17 replies to this topic

[smokeylonesome]

Started off with HomeAntiVirus2010, would not let MBAM, Spybot or MSMRT run, they would start the scan then die after a few seconds. Tried to open back up and get a no permission error. Uninstall the antivirus software to try again but the exe file cannot be deleted. Finally did a manual remove and got rid of the red x in the task bar and it has quit trying to download homeantivirus2010. Thought I had it but MBAM etc still would not run. Now something has complete taken over IE, it will not go to the selected links, always redirected to some worthless site. Currenly using FireFox and it is running slow as molasses. Installed and tried to run HJT, see logfile below, but it ran for only a few seconds then shut down, I don't think it completed the scan. HELP.

Somkeylonesome

Logfile of HijackThis v1.99.0
Scan saved at 2:38:54 PM, on 3/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Portrait Displays\forteManager\DTHtml.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\PROGRA~1\BLUETO~1\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Downloads\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O1 - Hosts: HP79872F HP0017A479872F
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Apoligamepixoh] rundll32.exe "C:\Documents and Settings\a\Local Settings\Temporary Internet Files\596325812.dll",e
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://*.turbotax.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1231151953266
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
O23 - Service: Portrait Displays Display Tune Service - Unknown - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: IAA Event Monitor - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MaxBackServiceInt - Unknown - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe
O23 - Service: MaxSyncService - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

[smokeylonesome]

Forgot to mention, tried downloading and renaming MBAM to winlogon.exe while booted up in SAFE mode for the entire time. It downloaded, updated then still got killed when I tried to scan.

[sUBs]

Download and run Win32kDiag:

1. Download Win32kDiag from any of the following locations and save it to your Desktop.


• Download Win32kDiag (Win32kDiag.exe) - #1
  
  
• Download Win32kDiag (Win32kDiag.exe) - #2
  
  
• Download Win32kDiag (Win32kDiag.exe) - #3
  2. Double-click Win32kDiag.exe to run Win32kDiag and let it finish.
  3. When it states "Finished! Press any key to exit...", press any key on your keyboard to close the program.
  4. Double-click on the Win32kDiag.txt file that is located on your Desktop and post the entire contents of that log as a reply to this topic.

[smokeylonesome]

Thanks, Win32 log below.




Log file is located at: C:\Documents and Settings\a\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...



Found mount point : C:\WINDOWS\$hf_mig$\{29F8DDC1-9487-49b8-B27E-3E0C3C1298FF}

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\SYSTEM32\MRT.exe

[1] 2009-07-29 17:49:16 24281536 C:\WINDOWS\SYSTEM32\MRT.exe ()

[2] 2009-04-06 07:57:26 24921544 C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1450\A0079782.exe (Microsoft Corporation)



Cannot access: C:\WINDOWS\SYSTEM32\netlogon.dll

[1] 2004-08-04 06:00:00 407040 C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll (Microsoft Corporation)

[1] 2008-04-13 19:12:01 407040 C:\WINDOWS\ServicePackFiles\i386\netlogon.dll (Microsoft Corporation)

[1] 2008-04-13 19:12:01 60416 C:\WINDOWS\SYSTEM32\netlogon.dll ()

[2] 2008-04-13 19:12:01 407040 C:\WINDOWS\SYSTEM32\ntelogon.dll (Microsoft Corporation)

[1] 2004-08-04 06:00:00 407040 C:\i386\NETLOGON.DLL (Microsoft Corporation)



Cannot access: C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe

[1] 2009-02-06 05:15:13 227840 C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2004-08-04 06:00:00 218112 C:\WINDOWS\$NtServicePackUninstall$\wmiprvse.exe (Microsoft Corporation)

[1] 2008-04-13 19:12:40 218112 C:\WINDOWS\$NtUninstallKB956572$\wmiprvse.exe (Microsoft Corporation)

[1] 2008-04-13 19:12:40 218112 C:\WINDOWS\ServicePackFiles\i386\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 05:10:02 227840 C:\WINDOWS\SYSTEM32\DLLCACHE\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 05:10:02 227840 C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe ()

[1] 2004-08-04 06:00:00 218112 C:\i386\WMIPRVSE.EXE (Microsoft Corporation)





Finished!

[sUBs]

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingc...to-use-combofix

Post the log from ComboFix when you've accomplished that.

[smokeylonesome]

ComboFix RAN!!! That is already an improvement. Log below.


