Smitfraud-C.CoreService removal

[eythcobb]

I am unable to completely remove this malware. Here is my hjt log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:33:29, on 8/18/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
D:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\Explorer.EXE
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
D:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\Program Files\Mouse\Amoumain.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Google\Google Talk\googletalk.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "D:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [WheelMouse] Amoumain.exe
O4 - HKLM\..\Run: [tsvcin] D:\WINNT\system32\n20050308.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [googletalk] D:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [MBKWBarManager] D:\Program Files\MBKWBar\TManager.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\Downloaded Program Files\SbCIe028.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {3B5E6F50-41B3-4DAA-8BC7-8155DDC7810C} - http://install.spywarelabs.com/DistID/3801040702/BundleOuter3801040702.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/3194a20335130006ef19/netzip/RdxIE2.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://antu.popcap.com/games/popcaploader_v5.cab
O20 - Winlogon Notify: AdminDebug - D:\WINNT\system32\QGAUTO8.DLL
O20 - Winlogon Notify: Uninstall - D:\WINNT\system32\aza6lgls16q6.dll (file missing)
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - D:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 8609 bytes

 

[Blade81]

Hi


Disable Spybot's TeaTimer

• Run Spybot-S&D in Advanced Mode
• If it is not already set to do this, go to the Mode menu
  select
  Advanced Mode
  
• On the left hand side, click on Tools
• Then click on the Resident icon in the list
• Uncheck
  Resident TeaTimer
  and OK any prompts.
• Restart your computer

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
   Remember to re-enable them afterwards.
   
   
2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

 

[eythcobb]

Here are the logs after combofix was run. Note that after running the program, I continue to get rogue IE popup windows, so I guess we aren't finished yet. Thanks for all of your help.

----------------
combofix log:

ComboFix 08-08-21.02 - Administrator 08/23/2008 14:50:49.1 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.3.1252.1.1033.18.123 [GMT -5:00]
Running from: D:\Documents and Settings\Administrator\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\FJJ36H42\interclick.com
D:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\FJJ36H42\interclick.com\ud.sol
D:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
D:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
D:\Documents and Settings\Administrator\Cookies\administrator@abetterinternet[3].txt
D:\Documents and Settings\Administrator\Cookies\administrator@rightmedia[2].txt
D:\Documents and Settings\Administrator\Cookies\administrator@S0012-01-1-7-217494-47679[1].txt
D:\Documents and Settings\Administrator\Cookies\administrator@S0014-01-2-16-217494-54117[1].txt
D:\WINNT\system32\atctres.dll
D:\WINNT\system32\en48l1hu1.dll
D:\WINNT\system32\en6sl1j71.dll
D:\WINNT\system32\enr0l19m1.dll
D:\WINNT\system32\fplm0331e.dll
D:\WINNT\system32\fpp0037me.dll
D:\WINNT\system32\fpr0039me.dll
D:\WINNT\system32\g4jo0e13eh.dll
D:\WINNT\system32\guard.tmp
D:\WINNT\system32\h6j40g1qe6.dll
D:\WINNT\system32\hr2u05f9e.dll
D:\WINNT\system32\hrlu0539e.dll
D:\WINNT\system32\ihsso.dll
D:\WINNT\system32\ir04l5dq1.dll
D:\WINNT\system32\ir20l5fm1.dll
D:\WINNT\system32\j0p0la7m1d.dll
D:\WINNT\system32\k4no0e53eh.dll
D:\WINNT\system32\kt26l7fs1.dll
D:\WINNT\system32\kt6ol7j31.dll
D:\WINNT\system32\l0r00a9med.dll
D:\WINNT\system32\lv4s09h7e.dll
D:\WINNT\system32\m4rmle911h.dll
D:\WINNT\system32\mdm.exe
D:\WINNT\system32\n84slih7184.dll
D:\WINNT\system32\nawrsfr.dll
D:\WINNT\system32\q0680ajuedo80.dll
D:\WINNT\system32\q6nulg5916.dll
D:\WINNT\system32\q6rq0g95e6.dll
D:\WINNT\system32\r48s0el7ehq.dll
D:\WINNT\Web\default.htt
D:\WINNT\winhelp.ini
D:\WINNT\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TNIDRIVER


((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 )))))))))))))))))))))))))))))))
.

2008-08-23 14:56 . 08-08-23 14:56 232,786 -r--s---- D:\WINNT\system32\kedcan.dll
2008-08-23 14:56 . 08-08-23 14:51 232,786 -r--s---- D:\WINNT\system32\e002lado1d0c.dll
2008-08-23 14:46 . 08-08-23 14:40 232,875 -r--s---- D:\WINNT\system32\lvn6095se.dll
2008-08-23 11:12 . 08-08-23 11:08 232,786 -r--s---- D:\WINNT\system32\i6jqlg1516.dll
2008-08-20 16:41 . 08-08-23 14:39 833,210 ---h----- D:\WINNT\ShellIconCache
2008-08-18 20:36 . 08-08-18 20:36 167,976 --------- D:\WINNT\system32\drivers\core.cache.dsk
2008-08-18 09:13 . 08-08-18 09:13 294 --a------ D:\WINNT\system32\drivers\Shortcut to drivers.lnk
2008-08-17 22:18 . 08-08-18 20:33 4,818 --a------ D:\WINNT\system32\tmp.reg
2008-08-15 10:07 . 08-08-16 10:40 9,728 --a------ D:\WINNT\quit.exe
2008-08-14 00:03 . 08-08-14 00:04 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-13 18:24 . 08-08-13 18:24 86,272 --a------ D:\WINNT\system32\drivers\nbff.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 13:23 5,852 --sha-w D:\WINNT\system32\KGyGaAvL.sys
2008-06-22 01:16 144 ---ha-w D:\PCEP-2508-7371-3710-6683.DAT
2001-06-07 16:18 271 ---h--w D:\Program Files\desktop.ini
2001-06-07 16:18 21,952 ---h--w D:\Program Files\folder.htt
2000-04-19 17:09 61,510 ----a-w D:\WINNT\inf\probedis.exe
2000-04-19 16:58 69,702 ----a-w D:\WINNT\inf\3cshtdwn.exe
2000-04-19 16:56 49,152 ----a-w D:\WINNT\inf\3cmlink.exe
1999-12-07 12:00 32,528 ----a-w D:\WINNT\inf\wbfirdma.sys
.

------- Sigcheck -------

99-12-07 07:00 7952 9e64ad53cfd9da2d22e8a924f8c6e62c D:\WINNT\system32\svchost.exe
99-12-07 03:00 7952 9e64ad53cfd9da2d22e8a924f8c6e62c D:\WINNT\system32\dllcache\svchost.exe

03-08-05 15:14 380176 15b1c7ea9659055280f71a3d83987da3 D:\WINNT\system32\USER32.DLL
03-08-05 15:14 380176 15b1c7ea9659055280f71a3d83987da3 D:\WINNT\system32\dllcache\USER32.DLL
99-12-07 07:00 402704 dd546c9407e7567ee207efe5ac8fd09d D:\WINNT\$NtServicePackUninstall$\user32.dll
02-07-22 15:05 405264 4dc317a74845603f6d2b0b325aa234c6 D:\WINNT\ServicePackFiles\i386\user32.dll
02-07-22 15:05 405264 4dc317a74845603f6d2b0b325aa234c6 D:\WINNT\$NtUninstallQ811493$\user32.dll
02-08-15 10:34 379664 7452d26b8518ea90645101fb75694e6e D:\WINNT\$NtUninstallQ329115$\user32.dll
02-08-26 08:45 379664 98e111cc77a837ab794ebebd8f8ed7e8 D:\WINNT\$NtUninstallQ328310$\user32.dll
02-11-01 16:33 379664 6314bee2aa797a4f8ddc93d123c71970 D:\WINNT\$NtUninstallKB824141$\user32.dll

