps\powercinema\kernel\clml_ntservice\clmlserver.exe" <Not Verified; Cyberlink; Cyberlink Media Library Server>
R2 USBDeviceService - c:\program files\sonic\digitalmedia le v7\mydvd le\usbdeviceservice.exe <Not Verified; ; USBDeviceService Module>

-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.

-- Scheduled Tasks -------------------------------------------------------------

2008-01-28 11:42:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-12-14 20:00:00 558 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Lucy Scott.job
2007-08-01 19:58:00 270 --a------ C:\WINDOWS\Tasks\Disk Cleanup.job
2006-12-28 23:39:40 200 --a------ C:\WINDOWS\Tasks\HDReg.job
2006-09-04 10:32:46 364 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job

-- Files created between 2008-01-28 and 2008-02-28 -----------------------------

2008-02-27 19:35:59 1007 --a------ C:\WINDOWS\mozver.dat
2008-02-26 20:37:12 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-02-26 20:37:12 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-02-26 20:37:12 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-02-26 20:37:12 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-02-26 20:06:14 0 d-------- C:\Documents and Settings\Matt.ML\Application Data\Malwarebytes
2008-02-26 20:06:09 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-02-26 20:06:07 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-02-25 20:47:14 0 d-------- C:\Documents and Settings\Matt.ML\Application Data\Mozilla
2008-02-17 16:55:45 0 d-------- C:\Program Files\Trend Micro
2008-02-17 16:49:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 16:18:09 0 d-------- C:\Documents and Settings\Matt.ML\Application Data\Skype
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-02-17 16:17:58 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-02-17 16:17:58 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-02-17 16:17:58 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-02-17 16:17:58 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-02-17 16:17:58 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\You've Got Pictures Screensaver
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-02-17 16:17:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\AOL
2008-02-17 16:15:43 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-17 14:13:13 0 d-------- C:\VundoFix Backups
2008-02-17 13:22:39 2920 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-17 13:19:21 0 dr------- C:\Documents and Settings\Administrator\My Documents
2008-02-17 13:19:21 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-02-17 13:19:21 0 dr------- C:\Documents and Settings\Administrator\Favorites
2008-02-17 13:19:21 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2008-02-17 13:19:21 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-02-17 13:19:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-17 13:19:21 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-02-17 13:19:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-02-17 13:19:20 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-02-17 13:19:19 2097152 --ah----- C:\Documents and Settings\Administrator\ntuser.dat
2008-02-17 00:16:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-02-17 00:16:49 0 d-------- C:\Program Files\Symantec
2008-02-17 00:16:38 0 d-------- C:\Program Files\Norton Internet Security
2008-02-17 00:15:57 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-02-17 00:15:54 0 d-------- C:\WINDOWS\Prefetch
2008-02-17 00:15:52 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-02-17 00:01:17 0 dr------- C:\Documents and Settings\Owner\Start Menu
2008-02-17 00:01:17 0 dr-h----- C:\Documents and Settings\Owner\SendTo
2008-02-17 00:01:17 0 dr-h----- C:\Documents and Settings\Owner\Recent
2008-02-17 00:01:16 0 dr------- C:\Documents and Settings\Owner\My Documents
2008-02-17 00:01:14 0 dr------- C:\Documents and Settings\Owner\Favorites
2008-02-17 00:01:14 0 dr-h----- C:\Documents and Settings\Owner\Application Data
2008-02-12 22:07:57 1152 --a------ C:\WINDOWS\system32\windrv.sys
2008-02-03 18:06:50 0 d-------- C:\Program Files\Kontiki
2008-02-03 18:06:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Kontiki

-- Find3M Report ---------------------------------------------------------------

2008-02-28 21:07:26 0 d-------- C:\Program Files\GustoSoft
2008-02-27 19:41:29 0 d-------- C:\Program Files\Common Files\Adobe
2008-02-27 19:37:41 0 d-------- C:\Program Files\Bonusprint PhotoBook Editor
2008-02-26 20:22:40 0 d-------- C:\Program Files\Common Files
2008-02-17 16:17:57 0 d-------- C:\Program Files\CodeStuff
2008-02-17 13:45:00 0 d-------- C:\Documents and Settings\Matt.ML\Application Data\AOL
2008-02-17 00:17:16 60 --a------ C:\WINDOWS\system32\SYSDRV.DAT
2008-02-17 00:11:48 0 d-------- C:\Program Files\Windows NT
2008-02-17 00:11:43 0 d-------- C:\Program Files\Movie Maker
2008-02-17 00:11:41 0 d-------- C:\Program Files\Messenger
2008-02-12 22:07:37 0 d-------- C:\Program Files\Common Files\Download Manager
2008-02-09 23:23:03 0 d-------- C:\Program Files\Windows Live
2008-02-05 19:36:32 0 d-------- C:\Documents and Settings\Matt.ML\Application Data\LimeWire
2008-01-21 18:48:16 0 d-------- C:\Program Files\Hewlett-Packard

maui78 · Feb 28, 2008

cont

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}]
04/07/2006 22:48 206552 --a------ C:\Program Files\RXToolBar\sfcont.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [08/03/2005 02:33 C:\WINDOWS\system32\VTTimer.exe]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [22/01/2007 21:19]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [27/07/2004 22:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [27/07/2004 22:50]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [27/07/2004 22:50]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/09/2006 10:25]
"SNM"="C:\Program Files\SpyNoMore\SNM.exe" []
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [13/09/2002 20:42]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [04/09/2006 10:24]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [08/04/2004 14:38]
"AOL Spyware Protection"="C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" [19/03/2004 20:17]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [28/02/2006 12:00]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [25/01/2008 10:08]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [18/01/2006 19:05]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [14/12/2004 10:44:06]
AOL 9.0 Tray Icon.lnk - C:\Program Files\AOL 9.0\aoltray.exe [04/09/2006 10:24:40]
AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [04/09/2006 10:25:21]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

*Newly Created Service* - COMHOST

-- Hosts -----------------------------------------------------------------------

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

7899 more entries in hosts file.

-- End of Deckard's System Scanner: finished at 2008-02-28 21:12:56 ------------

next one

katana · Feb 28, 2008

Have you tried using Windows Update to get IE 7 ? see if that stops some of the problems.

Do you have the Extra.txt ?

maui78 · Feb 29, 2008

Hello

I tried IE7. It all seems to work ok. I spent last night installing all of the windows updates. I had 54 of them to install.

I thought I posted the extra text, but for some reason it didnt work. I will post when I get home later.

I think the machine is begining to act normal again now. I cant see any visbael problems.

I have malware, but cant download Kaspersky

maui78

New member

maui78

New member

katana

Security Expert-Emeritus

maui78

New member

katana

Security Expert-Emeritus

maui78

New member

katana

Security Expert-Emeritus

maui78

New member

maui78

New member

katana

Security Expert-Emeritus

maui78

New member

maui78

New member

katana

Security Expert-Emeritus

maui78

New member