ComboFix 09-08-29.01 - a 08/30/2009 8:46.1.2 - NTFSx86
Running from: c:\program downloads\ComboFix\Combo-Fix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\a\Application Data\cixosumyta.bat
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome.manifest
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\_cfg.js
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\c.js
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\overlay.xul
c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\install.rdf
c:\documents and settings\a\Local Settings\Application Data\ohuso.reg
c:\documents and settings\a\Local Settings\Application Data\qagygeta.inf
c:\documents and settings\a\Local Settings\Temporary Internet Files\ifofa.sys
c:\documents and settings\a\Local Settings\Temporary Internet Files\meradabyj._sy
c:\documents and settings\a\Local Settings\Temporary Internet Files\ofyw.scr
c:\documents and settings\a\Local Settings\Temporary Internet Files\udahokigi.db
c:\documents and settings\a\Local Settings\Temporary Internet Files\ykoqavup.scr
c:\documents and settings\All Users\Application Data\amixoz.vbs
c:\documents and settings\All Users\Documents\ahicuvew.reg
c:\documents and settings\All Users\Documents\siqez.inf
c:\program files\Common Files\edywirocer.bat
c:\program files\Common Files\qexykidiq.inf
c:\windows\batyxaboli.reg
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\ewagos.exe
c:\windows\ewirujom.dll
c:\windows\Installer\1d7a3.msi
c:\windows\opebuvo.inf
c:\windows\sili.reg
c:\windows\system32\bszip.dll
c:\windows\system32\dllcache\beep.sys
c:\windows\system32\tmp.reg
c:\windows\system32\wisdstr.exe
c:\windows\system32\ygyzokuv.inf
c:\windows\yhabuz.bat

Infected copy of c:\windows\system32\netlogon.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\netlogon.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.