02-07-22 15:05 68368 30cd43c6903f8e9829871e9eeb6babf5 D:\WINNT\system32\ws2_32.dll
99-12-07 07:00 71440 e8162bf0c57d0cc137e2f3549d0485a7 D:\WINNT\$NtServicePackUninstall$\ws2_32.dll
02-07-22 15:05 68368 30cd43c6903f8e9829871e9eeb6babf5 D:\WINNT\ServicePackFiles\i386\ws2_32.dll

02-08-29 07:14 585728 8579e8474130334dfa93d4df3f0d3fa1 D:\WINNT\system32\WININET.DLL
02-08-29 07:14 585728 8579e8474130334dfa93d4df3f0d3fa1 D:\WINNT\system32\dllcache\wininet.dll
02-07-22 15:05 461584 b23633b7fb67ac5c1b1eb7211c38788f D:\WINNT\ServicePackFiles\i386\wininet.dll

02-07-22 15:05 329456 8b3cfa597a7b4ae984b8b7f21feff037 D:\WINNT\system32\drivers\tcpip.sys
99-12-07 07:00 305520 8072c7c242fb6d17fb61a01274f20217 D:\WINNT\$NtServicePackUninstall$\tcpip.sys
02-07-22 15:05 329456 8b3cfa597a7b4ae984b8b7f21feff037 D:\WINNT\ServicePackFiles\i386\tcpip.sys

03-07-17 10:20 182032 e3acd1bc832e859b157d95d9907560d3 D:\WINNT\system32\WINLOGON.EXE
03-07-17 10:20 182032 e3acd1bc832e859b157d95d9907560d3 D:\WINNT\system32\dllcache\WINLOGON.EXE
99-12-07 07:00 177424 85c0d6bd769aab1b007b21cca9a346c8 D:\WINNT\$NtServicePackUninstall$\winlogon.exe
02-07-22 15:05 178960 96a7495c924cf3fb1d0f857093b6f61f D:\WINNT\ServicePackFiles\i386\winlogon.exe
02-07-22 15:05 178960 96a7495c924cf3fb1d0f857093b6f61f D:\WINNT\$NtUninstallQ811493$\winlogon.exe
02-08-15 10:30 179472 f3036132e5b0de9e4cb09e3f649e3ee3 D:\WINNT\$NtUninstallQ329115$\winlogon.exe
02-08-15 10:30 179472 f3036132e5b0de9e4cb09e3f649e3ee3 D:\WINNT\$NtUninstallQ328310$\winlogon.exe
02-10-29 10:59 179472 ce8ea42d39c0eb42f064be762925ca0c D:\WINNT\$NtUninstallKB824141$\winlogon.exe

02-07-22 15:05 167344 880e0a9b181c05ab45f282ceec47b6b4 D:\WINNT\system32\drivers\ndis.sys
99-12-07 07:00 167760 fbf289385e77176b5929975748abd84b D:\WINNT\$NtServicePackUninstall$\ndis.sys
02-07-22 15:05 167344 880e0a9b181c05ab45f282ceec47b6b4 D:\WINNT\ServicePackFiles\i386\ndis.sys

02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\system32\NTKRNLPA.EXE
02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\system32\dllcache\ntkrnlpa.exe
02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\Driver Cache\i386\ntkrnlpa.exe
99-12-07 07:00 1611840 25b3a87706f18ca5c812f342f8690386 D:\WINNT\$NtServicePackUninstall$\ntkrnlpa.exe
02-07-22 15:05 1687360 08888c725e9ac9f3c8767546d0338b1c D:\WINNT\ServicePackFiles\i386\ntkrnlpa.exe
02-07-22 15:05 1687360 08888c725e9ac9f3c8767546d0338b1c D:\WINNT\$NtUninstallQ811493$\ntkrnlpa.exe

02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\system32\NTOSKRNL.EXE
02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\system32\dllcache\ntoskrnl.exe
02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\Driver Cache\i386\ntoskrnl.exe
99-12-07 07:00 1640976 d7697fad3df8494ac35f23c0c87c240e D:\WINNT\$NtServicePackUninstall$\ntoskrnl.exe
02-07-22 15:05 1712720 1be931a7bb06c089812029603ae9fe88 D:\WINNT\ServicePackFiles\i386\ntoskrnl.exe
02-07-22 15:05 1712720 1be931a7bb06c089812029603ae9fe88 D:\WINNT\$NtUninstallQ811493$\ntoskrnl.exe

02-07-22 15:05 242960 51794d917250081ab41a77950cee481d D:\WINNT\explorer.exe
99-12-07 07:00 238352 7251759785c60ed0e3d3f8379c89a079 D:\WINNT\$NtServicePackUninstall$\explorer.exe
02-07-22 15:05 242960 51794d917250081ab41a77950cee481d D:\WINNT\ServicePackFiles\i386\explorer.exe

02-07-22 15:05 88848 7f164d07ba059b6e3c37c119b49b282a D:\WINNT\system32\SERVICES.EXE
99-12-07 07:00 88848 63709f4c5bd9b401849c929d6eefbb3d D:\WINNT\$NtServicePackUninstall$\services.exe
02-07-22 15:05 88848 7f164d07ba059b6e3c37c119b49b282a D:\WINNT\ServicePackFiles\i386\services.exe

02-07-22 15:54 33552 70a442ebb75a161ab5a000ff4027d7ae D:\WINNT\system32\LSASS.EXE
02-07-22 15:54 33552 70a442ebb75a161ab5a000ff4027d7ae D:\WINNT\system32\dllcache\lsass.exe
99-12-07 07:00 33552 794087da8de60705c20e127262362c8c D:\WINNT\$NtServicePackUninstall$\lsass.exe
02-07-22 15:05 33552 0fabc9f91eab355a6303fa540071aee7 D:\WINNT\ServicePackFiles\i386\lsass.exe
02-07-22 15:05 33552 0fabc9f91eab355a6303fa540071aee7 D:\WINNT\$NtUninstallQ329115$\lsass.exe

02-07-22 15:05 45328 bf50e306a42659938ba10218425709ab D:\WINNT\system32\spoolsv.exe
99-12-07 07:00 44816 34b45ed0176c838e0a3af8ccea44a630 D:\WINNT\$NtServicePackUninstall$\spoolsv.exe
02-07-22 15:05 45328 bf50e306a42659938ba10218425709ab D:\WINNT\ServicePackFiles\i386\spoolsv.exe

04-01-31 00:40 148792 be3664bce815d4b3b3edd51993d97bf4 D:\WINNT\system32\wuauclt.exe
04-01-31 00:40 148792 be3664bce815d4b3b3edd51993d97bf4 D:\WINNT\system32\dllcache\wuauclt.exe
02-07-22 15:05 140800 5347f03d10ba3a0cbd76ec9475b07f88 D:\WINNT\ServicePackFiles\i386\wuauclt.exe

02-07-22 15:05 17680 d2c7c9f5c2623f6f7814231e278de9ff D:\WINNT\system32\USERINIT.EXE
99-12-07 07:00 17168 a4e505d537a0476daaf61eb90cae457c D:\WINNT\$NtServicePackUninstall$\userinit.exe
02-07-22 15:05 17680 d2c7c9f5c2623f6f7814231e278de9ff D:\WINNT\ServicePackFiles\i386\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07-06-27 10:12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"3c1807pd"="D:\WINNT\SYSTEM32\3cmlink.exe" [00-04-19 11:56 49152]
"HPDJ Taskbar Utility"="D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe" [01-06-25 17:10 200704]
"Pop3trap.exe"="D:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe" [01-05-21 09:37 290886]
"WebTrapNT.exe"="D:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe" [01-05-21 09:32 235008]
"WinPoET"="D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe" [01-03-20 12:58 237568]
"ConMgr.exe"="C:\Program Files\EarthLink 5.0\ConMgr.exe" [01-07-16 17:39 286720]
"UpdateMgr.exe"="C:\Program Files\EarthLink 5.0\updatemgr.exe" [01-07-13 11:13 61440]
"WinampAgent"="D:\Program Files\Winamp\Winampa.exe" [02-04-26 12:53 12288]
"LifeScape Media Detector"="D:\Program Files\Picasa\PicasaMediaDetector.exe" [04-01-05 23:02 151552]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05-10-06 19:24 180269]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [05-10-18 11:58 278528]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [05-12-24 11:22 155648]
"dlcxmon.exe"="D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe" [07-01-12 12:57 292336]
"MemoryCardManager"="D:\Program Files\Dell Photo AIO Printer 926\memcard.exe" [06-11-03 18:04 304008]
"FaxCenterServer"="D:\Program Files\Dell PC Fax\fm3032.exe" [06-11-03 18:09 312200]
"Corel Photo Downloader"="D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [05-08-31 11:06 106496]
"ISUSPM Startup"="D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [05-06-10 10:44 249856]
"ISUSScheduler"="D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [05-06-10 10:44 81920]
"DLCXCATS"="D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [06-10-16 01:31 106496]
"Synchronization Manager"="mobsync.exe" [99-12-07 07:00 111376 D:\WINNT\system32\mobsync.exe]
"nwiz"="nwiz.exe" [02-05-03 10:06 364544 D:\WINNT\system32\nwiz.exe]

D:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2003-12-06 19:58:02 225280]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 04:15:54 65588]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2002-01-04 17:35:54 106560]
Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-01-25 17:19:44 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RunOnce]
08-08-23 11:08 232786 D:\WINNT\system32\i6jqlg1516.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zpasspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);D:\WINNT\system32\DRIVERS\SONYPVM1.SYS [00-05-27 04:37 ]
R0 ultra66;ultra66;D:\WINNT\system32\DRIVERS\ultra66.sys [99-12-07 07:00 ]
R1 nbff;nbff;D:\WINNT\system32\drivers\nbff.sys [08-08-13 18:24 ]
R2 dlcx_device;dlcx_device;D:\WINNT\system32\dlcxcoms.exe [06-11-03 18:07 ]
R3 3c1807pd;U.S. Robotics 56K Fax Win Int;D:\WINNT\system32\DRIVERS\3c1807pd.sys [00-05-03 11:06 ]
R3 Amps2prt;Compatible PS/2 Port Mouse Driver;D:\WINNT\system32\DRIVERS\Amps2prt.sys [02-07-31 13:04 ]
R3 lne100v5;Linksys LNE100TX(v5) Fast Ethernet Adapter;D:\WINNT\system32\DRIVERS\lne100v5.sys [01-04-02 11:01 ]
R3 WrKPoET2000;WrKPoET2000;D:\Program Files\iVasion\WinPoET\WrKPoET2000.sys [00-10-30 15:11 ]
R3 WRSWanDD;iVasion PoET Adapter;D:\WINNT\system32\DRIVERS\WrKPoETNic2000.sys [00-10-30 15:18 ]

*Newly Created Service* - IPNAT
*Newly Created Service* - RASAUTO
*Newly Created Service* - SHAREDACCESS
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-MBKWBarManager - D:\Program Files\MBKWBar\TManager.exe
HKLM-Run-tsvcin - D:\WINNT\system32\n20050308.EXE
HKLM-Run-WheelMouse - Amoumain.exe
HKU-Default-RunOnce-^SetupICWDesktop - (no file)


.
------- Supplementary Scan -------
.
FireFox -: Profile - D:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\w0nbowhi.Linda\
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPJava11.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPJava12.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPJava13.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPJava32.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPJPI140_01.dll
FF -: plugin - C:\Program Files\Java\j2re1.4.0\bin\NPOJI610.dll
FF -: plugin - D:\Program Files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 14:56:51
Windows 5.0.2195 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCXCATS = rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: D:\WINNT\system32\winlogon.exe
-> D:\WINNT\system32\i6jqlg1516.dll
.
Completion time: 2008-08-23 14:58:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-23 19:58:38

Pre-Run: 1,377,525,760 bytes free
Post-Run: 1,416,134,656 bytes free

236


------------------------

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05:47, on 8/23/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\Program Files\Mouse\Amoumain.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\WINNT\explorer.exe
D:\WINNT\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINNT\system32\cmd.exe
C:\Vim\vim60\gvim.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "D:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "D:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\Downloaded Program Files\SbCIe028.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {3B5E6F50-41B3-4DAA-8BC7-8155DDC7810C} - http://install.spywarelabs.com/DistID/3801040702/BundleOuter3801040702.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O20 - Winlogon Notify: RunOnce - D:\WINNT\system32\i6jqlg1516.dll
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 7719 bytes

 

[Blade81]

Hi

Yes, the process isn't finished yet


Start hjt, do a system scan, check (if found):
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = D:\windows\system32\blank.htm
O4 - Startup: PowerReg Scheduler V3.exe

Close browsers and fix checked.


Open notepad and copy/paste the text in the quotebox below into it:

Driver::
nbff

File::
D:\WINNT\system32\kedcan.dll
D:\WINNT\system32\e002lado1d0c.dll
D:\WINNT\system32\lvn6095se.dll
D:\WINNT\system32\i6jqlg1516.dll
D:\WINNT\system32\drivers\core.cache.dsk
D:\WINNT\quit.exe
D:\WINNT\system32\drivers\nbff.sys

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\RunOnce]

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with Kaspersky Online Scanner (scan whole 'my computer'). Post back its report, a fresh hjt log and above meantioned ComboFix resultant log.

 

[eythcobb]

Things have not gone as well this iteration.

The HTJ step went fine.

I saved CFScript.txt to the desktop. When I move the CFScript icon on top of the ComboFix icon, I got an error message that went away quickly. The error was something like (but not exactly)
Cannot upload d:\...\CFScript.txt. File must be a registry type (?).


ComboFix continued to run, but I'm guessing without the intended input.
I tried again with the same result. I have attached the resulting log.

The Kaspersky online scan was very slow. It took almost 18 hours to scan ~162K files. Should I try downloading the 30 day trial for the next run?

------
combofix log:

ComboFix 08-08-23.03 - Administrator 08/24/2008 11:12:33.3 - FAT32x86
Microsoft Windows 2000 Professional 5.0.2195.3.1252.1.1033.18.122 [GMT -5:00]
Running from: D:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: D:\Documents and Settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
D:\WINNT\quit.exe
D:\WINNT\system32\drivers\core.cache.dsk
D:\WINNT\system32\drivers\nbff.sys
D:\WINNT\system32\e002lado1d0c.dll
D:\WINNT\system32\i6jqlg1516.dll
D:\WINNT\system32\kedcan.dll
D:\WINNT\system32\lvn6095se.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\WINNT\quit.exe
D:\WINNT\system32\dkcxinst.dll
D:\WINNT\system32\drivers\core.cache.dsk
D:\WINNT\system32\drivers\nbff.sys
D:\WINNT\system32\guard.tmp
D:\WINNT\system32\e002lado1d0c.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NBFF
-------\Service_nbff


((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 )))))))))))))))))))))))))))))))
.