2009-08-29 16:39 . 2009-08-03 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 16:39 . 2009-08-30 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 16:39 . 2009-08-03 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 13:12 . 2009-08-29 13:12 0 ----a-w- c:\documents and settings\a\settings.dat
2009-08-29 12:08 . 2009-08-29 12:08 -------- d-----w- c:\program files\Trend Micro
2009-08-26 22:07 . 2009-08-26 22:08 -------- d-----w- c:\program files\SpywareBlaster
2009-08-20 09:29 . 2009-08-20 09:29 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 09:56 . 2009-08-18 09:56 -------- d-----w- c:\documents and settings\a\Local Settings\Application Data\Mozilla
2009-08-16 20:12 . 2009-08-16 20:12 117760 ----a-w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com
2009-08-02 16:12 . 2009-08-02 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-02 16:12 . 2009-08-02 16:12 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-08-02 13:25 . 2009-08-02 13:25 -------- d--h--w- c:\windows\PIF
2009-08-02 13:25 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\a\Application Data\Simply Super Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-01 18:47 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 09:35 . 2007-11-01 22:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-27 09:31 . 2008-05-06 00:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-27 09:31 . 2005-08-01 10:09 -------- d-----w- c:\program files\Lavasoft
2009-08-20 09:29 . 2005-03-10 17:34 -------- d-----w- c:\program files\Java
2009-08-15 14:11 . 2005-04-03 16:31 -------- d-----w- c:\program files\Canon
2009-08-02 13:25 . 2009-07-31 00:19 -------- d-----w- c:\program files\AVG
2009-08-02 13:25 . 2009-07-31 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-02 13:24 . 2009-07-31 00:05 -------- d-----w- c:\program files\Trojan Remover
2009-08-02 13:20 . 2009-03-22 13:37 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-08-01 18:18 . 2007-05-28 13:17 -------- d-----w- c:\program files\Eraser
2009-07-31 22:39 . 2009-03-22 13:36 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-07-31 00:54 . 2005-03-26 21:47 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-07-31 00:05 . 2009-07-31 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-07-30 21:33 . 2009-07-30 21:33 19604 ----a-w- c:\windows\bobojy.com
2009-07-30 21:33 . 2009-07-30 21:33 18309 ----a-w- c:\program files\Common Files\tycujavece.scr
2009-07-30 21:33 . 2009-07-30 21:33 15725 ----a-w- c:\documents and settings\a\Local Settings\Application Data\nofesu.sys
2009-07-30 21:33 . 2009-07-30 21:33 14513 ----a-w- c:\windows\system32\zoqa.dll
2009-07-30 21:33 . 2009-07-30 21:33 13338 ----a-w- c:\program files\Common Files\xemetoh.pif
2009-07-30 21:33 . 2009-07-30 21:33 12083 ----a-w- c:\documents and settings\All Users\Application Data\yhozucuj.scr
2009-07-30 21:33 . 2009-07-30 21:33 12083 ----a-w- c:\documents and settings\All Users\Application Data\yhozucuj.scr
2009-07-30 20:49 . 2009-07-30 20:49 19251 ----a-w- c:\windows\system32\jecepudyj.bin
2009-07-30 20:49 . 2009-07-30 20:49 16926 ----a-w- c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com
2009-07-30 20:49 . 2009-07-30 20:49 16585 ----a-w- c:\program files\Common Files\evihi.pif
2009-07-30 20:49 . 2009-07-30 20:49 15720 ----a-w- c:\documents and settings\a\Application Data\qenawogec.exe
2009-07-30 20:49 . 2009-07-30 20:49 15720 ----a-w- c:\documents and settings\a\Application Data\qenawogec.exe
2009-07-30 20:49 . 2009-07-30 20:49 13062 ----a-w- c:\program files\Common Files\enygew.ban
2009-07-30 20:49 . 2009-07-30 20:49 19050 ----a-w- c:\documents and settings\a\Local Settings\Application Data\zafypire.bin
2009-07-30 20:49 . 2009-07-30 20:49 10218 ----a-w- c:\program files\Common Files\gezotekiwe.scr
2009-07-30 19:00 . 2009-07-31 09:10 3036024 ----a-w- c:\documents and settings\a\Application Data\Simply Super Software\Trojan Remover\sxmC5.exe
2009-07-30 19:00 . 2009-07-31 00:06 3036024 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\hhu3.exe
2009-07-25 10:23 . 2009-01-09 21:41 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 15:09 . 2009-07-23 06:38 -------- d-----w- c:\program files\Shared
2009-07-20 16:34 . 2009-07-20 16:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-07-15 05:58 . 2008-07-20 11:56 -------- d-----w- c:\program files\NewsRover
2009-07-12 15:47 . 2005-03-23 00:15 86600 ----a-w- c:\documents and settings\a\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-05-10 00:19 . 2007-05-10 00:19 2823446 ----a-w- c:\program files\audacity-win-unicode-1.3.2.exe
2006-06-05 22:07 . 2006-06-05 22:07 2614605 ----a-w- c:\program files\Tetrominoes_v1-3_Instl.exe
2006-05-03 09:06 . 2007-11-01 21:43 163328 --sh--r- c:\windows\SYSTEM32\flvDX.dll
2007-02-21 10:47 . 2007-11-01 21:43 31232 --sh--r- c:\windows\SYSTEM32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-08-18 18:49 . 2005-08-18 18:49 307200 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe

1980-01-01 06:00 . 2004-10-14 21:42 1404928 c:\program files\Analog Devices\Core\bak\smax4pnp.exe

2005-03-10 17:35 . 2004-08-25 18:52 339968 c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

2004-01-07 07:01 . 2004-01-07 07:01 110592 c:\program files\Common Files\Sonic\Update Manager\bak\sgtray.exe

2005-03-10 17:36 . 2004-10-12 22:54 57344 c:\program files\CyberLink\PowerDVD\bak\DVDLauncher.exe

2004-09-15 07:01 . 2004-09-15 07:01 86016 c:\program files\Dell\Media Experience\bak\DMXLauncher.exe

2005-03-10 17:35 . 2004-06-29 17:23 135168 c:\program files\Intel\Intel Application Accelerator\bak\iaanotif.exe

2005-03-10 17:35 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2005-03-10 17:40 . 2004-09-14 14:50 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe

2005-03-10 17:40 . 2004-09-14 14:50 131072 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe

2005-03-10 17:43 . 2005-03-10 17:43 98304 c:\program files\QuickTime\bak\qttask.exe
2009-01-05 22:18 . 2009-01-05 22:18 413696 c:\program files\QuickTime\QTTask.exe