2008-08-24 11:17 . 08-08-24 11:17 232,786 -r--s---- D:\WINNT\system32\tlpmib.dll
2008-08-24 11:17 . 08-08-24 11:11 232,786 -r--s---- D:\WINNT\system32\r0p80a7ued.dll
2008-08-24 11:06 . 08-08-24 11:02 232,786 -r--s---- D:\WINNT\system32\lv6209joe.dll
2008-08-23 14:56 . 08-08-23 14:51 232,786 --------- D:\WINNT\system32\e002lado1d0c.dll
2008-08-20 16:41 . 08-08-23 14:39 833,210 ---h----- D:\WINNT\ShellIconCache
2008-08-18 09:13 . 08-08-18 09:13 294 --a------ D:\WINNT\system32\drivers\Shortcut to drivers.lnk
2008-08-17 22:18 . 08-08-18 20:33 4,818 --a------ D:\WINNT\system32\tmp.reg
2008-08-14 00:03 . 08-08-14 00:04 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Lavasoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-17 13:23 5,852 --sha-w D:\WINNT\system32\KGyGaAvL.sys
2008-06-22 01:16 144 ---ha-w D:\PCEP-2508-7371-3710-6683.DAT
2001-06-07 16:18 271 ---h--w D:\Program Files\desktop.ini
2001-06-07 16:18 21,952 ---h--w D:\Program Files\folder.htt
2000-04-19 17:09 61,510 ----a-w D:\WINNT\inf\probedis.exe
2000-04-19 16:58 69,702 ----a-w D:\WINNT\inf\3cshtdwn.exe
2000-04-19 16:56 49,152 ----a-w D:\WINNT\inf\3cmlink.exe
1999-12-07 12:00 32,528 ----a-w D:\WINNT\inf\wbfirdma.sys
.

------- Sigcheck -------

99-12-07 07:00 7952 9e64ad53cfd9da2d22e8a924f8c6e62c D:\WINNT\system32\svchost.exe
99-12-07 03:00 7952 9e64ad53cfd9da2d22e8a924f8c6e62c D:\WINNT\system32\dllcache\svchost.exe

03-08-05 15:14 380176 15b1c7ea9659055280f71a3d83987da3 D:\WINNT\system32\USER32.DLL
03-08-05 15:14 380176 15b1c7ea9659055280f71a3d83987da3 D:\WINNT\system32\dllcache\USER32.DLL
99-12-07 07:00 402704 dd546c9407e7567ee207efe5ac8fd09d D:\WINNT\$NtServicePackUninstall$\user32.dll
02-07-22 15:05 405264 4dc317a74845603f6d2b0b325aa234c6 D:\WINNT\ServicePackFiles\i386\user32.dll
02-07-22 15:05 405264 4dc317a74845603f6d2b0b325aa234c6 D:\WINNT\$NtUninstallQ811493$\user32.dll
02-08-15 10:34 379664 7452d26b8518ea90645101fb75694e6e D:\WINNT\$NtUninstallQ329115$\user32.dll
02-08-26 08:45 379664 98e111cc77a837ab794ebebd8f8ed7e8 D:\WINNT\$NtUninstallQ328310$\user32.dll
02-11-01 16:33 379664 6314bee2aa797a4f8ddc93d123c71970 D:\WINNT\$NtUninstallKB824141$\user32.dll

02-07-22 15:05 68368 30cd43c6903f8e9829871e9eeb6babf5 D:\WINNT\system32\ws2_32.dll
99-12-07 07:00 71440 e8162bf0c57d0cc137e2f3549d0485a7 D:\WINNT\$NtServicePackUninstall$\ws2_32.dll
02-07-22 15:05 68368 30cd43c6903f8e9829871e9eeb6babf5 D:\WINNT\ServicePackFiles\i386\ws2_32.dll

02-08-29 07:14 585728 8579e8474130334dfa93d4df3f0d3fa1 D:\WINNT\system32\WININET.DLL
02-08-29 07:14 585728 8579e8474130334dfa93d4df3f0d3fa1 D:\WINNT\system32\dllcache\wininet.dll
02-07-22 15:05 461584 b23633b7fb67ac5c1b1eb7211c38788f D:\WINNT\ServicePackFiles\i386\wininet.dll

02-07-22 15:05 329456 8b3cfa597a7b4ae984b8b7f21feff037 D:\WINNT\system32\drivers\tcpip.sys
99-12-07 07:00 305520 8072c7c242fb6d17fb61a01274f20217 D:\WINNT\$NtServicePackUninstall$\tcpip.sys
02-07-22 15:05 329456 8b3cfa597a7b4ae984b8b7f21feff037 D:\WINNT\ServicePackFiles\i386\tcpip.sys

03-07-17 10:20 182032 e3acd1bc832e859b157d95d9907560d3 D:\WINNT\system32\WINLOGON.EXE
03-07-17 10:20 182032 e3acd1bc832e859b157d95d9907560d3 D:\WINNT\system32\dllcache\WINLOGON.EXE
99-12-07 07:00 177424 85c0d6bd769aab1b007b21cca9a346c8 D:\WINNT\$NtServicePackUninstall$\winlogon.exe
02-07-22 15:05 178960 96a7495c924cf3fb1d0f857093b6f61f D:\WINNT\ServicePackFiles\i386\winlogon.exe
02-07-22 15:05 178960 96a7495c924cf3fb1d0f857093b6f61f D:\WINNT\$NtUninstallQ811493$\winlogon.exe
02-08-15 10:30 179472 f3036132e5b0de9e4cb09e3f649e3ee3 D:\WINNT\$NtUninstallQ329115$\winlogon.exe
02-08-15 10:30 179472 f3036132e5b0de9e4cb09e3f649e3ee3 D:\WINNT\$NtUninstallQ328310$\winlogon.exe
02-10-29 10:59 179472 ce8ea42d39c0eb42f064be762925ca0c D:\WINNT\$NtUninstallKB824141$\winlogon.exe

02-07-22 15:05 167344 880e0a9b181c05ab45f282ceec47b6b4 D:\WINNT\system32\drivers\ndis.sys
99-12-07 07:00 167760 fbf289385e77176b5929975748abd84b D:\WINNT\$NtServicePackUninstall$\ndis.sys
02-07-22 15:05 167344 880e0a9b181c05ab45f282ceec47b6b4 D:\WINNT\ServicePackFiles\i386\ndis.sys

02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\system32\NTKRNLPA.EXE
02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\system32\dllcache\ntkrnlpa.exe
02-12-12 17:22 1688832 719ce7d2371013e85622f9eecf09d9bd D:\WINNT\Driver Cache\i386\ntkrnlpa.exe
99-12-07 07:00 1611840 25b3a87706f18ca5c812f342f8690386 D:\WINNT\$NtServicePackUninstall$\ntkrnlpa.exe
02-07-22 15:05 1687360 08888c725e9ac9f3c8767546d0338b1c D:\WINNT\ServicePackFiles\i386\ntkrnlpa.exe
02-07-22 15:05 1687360 08888c725e9ac9f3c8767546d0338b1c D:\WINNT\$NtUninstallQ811493$\ntkrnlpa.exe

02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\system32\NTOSKRNL.EXE
02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\system32\dllcache\ntoskrnl.exe
02-12-12 17:22 1666944 95a7e6ba49b7670f034590df206ed12a D:\WINNT\Driver Cache\i386\ntoskrnl.exe
99-12-07 07:00 1640976 d7697fad3df8494ac35f23c0c87c240e D:\WINNT\$NtServicePackUninstall$\ntoskrnl.exe
02-07-22 15:05 1712720 1be931a7bb06c089812029603ae9fe88 D:\WINNT\ServicePackFiles\i386\ntoskrnl.exe
02-07-22 15:05 1712720 1be931a7bb06c089812029603ae9fe88 D:\WINNT\$NtUninstallQ811493$\ntoskrnl.exe

02-07-22 15:05 242960 51794d917250081ab41a77950cee481d D:\WINNT\explorer.exe
99-12-07 07:00 238352 7251759785c60ed0e3d3f8379c89a079 D:\WINNT\$NtServicePackUninstall$\explorer.exe
02-07-22 15:05 242960 51794d917250081ab41a77950cee481d D:\WINNT\ServicePackFiles\i386\explorer.exe

02-07-22 15:05 88848 7f164d07ba059b6e3c37c119b49b282a D:\WINNT\system32\SERVICES.EXE
99-12-07 07:00 88848 63709f4c5bd9b401849c929d6eefbb3d D:\WINNT\$NtServicePackUninstall$\services.exe
02-07-22 15:05 88848 7f164d07ba059b6e3c37c119b49b282a D:\WINNT\ServicePackFiles\i386\services.exe

02-07-22 15:54 33552 70a442ebb75a161ab5a000ff4027d7ae D:\WINNT\system32\LSASS.EXE
02-07-22 15:54 33552 70a442ebb75a161ab5a000ff4027d7ae D:\WINNT\system32\dllcache\lsass.exe
99-12-07 07:00 33552 794087da8de60705c20e127262362c8c D:\WINNT\$NtServicePackUninstall$\lsass.exe
02-07-22 15:05 33552 0fabc9f91eab355a6303fa540071aee7 D:\WINNT\ServicePackFiles\i386\lsass.exe
02-07-22 15:05 33552 0fabc9f91eab355a6303fa540071aee7 D:\WINNT\$NtUninstallQ329115$\lsass.exe

02-07-22 15:05 45328 bf50e306a42659938ba10218425709ab D:\WINNT\system32\spoolsv.exe
99-12-07 07:00 44816 34b45ed0176c838e0a3af8ccea44a630 D:\WINNT\$NtServicePackUninstall$\spoolsv.exe
02-07-22 15:05 45328 bf50e306a42659938ba10218425709ab D:\WINNT\ServicePackFiles\i386\spoolsv.exe

04-01-31 00:40 148792 be3664bce815d4b3b3edd51993d97bf4 D:\WINNT\system32\wuauclt.exe
04-01-31 00:40 148792 be3664bce815d4b3b3edd51993d97bf4 D:\WINNT\system32\dllcache\wuauclt.exe
02-07-22 15:05 140800 5347f03d10ba3a0cbd76ec9475b07f88 D:\WINNT\ServicePackFiles\i386\wuauclt.exe

02-07-22 15:05 17680 d2c7c9f5c2623f6f7814231e278de9ff D:\WINNT\system32\USERINIT.EXE
99-12-07 07:00 17168 a4e505d537a0476daaf61eb90cae457c D:\WINNT\$NtServicePackUninstall$\userinit.exe
02-07-22 15:05 17680 d2c7c9f5c2623f6f7814231e278de9ff D:\WINNT\ServicePackFiles\i386\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07-06-27 10:12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="NvQTwk" [X]
"3c1807pd"="D:\WINNT\SYSTEM32\3cmlink.exe" [00-04-19 11:56 49152]
"HPDJ Taskbar Utility"="D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe" [01-06-25 17:10 200704]
"WinPoET"="D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe" [01-03-20 12:58 237568]
"ConMgr.exe"="C:\Program Files\EarthLink 5.0\ConMgr.exe" [01-07-16 17:39 286720]
"UpdateMgr.exe"="C:\Program Files\EarthLink 5.0\updatemgr.exe" [01-07-13 11:13 61440]
"WinampAgent"="D:\Program Files\Winamp\Winampa.exe" [02-04-26 12:53 12288]
"LifeScape Media Detector"="D:\Program Files\Picasa\PicasaMediaDetector.exe" [04-01-05 23:02 151552]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05-10-06 19:24 180269]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [05-10-18 11:58 278528]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [05-12-24 11:22 155648]
"dlcxmon.exe"="D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe" [07-01-12 12:57 292336]
"MemoryCardManager"="D:\Program Files\Dell Photo AIO Printer 926\memcard.exe" [06-11-03 18:04 304008]
"FaxCenterServer"="D:\Program Files\Dell PC Fax\fm3032.exe" [06-11-03 18:09 312200]
"Corel Photo Downloader"="D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [05-08-31 11:06 106496]
"ISUSPM Startup"="D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [05-06-10 10:44 249856]
"ISUSScheduler"="D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [05-06-10 10:44 81920]
"DLCXCATS"="D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [06-10-16 01:31 106496]
"Synchronization Manager"="mobsync.exe" [99-12-07 07:00 111376 D:\WINNT\system32\mobsync.exe]
"nwiz"="nwiz.exe" [02-05-03 10:06 364544 D:\WINNT\system32\nwiz.exe]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 04:15:54 65588]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2002-01-04 17:35:54 106560]
Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-01-25 17:19:44 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck]
08-08-23 14:51 232786 D:\WINNT\system32\e002lado1d0c.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zpasspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="0x00000000"
"UpdatesDisableNotify"="0x00000000"

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);D:\WINNT\system32\DRIVERS\SONYPVM1.SYS [00-05-27 04:37 ]
R0 ultra66;ultra66;D:\WINNT\system32\DRIVERS\ultra66.sys [99-12-07 07:00 ]
R2 dlcx_device;dlcx_device;D:\WINNT\system32\dlcxcoms.exe [06-11-03 18:07 ]
R3 3c1807pd;U.S. Robotics 56K Fax Win Int;D:\WINNT\system32\DRIVERS\3c1807pd.sys [00-05-03 11:06 ]
R3 Amps2prt;Compatible PS/2 Port Mouse Driver;D:\WINNT\system32\DRIVERS\Amps2prt.sys [02-07-31 13:04 ]
R3 lne100v5;Linksys LNE100TX(v5) Fast Ethernet Adapter;D:\WINNT\system32\DRIVERS\lne100v5.sys [01-04-02 11:01 ]
R3 WrKPoET2000;WrKPoET2000;D:\Program Files\iVasion\WinPoET\WrKPoET2000.sys [00-10-30 15:11 ]
R3 WRSWanDD;iVasion PoET Adapter;D:\WINNT\system32\DRIVERS\WrKPoETNic2000.sys [00-10-30 15:18 ]
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-24 11:17:32
Windows 5.0.2195 Service Pack 3 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCXCATS = rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: D:\WINNT\system32\winlogon.exe
-> D:\WINNT\system32\e002lado1d0c.dll
.
Completion time: 2008-08-24 11:19:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-24 16:19:18
ComboFix3.txt 2008-08-23 19:58:48
ComboFix2.txt 2008-08-24 16:10:10

Pre-Run: 1,439,756,288 bytes free
Post-Run: 1,432,510,464 bytes free

186

-----------

HTJ log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:30, on 8/25/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\WINNT\explorer.exe
D:\WINNT\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrator\Local Settings\temp\jkos-Administrator\binaries\ScanningProcess.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\cmd.exe
C:\Vim\vim60\gvim.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - D:\WINNT\Downloaded Program Files\SbCIe028.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {3B5E6F50-41B3-4DAA-8BC7-8155DDC7810C} - http://install.spywarelabs.com/DistID/3801040702/BundleOuter3801040702.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O20 - Winlogon Notify: WebCheck - D:\WINNT\system32\e002lado1d0c.dll
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 7808 bytes