2005-03-10 17:44 . 2004-12-06 07:05 127035 c:\windows\SYSTEM32\dla\bak\tfswctrl.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="1" [X]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"DT LGE"="c:\program files\Portrait Displays\forteManager\DTHtml.exe" [2007-02-01 285696]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455]
"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2007-04-05 684118]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"NWEReboot"="" [N/A]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-25 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2007-10-18 217088]
Bluetooth.lnk - c:\program files\Bluetooth\Bluetooth Software\BTTray.exe [2005-9-19 581693]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Downloads\\Mute\\MUTE\\fileSharingMUTE.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\MMC.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 DPCNET5U;Satellite USB Driver;c:\windows\system32\DRIVERS\dpcnet5u.sys [x]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
R3 OlCamudp;OLYMPUS Digital Camera;c:\windows\system32\Drivers\olcamudp.sys [2000-02-08 10379]
S3 DVC150B;Dazzle DVC 150B;c:\windows\system32\Drivers\dvc150b.SYS [2005-02-09 30976]

.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Send To &Bluetooth - c:\program files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\mxuet5r0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 83
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 08:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,dd,35,7d,54,5c,
f4,84,6f,c8,28,51,af,b0,29,a3,98,2e,70,73,e8,58,5e,5a,6c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,ef,98,38,b6,33,
e2,d3,3b,71,3b,04,66,8b,46,0d,96,b0,d5,27,14,ca,1e,a7,ba,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,8c,28,30,81,68,
8d,90,15,25,da,ec,7e,55,20,c9,26,17,b1,aa,3f,4b,52,8b,27,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,37,12,51,14,ec,
c3,fe,9e,3e,1e,9e,e0,57,5a,93,61,6d,2c,0f,7f,59,7a,b3,ec,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,5d,fc,f0,4f,cc,
32,33,58,cd,44,cd,b9,a6,33,6c,cd,6d,cc,f8,80,99,c2,64,9c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,c4,a4,c7,11,66,
ca,32,52,b0,18,ed,a7,3f,8d,37,a4,fe,d3,d3,24,81,ad,57,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,d7,ba,bd,28,28,
71,5d,5e,31,77,e1,ba,b1,f8,68,02,46,45,cf,0c,18,02,35,dc,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,db,78,8d,ca,c7,
11,48,9f,83,6c,56,8b,a0,85,96,ab,e2,fe,a5,39,96,c3,ea,a5,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,85,01,d8,2e,07,
b8,c3,ac,51,fa,6e,91,28,9e,14,cc,7e,bb,c1,b1,55,b1,54,e1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,bd,27,59,97,cb,
3d,40,24,b1,cd,45,5a,a8,c4,f8,b9,8c,4f,9b,73,ae,53,8c,75,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3b,f5,26,43,b9,
57,ba,87,e3,0e,66,d5,eb,bc,2f,6b,bf,c5,48,b8,bd,c3,ea,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,b2,75,e1,a3,f5,
e3,85,8b,fa,ea,66,7f,d4,3b,6b,70,cc,5d,63,0a,02,52,89,a3,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2352)
c:\progra~1\SBCSEL~1\SMARTB~1\SBHook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\SBC Self Support Tool\bin\mpbtn.exe
c:\program files\Bluetooth\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\HPZipm12.exe
c:\program files\Bluetooth\Bluetooth Software\BTStackServer.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\SYSTEM32\msiexec.exe
c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe
c:\windows\SYSTEM32\wscntfy.exe
c:\windows\SYSTEM32\HPZinw12.exe
.
**************************************************************************
.
Completion time: 2009-08-30 8:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-30 13:58

Pre-Run: 109,032,763,392 bytes free
Post-Run: 112,174,645,248 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

372

[sUBs]

Does MBAM work now?


Open NOTEPAD and copy/paste the text in the quotebox below into it:

DirLook::
c:\program files\Shared
FILE::
C:\documents and settings\a\settings.dat
C:\windows\bobojy.com
C:\program files\Common Files\tycujavece.scr
C:\documents and settings\a\Local Settings\Application Data\nofesu.sys
C:\windows\system32\zoqa.dll
C:\program files\Common Files\xemetoh.pif
C:\documents and settings\All Users\Application Data\yhozucuj.scr
C:\windows\system32\jecepudyj.bin
C:\documents and settings\a\Local Settings\Application Data\tucoxatud.com
C:\program files\Common Files\evihi.pif
C:\documents and settings\a\Application Data\qenawogec.exe
C:\program files\Common Files\enygew.ban
C:\documents and settings\a\Local Settings\Application Data\zafypire.bin
C:\program files\Common Files\gezotekiwe.scr
FOLDER::
C:\program files\Adobe\Acrobat 7.0\Reader\Bak
C:\program files\Analog Devices\Core\Bak
C:\program files\ATI Technologies\ATI Control Panel\Bak
C:\program files\Common Files\Sonic\Update Manager\Bak
C:\program files\CyberLink\PowerDVD\Bak
C:\program files\Dell\Media Experience\Bak
C:\program files\Intel\Intel Application Accelerator\Bak
C:\program files\Intel\Modem Event Monitor\Bak
C:\program files\MUSICMATCH\Musicmatch Jukebox\Bak
C:\program files\MUSICMATCH\Musicmatch Jukebox\Bak
C:\program files\QuickTime\Bak
C:\windows\SYSTEM32\dla\Bak
REGISTRY::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"=-
"SUPERAntiSpyware"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NWEReboot"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=-

Save this as "CFScript"





Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.


---------------


Using Internet Explorer, visit http://www.kaspersky.com/service?chapter=161739400

Vista users right click on the Internet Explorer shortcut, and choose Run As Administrator.

**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
  
• The program will then begin downloading and installing and will also update the database.
  
• Please be patient as this can take several minutes.
  
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  
• Click View scan report at the bottom.
  
• Click the Save Report As... button.
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

---------------


In your next post, please include fresh logs from:

• Online scan
  
• ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

[smokeylonesome]

I decided to run the script in ComboFIx before trying to run MBAM. Log file below.


ComboFix 09-08-29.01 - a 08/30/2009 9:58.2.2 - NTFSx86
Running from: c:\program downloads\ComboFix\Combo-Fix.exe
Command switches used :: c:\documents and settings\a\Desktop\CFScript.txt
* Created a new restore point

FILE ::
"c:\documents and settings\a\Application Data\qenawogec.exe"
"c:\documents and settings\a\Local Settings\Application Data\nofesu.sys"
"c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com"
"c:\documents and settings\a\Local Settings\Application Data\zafypire.bin"
"c:\documents and settings\a\settings.dat"
"c:\documents and settings\All Users\Application Data\yhozucuj.scr"
"c:\program files\Common Files\enygew.ban"
"c:\program files\Common Files\evihi.pif"
"c:\program files\Common Files\gezotekiwe.scr"
"c:\program files\Common Files\tycujavece.scr"
"c:\program files\Common Files\xemetoh.pif"
"c:\windows\bobojy.com"
"c:\windows\system32\jecepudyj.bin"
"c:\windows\system32\zoqa.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\a\Application Data\qenawogec.exe
c:\documents and settings\a\Local Settings\Application Data\nofesu.sys
c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com
c:\documents and settings\a\Local Settings\Application Data\zafypire.bin
c:\documents and settings\a\settings.dat
c:\documents and settings\All Users\Application Data\yhozucuj.scr
c:\program files\Adobe\Acrobat 7.0\Reader\Bak
c:\program files\Adobe\Acrobat 7.0\Reader\Bak\AdobeUpdateManager.exe
c:\program files\Analog Devices\Core\Bak
c:\program files\Analog Devices\Core\Bak\smax4pnp.exe
c:\program files\ATI Technologies\ATI Control Panel\Bak
c:\program files\ATI Technologies\ATI Control Panel\Bak\atiptaxx.exe
c:\program files\Common Files\enygew.ban
c:\program files\Common Files\evihi.pif
c:\program files\Common Files\gezotekiwe.scr
c:\program files\Common Files\Sonic\Update Manager\Bak
c:\program files\Common Files\Sonic\Update Manager\Bak\sgtray.exe
c:\program files\Common Files\tycujavece.scr
c:\program files\Common Files\xemetoh.pif
c:\program files\CyberLink\PowerDVD\Bak
c:\program files\CyberLink\PowerDVD\Bak\DVDLauncher.exe
c:\program files\Dell\Media Experience\Bak
c:\program files\Dell\Media Experience\Bak\DMXLauncher.exe
c:\program files\Intel\Intel Application Accelerator\Bak
c:\program files\Intel\Intel Application Accelerator\Bak\iaanotif.exe
c:\program files\Intel\Modem Event Monitor\Bak
c:\program files\Intel\Modem Event Monitor\Bak\IntelMEM.exe
c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak
c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak\mm_tray.exe
c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak\mmtask.exe
c:\program files\QuickTime\Bak
c:\program files\QuickTime\Bak\qttask.exe
c:\windows\bobojy.com
c:\windows\SYSTEM32\dla\Bak
c:\windows\SYSTEM32\dla\Bak\tfswctrl.exe
c:\windows\system32\jecepudyj.bin
c:\windows\system32\zoqa.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.