--------------
kaspersky log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, August 25, 2008
Operating System: Microsoft Windows 2000 Professional Service Pack 3 (build 2195)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, August 24, 2008 16:42:05
Records in database: 1140842
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 162144
Threat name: 10
Infected objects: 107
Suspicious objects: 2
Duration of the scan: 17:53:27


File name / Threat name / Threats count
winlogon.exe\e002lado1d0c.dll/winlogon.exe\e002lado1d0c.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
rundll32.exe\tlpmib.dll/rundll32.exe\tlpmib.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\tlpmib.dll/D:\WINNT\system32\tlpmib.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
C:\WINDOWS\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.VBS.KakWorm 6
C:\WINDOWS\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 14
C:\WINDOWS\Profiles\admin\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.VBS.KakWorm 6
C:\WINDOWS\Profiles\admin\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 14
D:\WINNT\system32\tlpmib.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\en06l1ds1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\ennql1551.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\o0lu0a39ed.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\lv6209joe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\k4260efseh260.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\n4p40e7qeh.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\enr6l19s1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\p08qlal51dq.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\q686lgls16q6.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\f40o0ed3eh0.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\l06olaj31do.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\l6j8lg1u16.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\p64ulgh9164.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\p4n80e5ueh.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\lv6409jqe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\azaola931d.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\azaulgh9164.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\l48m0el1ehq.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\jGvacypt.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\f02mlaf11d2.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\guard.tmp_tobedeleted Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\o0rola931d.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\lvn4095qe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system32\l8l6li3s18.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\WINNT\system\UpdInstall.exe Infected: not-a-virus:AdWare.Win32.Look2Me.e 1
D:\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll Infected: not-a-virus:AdWare.Win32.Gator.1019 1
D:\WINNT\Downloaded Program Files\flash.inf Infected: not-a-virus:AdWare.Win32.BetterInternet.be 1
D:\WINNT\Downloaded Program Files\SbCIe028.dll Infected: not-a-virus:AdWare.Win32.SideStep.a 1
D:\WINNT\jmmrwk.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.s 1
D:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{D53FF441-54D1-4B1D-A869-9714785A7299}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
D:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\Program Files\Mozilla Firefox\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\QooBox\Quarantine\D\WINNT\system32\atctres.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\en48l1hu1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\en6sl1j71.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\enr0l19m1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fplm0331e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fpp0037me.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fpr0039me.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\g4jo0e13eh.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\h6j40g1qe6.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\hr2u05f9e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\hrlu0539e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ihsso.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ir04l5dq1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ir20l5fm1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\j0p0la7m1d.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\k4no0e53eh.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kt26l7fs1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kt6ol7j31.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\l0r00a9med.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\lv4s09h7e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\m4rmle911h.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\n84slih7184.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\nawrsfr.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q0680ajuedo80.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q6nulg5916.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q6rq0g95e6.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\r48s0el7ehq.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kedcan.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\lvn6095se.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\guard.tmp.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\quit.exe.vir Infected: Trojan.Win32.KillFiles.xj 1

The selected area was scanned.

 

[Blade81]

Hi

Clear your deleted mail box and delete suspicious looking mail messages from inbox and sent mail boxes.

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  D:\WINNT\system32\tlpmib.dll
  D:\WINNT\system32\en06l1ds1.dll
  D:\WINNT\system32\ennql1551.dll
  D:\WINNT\system32\o0lu0a39ed.dll
  D:\WINNT\system32\lv6209joe.dll
  D:\WINNT\system32\k4260efseh260.dll
  D:\WINNT\system32\n4p40e7qeh.dll
  D:\WINNT\system32\enr6l19s1.dll
  D:\WINNT\system32\p08qlal51dq.dll
  D:\WINNT\system32\q686lgls16q6.dll
  D:\WINNT\system32\f40o0ed3eh0.dll
  D:\WINNT\system32\l06olaj31do.dll
  D:\WINNT\system32\l6j8lg1u16.dll
  D:\WINNT\system32\p64ulgh9164.dll
  D:\WINNT\system32\p4n80e5ueh.dll
  D:\WINNT\system32\lv6409jqe.dll
  D:\WINNT\system32\azaola931d.dll
  D:\WINNT\system32\azaulgh9164.dll
  D:\WINNT\system32\l48m0el1ehq.dll
  D:\WINNT\system32\jGvacypt.dll
  D:\WINNT\system32\f02mlaf11d2.dll
  D:\WINNT\system32\guard.tmp_tobedeleted
  D:\WINNT\system32\o0rola931d.dll
  D:\WINNT\system32\lvn4095qe.dll
  D:\WINNT\system32\l8l6li3s18.dll
  D:\WINNT\system\UpdInstall.exe
  D:\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll
  D:\WINNT\Downloaded Program Files\flash.inf
  D:\WINNT\Downloaded Program Files\SbCIe028.dll
  D:\WINNT\jmmrwk.exe
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck

• Return to OTMoveIt2, right click in the
  Paste Standard List of Files/Folders to Move
  window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Please post contents of that file & a fresh hjt log in your next reply.

 

[eythcobb]

OT Move It log:

D:\WINNT\system32\lv6409jqe.dll moved successfully.
D:\WINNT\system32\azaola931d.dll unregistered successfully.
D:\WINNT\system32\azaola931d.dll moved successfully.
D:\WINNT\system32\azaulgh9164.dll unregistered successfully.
D:\WINNT\system32\azaulgh9164.dll moved successfully.
D:\WINNT\system32\l48m0el1ehq.dll unregistered successfully.
D:\WINNT\system32\l48m0el1ehq.dll moved successfully.
D:\WINNT\system32\jGvacypt.dll unregistered successfully.
D:\WINNT\system32\jGvacypt.dll moved successfully.
D:\WINNT\system32\f02mlaf11d2.dll unregistered successfully.
D:\WINNT\system32\f02mlaf11d2.dll moved successfully.
D:\WINNT\system32\guard.tmp_tobedeleted moved successfully.
D:\WINNT\system32\o0rola931d.dll unregistered successfully.
D:\WINNT\system32\o0rola931d.dll moved successfully.
D:\WINNT\system32\lvn4095qe.dll unregistered successfully.
D:\WINNT\system32\lvn4095qe.dll moved successfully.
D:\WINNT\system32\l8l6li3s18.dll unregistered successfully.
D:\WINNT\system32\l8l6li3s18.dll moved successfully.
D:\WINNT\system\UpdInstall.exe moved successfully.
D:\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll unregistered successfully.
D:\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll moved successfully.
D:\WINNT\Downloaded Program Files\flash.inf moved successfully.
D:\WINNT\Downloaded Program Files\SbCIe028.dll unregistered successfully.
D:\WINNT\Downloaded Program Files\SbCIe028.dll moved successfully.
D:\WINNT\jmmrwk.exe moved successfully.
< HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck\\ deleted successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08262008_234729
---------------------------------------------

malwarebyte log;

Malwarebytes' Anti-Malware 1.25
Database version: 1088
Windows 5.0.2195 Service Pack 3

8:51:08 AM 8/27/2008
mbam-log-08-27-2008 (08-51-08).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 191371
Time elapsed: 36 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
D:\QooBox\Quarantine\D\WINNT\quit.exe.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.

----------------
HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:53:25, on 8/27/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\WINNT\explorer.exe
D:\WINNT\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrator\Local Settings\temp\jkos-Administrator\binaries\ScanningProcess.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\cmd.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINNT\system32\NOTEPAD.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {3B5E6F50-41B3-4DAA-8BC7-8155DDC7810C} - http://install.spywarelabs.com/DistID/3801040702/BundleOuter3801040702.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...le.com/samantha/us/win/QuickTimeInstaller.exe
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O20 - Winlogon Notify: WebCheck - D:\WINNT\system32\e002lado1d0c.dll
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 7697 bytes

 

[Blade81]

Hi

Start hjt, do a system scan, check (if found):
O16 - DPF: {3B5E6F50-41B3-4DAA-8BC7-8155DDC7810C} - http://install.spywarelabs.com/DistI...3801040702.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab

Close browsers and fix checked.


Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  D:\WINNT\system32\e002lado1d0c.dll
  HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck

• Return to OTMoveIt2, right click in the
  Paste Standard List of Files/Folders to Move
  window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


Run Kaspersky online scanner again and post back its report & a fresh hjt log too.

 

[eythcobb]

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:04:35, on 8/28/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\Explorer.EXE
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrator\Local Settings\temp\jkos-Administrator\binaries\ScanningProcess.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O20 - Winlogon Notify: MCD - D:\WINNT\system32\r0p80a7ued.dll
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 7140 bytes

-------------------
Kaspersky log:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, August 28, 2008
Operating System: Microsoft Windows 2000 Professional Service Pack 3 (build 2195)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, August 27, 2008 21:33:26
Records in database: 1152133
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 162272
Threat name: 9
Infected objects: 105
Suspicious objects: 2
Duration of the scan: 24:58:34


File name / Threat name / Threats count
rundll32.exe\ruvpperf.dll/rundll32.exe\ruvpperf.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
Explorer.EXE\ruvpperf.dll/Explorer.EXE\ruvpperf.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
C:\WINDOWS\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.VBS.KakWorm 6
C:\WINDOWS\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 14
C:\WINDOWS\Profiles\admin\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Inbox.dbx Infected: Email-Worm.VBS.KakWorm 6
C:\WINDOWS\Profiles\admin\Application Data\Identities\{DC4B05A0-CF6F-11D3-B64C-FB1910A7623B}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 14
D:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{D53FF441-54D1-4B1D-A869-9714785A7299}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
D:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\Documents and Settings\Administrator\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\Program Files\Mozilla Firefox\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
D:\QooBox\Quarantine\D\WINNT\system32\atctres.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\en48l1hu1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\en6sl1j71.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\enr0l19m1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fplm0331e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fpp0037me.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\fpr0039me.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\g4jo0e13eh.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\h6j40g1qe6.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\hr2u05f9e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\hrlu0539e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ihsso.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ir04l5dq1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\ir20l5fm1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\j0p0la7m1d.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\k4no0e53eh.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kt26l7fs1.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kt6ol7j31.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\l0r00a9med.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\lv4s09h7e.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\m4rmle911h.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\n84slih7184.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\nawrsfr.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q0680ajuedo80.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q6nulg5916.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\q6rq0g95e6.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\r48s0el7ehq.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\kedcan.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\lvn6095se.dll.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\QooBox\Quarantine\D\WINNT\system32\guard.tmp.vir Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\tlpmib.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\en06l1ds1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\ennql1551.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\o0lu0a39ed.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\lv6209joe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\k4260efseh260.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\n4p40e7qeh.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\enr6l19s1.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\p08qlal51dq.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\q686lgls16q6.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\f40o0ed3eh0.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\l06olaj31do.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\l6j8lg1u16.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\p64ulgh9164.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\p4n80e5ueh.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\lv6409jqe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\azaola931d.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\azaulgh9164.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\l48m0el1ehq.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\jGvacypt.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\f02mlaf11d2.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\guard.tmp_tobedeleted Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\o0rola931d.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\lvn4095qe.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system32\l8l6li3s18.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\system\UpdInstall.exe Infected: not-a-virus:AdWare.Win32.Look2Me.e 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\Downloaded Program Files\CONFLICT.1\HDPlugin1019.dll Infected: not-a-virus:AdWare.Win32.Gator.1019 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\Downloaded Program Files\flash.inf Infected: not-a-virus:AdWare.Win32.BetterInternet.be 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\Downloaded Program Files\SbCIe028.dll Infected: not-a-virus:AdWare.Win32.SideStep.a 1
D:\_OTMoveIt\MovedFiles\08262008_234729\WINNT\jmmrwk.exe Infected: not-a-virus:AdWare.Win32.BetterInternet.s 1

The selected area was scanned.

-------------------------

OTMoveIt log:

LoadLibrary failed for D:\WINNT\system32\e002lado1d0c.dll
D:\WINNT\system32\e002lado1d0c.dll NOT unregistered.
File move failed. D:\WINNT\system32\e002lado1d0c.dll scheduled to be moved on reboot.
< HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck >
Registry key HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WebCheck\\ deleted successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08272008_181755

 

[Blade81]

Download L2mfix from one of
these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click
the Install button to extract the files and follow the prompts,
then open the newly added l2mfix folder on your desktop. Double click
l2mfix.bat and select option #1 for Run Find Log by
typing 1 and then pressing enter. This will scan your computer and it
may appear nothing is happening, then, after a minute or 2, notepad will
open with a log. Copy the contents of that log and paste it into this
thread.

IMPORTANT: Do NOT run option #2 OR any other files in the
l2mfix folder until you are asked to do so!

 

[eythcobb]

L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="D:\\WINNT\\system32\\r0p80a7ued.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{110A641B-05AA-DD93-C7E2-96B143AFBE1B}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
"{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
"{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{51EEE242-AD87-11d3-9C1E-0090278BBD99}"="Vim Shell Extension"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{771A9DA0-731A-11CE-993C-00AA004ADB6C}"="VBPropSheet"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{B988C8B2-373B-11CF-B6E0-00AA00BBBA9E}"="ICCompPropPage"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{C56C4E21-706D-11d0-AFC5-444553540002}"="My Digital Camera"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}"=""
"{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\InprocServer32]
@="D:\\WINNT\\system32\\tlpmib.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\InprocServer32]
@="D:\\WINNT\\system32\\ruvpperf.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

D:\WINNT\SYSTEM32\
ruvpperf.dll Wed Aug 27 2008 6:20:32p ..S.R 232,786 227.33 K
t08u0a~1.dll Tue Aug 26 2008 11:47:32p ..S.R 230,785 225.38 K
r0p80a~1.dll Sun Aug 24 2008 11:11:42a ..S.R 232,786 227.33 K

3 items found: 3 files (3 H/S), 0 directories.
Total of file sizes: 696,357 bytes 680.04 K
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive D is WIN2K
Volume Serial Number is 11E9-2260

Directory of D:\WINNT\System32

08/27/2008 06:20p 232,786 ruvpperf.dll
08/26/2008 11:47p 230,785 t08u0al9edq.dll
08/24/2008 11:11a 232,786 r0p80a7ued.dll
07/17/2008 08:23a 5,852 KGyGaAvL.sys
07/17/2008 08:22a 104 365195E1C6.sys
06/07/2001 11:05a <DIR> dllcache
5 File(s) 702,313 bytes
1 Dir(s) 1,280,073,728 bytes free

 

[Blade81]

Now we'll continue...

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click
l2mfix.bat and select option #2 for Run Fix by
typing 2 and then pressing enter, then press any key to reboot your
computer. After a reboot, your desktop and icons will appear, then
disappear (this is normal). L2mfix will continue to scan your computer
and when it's finished, notepad will open with a log. Copy the contents
of that log and paste it back into this thread, along with a new
Hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder
unless you are asked to do so!

Note : Once the PC has restarted if a log does not appear or the
icons didn't disappear, run the
second.bat located inside the L2mfix folder.

 

[eythcobb]

l2mfix log:

L2mfix 032106
Creating Account.
The command completed successfully.


Adding Administrative privleges.
The command completed successfully.

Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
D:\WINNT\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 140 'smss.exe'
Killing PID 140 'smss.exe'
Error 0x5 : Access is denied.


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 160 'winlogon.exe'
Killing PID 160 'winlogon.exe'
Error 0x5 : Access is denied.


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1016 'explorer.exe'
Killing PID 1016 'explorer.exe'
Error 0x5 : Access is denied.


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 876 'rundll32.exe'
Killing PID 876 'rundll32.exe'
Error 0x5 : Access is denied.

Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
Deleting: D:\WINNT\system32\r0p80a7ued.dll
Successfully Deleted: D:\WINNT\system32\r0p80a7ued.dll
Deleting: D:\WINNT\system32\ruvpperf.dll
Successfully Deleted: D:\WINNT\system32\ruvpperf.dll
Deleting: D:\WINNT\system32\t08u0al9edq.dll
Successfully Deleted: D:\WINNT\system32\t08u0al9edq.dll

msg11?.dll
0 file(s) copied.
Desktop.ini sucessfully removed




Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
"Asynchronous"=dword:00000000
"DllName"="D:\\WINNT\\system32\\r0p80a7ued.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
D:\WINNT\system32\r0p80a7ued.dll
D:\WINNT\system32\ruvpperf.dll
D:\WINNT\system32\t08u0al9edq.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}\InprocServer32]
@="D:\\WINNT\\system32\\tlpmib.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}\InprocServer32]
@="D:\\WINNT\\system32\\ruvpperf.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}"=-
"{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}"=-
[-HKEY_CLASSES_ROOT\CLSID\{F15C9CD3-D208-415C-B45F-E4F963CCE7FE}]
[-HKEY_CLASSES_ROOT\CLSID\{2FC88215-B7FE-427B-AA31-A72E7BDC51E4}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/r0p80a7ued.dll (deflated 5%)
adding: dlls/ruvpperf.dll (deflated 5%)
adding: dlls/t08u0al9edq.dll (deflated 4%)
adding: backregs/notibac.reg (deflated 63%)
adding: backregs/shell.reg (deflated 75%)
adding: backregs/F15C9CD3-D208-415C-B45F-E4F963CCE7FE.reg (deflated 70%)
adding: backregs/2FC88215-B7FE-427B-AA31-A72E7BDC51E4.reg (deflated 70%)

------------------------
hjtlog:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:02:54, on 8/30/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\WINNT\system32\notepad.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O20 - Winlogon Notify: MCD - D:\WINNT\system32\r0p80a7ued.dll (file missing)
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 7014 bytes

 

[Blade81]

Hi

• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  D:\WINNT\system32\guard.tmp
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD

• Return to OTMoveIt2, right click in the
  Paste Standard List of Files/Folders to Move
  window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Reboot and post a fresh hjt log too.

 

[eythcobb]

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44:32, on 8/30/2008
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\dlcxcoms.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\System32\nvsvc32.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\Program Files\iVasion\WinPoET\WrOS.EXE
D:\WINNT\system32\svchost.exe
D:\WINNT\Explorer.EXE
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\Program Files\EarthLink 5.0\updatemgr.exe
D:\Program Files\Winamp\Winampa.exe
D:\Program Files\Picasa\PicasaMediaDetector.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINNT\SYSTEM32\3cshtdwn.exe
D:\WINNT\SYSTEM32\3cmlink.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe
D:\Program Files\Dell Photo AIO Printer 926\memcard.exe
D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\WINNT\system32\mrtMngr.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\winnt\googletoolbar4.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [3c1807pd] D:\WINNT\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [WinPoET] D:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [LifeScape Media Detector] D:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dlcxmon.exe] "D:\Program Files\Dell Photo AIO Printer 926\dlcxmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "D:\Program Files\Dell Photo AIO Printer 926\memcard.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "D:\Program Files\Dell PC Fax\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] D:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "D:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "D:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCXCATS] rundll32 D:\WINNT\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\program files\partypoker\IEExtension.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176311852931
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O23 - Service: dlcx_device - - D:\WINNT\system32\dlcxcoms.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINNT\System32\nvsvc32.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - D:\Program Files\iVasion\WinPoET\WrOS.EXE

--
End of file - 6905 bytes

================================

OT MoveIT log:

File/Folder D:\WINNT\system32\guard.tmp not found.
< HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD >
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD\\ deleted successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08302008_144015

 

[Blade81]

Hi

Looks quite good now. Before final instructions I'd like to know how's the system running now?

 

[eythcobb]

There are a couple of clear improvements:
- Not more rogue IE instance popping up with ads
- For a long time (1+ years), I always got a couple of "Unrecognized files by Windows, do you want to continue" dialog boxes after a reboot. These have now gone away and I get clean reboots.

I gave up on IE and Outlook Express a long time ago due to bad behaviors (probably due to some of the malware we have just removed) and just use Firefox and web-based email. I noticed several bad files that looked linked to Outlook Express and you mentioned cleaning up the deleted and sent folders. I have been fearful of bringing Outlook Express up since I have used it for a long, long time and had trouble before. Do you think I should continue to ignore this app, or bring it up and clean out sent/deleted?

One other small thing is that there continues to be some small tracking cookie issues SpyBot is picking up that don't seem to go away after an attempt to fix. I copied a subset of the SpyBot log below. Is this behavior expected?

Thanks again for all of your help.


-----------------------------

--- Search result list ---
Hint of the Day: Click the bar at the right of this to see more information! ()


DoubleClick: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


MediaPlex: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


CasaleMedia: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


CasaleMedia: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


CasaleMedia: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


CasaleMedia: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)


Zedo: Tracking cookie (Firefox: Linda) (Cookie, nothing done)

 

[Blade81]

Hi

Just empty all boxes thru Outlook Express without browsing email messages there.

Those cookies are normal. To get rid of most of them for good you may install mvps hosts file meantioned below in this post.

Well congrats, it appears your system is all clean Are you still noticing any problems? If not, it's time to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT


We need to re hide system files. To do so, please follow the steps below:

1. Double-click My Computer.
2. Click the Tools menu, and then click Folder Options.
3. Click the View tab.
4. Put a check by
   Hide file extensions for known file types.
5. Under the
   Hidden files
   folder, select
   Show hidden files and folders.
   
6. Check
   Hide protected operating system files.
7. Click Apply, and then click OK.

Now lets uninstall ComboFix:

• Click START then RUN
• Now type Combofix /u in the runbox and click OK

Next we remove all used tools.

• Double-click OTMoveIt2.exe.
• Click the CleanUp! button.
• Select Yes when the
  Begin cleanup Process?
  prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the internet, please allow it to do so.




UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

• Download Adaware
  Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial
  The program is available for download here
• Download SpywareBlaster
  Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
  kill bits
  in the registry, so that certain activex controls can't install.
  If you don't know what activex controls are, see here
  You can download SpywareBlaster here here
  SpywareBlaster tutorial
  
• hosts file:
  • Every version of windows has a hosts file as part of them.
  • In a very basic sense, they are used to locate webpages.
  • We can customize a hosts file so that it blocks certain webpages.
  • However, it can slow down certain computers.
  • This is why using a hosts file is optional!!
  Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
  If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  1. [*]Click the start button (at the lower left hand corner of your screen) [*]Click run [*]In the dialog box, type services.msc [*]hit enter, then locate dns client [*]Highlight it, then double-click it. [*]On the dropdown box, change the setting from automatic to manual. [*]Click ok
  
  
  
• Get Anti Virus Software and keep it updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. See here to choose one
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
  See here to choose one if you don't have a 3rd party firewall

Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Run the spybot and adaware regularly. (Once or twice a week minimum.)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade

 

[Blade81]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.