2009-08-29 16:39 . 2009-08-03 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-29 16:39 . 2009-08-30 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-29 16:39 . 2009-08-03 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 12:08 . 2009-08-29 12:08 -------- d-----w- c:\program files\Trend Micro
2009-08-26 22:07 . 2009-08-26 22:08 -------- d-----w- c:\program files\SpywareBlaster
2009-08-20 09:29 . 2009-08-20 09:29 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2009-08-18 09:56 . 2009-08-18 09:56 -------- d-----w- c:\documents and settings\a\Local Settings\Application Data\Mozilla
2009-08-16 20:12 . 2009-08-16 20:12 117760 ----a-w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com
2009-08-02 16:12 . 2009-08-02 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-02 16:12 . 2009-08-02 16:12 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-08-02 13:25 . 2009-08-02 13:25 -------- d--h--w- c:\windows\PIF
2009-08-02 13:25 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\a\Application Data\Simply Super Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software
2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-01 18:47 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-30 15:02 . 2005-03-10 17:43 -------- d-----w- c:\program files\QuickTime
2009-08-27 09:35 . 2007-11-01 22:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-27 09:31 . 2008-05-06 00:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-08-27 09:31 . 2005-08-01 10:09 -------- d-----w- c:\program files\Lavasoft
2009-08-20 09:29 . 2005-03-10 17:34 -------- d-----w- c:\program files\Java
2009-08-15 14:11 . 2005-04-03 16:31 -------- d-----w- c:\program files\Canon
2009-08-02 13:25 . 2009-07-31 00:19 -------- d-----w- c:\program files\AVG
2009-08-02 13:25 . 2009-07-31 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-02 13:24 . 2009-07-31 00:05 -------- d-----w- c:\program files\Trojan Remover
2009-08-02 13:20 . 2009-03-22 13:37 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-08-01 18:18 . 2007-05-28 13:17 -------- d-----w- c:\program files\Eraser
2009-07-31 22:39 . 2009-03-22 13:36 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-07-31 00:54 . 2005-03-26 21:47 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2009-07-31 00:05 . 2009-07-31 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-07-30 19:00 . 2009-07-31 09:10 3036024 ----a-w- c:\documents and settings\a\Application Data\Simply Super Software\Trojan Remover\sxmC5.exe
2009-07-30 19:00 . 2009-07-31 00:06 3036024 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\hhu3.exe
2009-07-25 10:23 . 2009-01-09 21:41 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 15:09 . 2009-07-23 06:38 -------- d-----w- c:\program files\Shared
2009-07-20 16:34 . 2009-07-20 16:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-07-15 05:58 . 2008-07-20 11:56 -------- d-----w- c:\program files\NewsRover
2009-07-12 15:47 . 2005-03-23 00:15 86600 ----a-w- c:\documents and settings\a\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-05-10 00:19 . 2007-05-10 00:19 2823446 ----a-w- c:\program files\audacity-win-unicode-1.3.2.exe
2006-06-05 22:07 . 2006-06-05 22:07 2614605 ----a-w- c:\program files\Tetrominoes_v1-3_Instl.exe
2006-05-03 09:06 . 2007-11-01 21:43 163328 --sh--r- c:\windows\SYSTEM32\flvDX.dll
2007-02-21 10:47 . 2007-11-01 21:43 31232 --sh--r- c:\windows\SYSTEM32\msfDX.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\Shared ----

2009-07-23 15:09 . 2009-07-24 09:30 50688 ----a-w- c:\program files\Shared\_lib.sig
2009-07-23 12:45 . 2009-07-23 12:45 294924 ----a-w- c:\program files\Shared\_lib.dll
2009-07-23 09:34 . 2009-07-30 09:38 50688 ----a-w- c:\program files\Shared\lib.sig
2009-07-23 06:38 . 2009-07-24 11:45 294924 ----a-w- c:\program files\Shared\lib.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]
"DT LGE"="c:\program files\Portrait Displays\forteManager\DTHtml.exe" [2007-02-01 285696]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455]
"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2007-04-05 684118]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-25 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2007-10-18 217088]
Bluetooth.lnk - c:\program files\Bluetooth\Bluetooth Software\BTTray.exe [2005-9-19 581693]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Downloads\\Mute\\MUTE\\fileSharingMUTE.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\MMC.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]
R3 DPCNET5U;Satellite USB Driver;c:\windows\system32\DRIVERS\dpcnet5u.sys [x]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]
R3 OlCamudp;OLYMPUS Digital Camera;c:\windows\system32\Drivers\olcamudp.sys [2000-02-08 10379]
S3 DVC150B;Dazzle DVC 150B;c:\windows\system32\Drivers\dvc150b.SYS [2005-02-09 30976]

.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Send To &Bluetooth - c:\program files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\mxuet5r0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 83
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-30 10:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,dd,35,7d,54,5c,
f4,84,6f,c8,28,51,af,b0,29,a3,98,2e,70,73,e8,58,5e,5a,6c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,ef,98,38,b6,33,
e2,d3,3b,71,3b,04,66,8b,46,0d,96,b0,d5,27,14,ca,1e,a7,ba,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,8c,28,30,81,68,
8d,90,15,25,da,ec,7e,55,20,c9,26,17,b1,aa,3f,4b,52,8b,27,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,37,12,51,14,ec,
c3,fe,9e,3e,1e,9e,e0,57,5a,93,61,6d,2c,0f,7f,59,7a,b3,ec,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,5d,fc,f0,4f,cc,
32,33,58,cd,44,cd,b9,a6,33,6c,cd,6d,cc,f8,80,99,c2,64,9c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,c4,a4,c7,11,66,
ca,32,52,b0,18,ed,a7,3f,8d,37,a4,fe,d3,d3,24,81,ad,57,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,d7,ba,bd,28,28,
71,5d,5e,31,77,e1,ba,b1,f8,68,02,46,45,cf,0c,18,02,35,dc,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,db,78,8d,ca,c7,
11,48,9f,83,6c,56,8b,a0,85,96,ab,e2,fe,a5,39,96,c3,ea,a5,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,85,01,d8,2e,07,
b8,c3,ac,51,fa,6e,91,28,9e,14,cc,7e,bb,c1,b1,55,b1,54,e1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,bd,27,59,97,cb,
3d,40,24,b1,cd,45,5a,a8,c4,f8,b9,8c,4f,9b,73,ae,53,8c,75,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3b,f5,26,43,b9,
57,ba,87,e3,0e,66,d5,eb,bc,2f,6b,bf,c5,48,b8,bd,c3,ea,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,b2,75,e1,a3,f5,
e3,85,8b,fa,ea,66,7f,d4,3b,6b,70,cc,5d,63,0a,02,52,89,a3,6c,43,2d,1e,aa,22,\
.
Completion time: 2009-08-30 10:04
ComboFix-quarantined-files.txt 2009-08-30 15:04
ComboFix2.txt 2009-08-30 13:58

Pre-Run: 112,220,368,896 bytes free
Post-Run: 112,166,473,728 bytes free

318

[sUBs]

Quote

---- Directory of c:\program files\Shared ----

2009-07-23 15:09 . 2009-07-24 09:30 50688 ----a-w- c:\program files\Shared\_lib.sig
2009-07-23 12:45 . 2009-07-23 12:45 294924 ----a-w- c:\program files\Shared\_lib.dll
2009-07-23 09:34 . 2009-07-30 09:38 50688 ----a-w- c:\program files\Shared\lib.sig
2009-07-23 06:38 . 2009-07-24 11:45 294924 ----a-w- c:\program files\Shared\lib.dll

Any idea what these are? Are they part of something that you installed?

[smokeylonesome]

MBAM now runs. No way I could have killed off this sucker on my own. What was the offender.

Logfile below.


Malwarebytes' Anti-Malware 1.40
Database version: 2718
Windows 5.1.2600 Service Pack 3

8/30/2009 10:14:02 AM
mbam-log-2009-08-30 (10-14-02).txt

Scan type: Quick Scan
Objects scanned: 99663
Time elapsed: 3 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\TypeLib\{df058c45-cd18-453e-8745-5a77f60722ab} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b5a33c35-7298-4d15-8753-a2e851e2eab3} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d2b812-752d-4af1-a2fb-968c4d8446db} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e856b973-45fd-4559-8f82-eab539144667} (Adware.Gdown) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\GTDownDE_87.ocx (Adware.Gdown) -> Quarantined and deleted successfully.
C:\WINDOWS\meta4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Shared\lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.
C:\Program Files\Shared\_lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

[sUBs]

Quote

Any idea what these are? Are they part of something that you installed?

Quote

C:\Program Files\Shared\lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.
C:\Program Files\Shared\_lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

I guess that answers my query. Please delete the rest of the folder - C:\Program Files\Shared

I shall wait for the results of the Kaspersky scan

[smokeylonesome]

could not run the Kaspersky lab software. [Error: java.lang.UnsatisfiedLinkError: C:documents and SettingsLocal SettingsTempjkos-a inarieskosglue-7.026.0.dll: The system cannot find the file specified]

[sUBs]

Let's try a different scanner.



ESET Online Scanner

• Please go to the following link ESET Online Scanner Link
  
• Tick the box YES, I accept the Terms Of Use
  
• Click the Start button
  
• Now click the Install button
  
• Click Start
  
  The scanner engine will initialise and update
  
  
• Do Not tick the box Remove found threats
  
• Click the Scan button
  
  The scan will now run, please be patient
  
  
• When the scan finishes click the Details tab
  
• Copy and paste the contents of the C:\Program Files\EsetOnlineScanner\log.txt back here.

[smokeylonesome]

Sorry for the delay, had to send the oldest to Texas A&M for his first semester of college, also prep'd about 8 pints of jalapenoes for canning tomorrow, if you want a recipe for the best pickled jals (better than Trappies) let me know. While I had control of my computer, for the first time is 3 weeks, I updated window xp, java and ran Malwarebytes on deep scan mode along with Spybot's latest scan, deleted detected files as suggested. ESET scan file is attached.



ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=31f7dd8d66776046bb8675bdeb4b88e0
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-31 12:15:40
# local_time=2009-08-30 07:15:40 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1027 62 0 7 26781485000000
# scanned=225826
# found=10
# cleaned=0
# scan_time=5618
C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2004 email.dbx Win32/Sober.I worm 00000000000000000000000000000000 I
C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan 00000000000000000000000000000000 I
C:\I386\GTDownDE_87.ocx probably a variant of Win32/Adware.Agent application 00000000000000000000000000000000 I
F:\Mark 8.28.09\Outlook Express\2004 email.dbx Win32/Sober.I worm 00000000000000000000000000000000 I
F:\Mark 8.28.09\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan 00000000000000000000000000000000 I
F:\Russell's Awesome Documents\My Music April 1 2009\03 Track 3 (techno).wma WMA/TrojanDownloader.Wimad.D trojan 00000000000000000000000000000000 I
F:\Russell's Awesome Documents\My Music April 1 2009\07 Track 7 (techno).wma WMA/TrojanDownloader.Wimad.D trojan 00000000000000000000000000000000 I
F:\Russell's Awesome Documents\My Music April 1 2009\The Mars Volta - Televators.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
F:\Russell's Awesome Documents\My Music April 1 2009\Amon Amarth\runes to my memory.mpg a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I
F:\Russell's Awesome Documents\My Music April 1 2009\Bonobo\Bonobo - Discography.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I

[sUBs]

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2004 email.dbx Win32/Sober.I worm 

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan

F:\Mark 8.28.09\Outlook Express\2004 email.dbx Win32/Sober.I worm 

F:\Mark 8.28.09\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan

These are infections/threats from old backups of old email. To remove them, you have to launch your email client, load those backups and pick them off individually. Personally, I'll leave them be. The infections are old and shall be easily picked up by your resident antivirus program.


------------



Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"F:\Russell's Awesome Documents\My Music April 1 2009\03 Track 3 (techno).wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\07 Track 7 (techno).wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\The Mars Volta - Televators.wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\Amon Amarth\runes to my memory.mpg"
"F:\Russell's Awesome Documents\My Music April 1 2009\Bonobo\Bonobo - Discography.mp3"
) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"%systemdrive%\VundoFix Backups"
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
pause
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:
Double click on fix.bat & allow it to run

Post back to tell me what it says

[smokeylonesome]

Ran for about 3 seconds and came back with Deletion Successful.

[sUBs]

Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

• Uninstall ComboFix ... do not skip this step
  This process will perform some post cleanup measures.
  Do this by going to to Start > Run & typing in ComboFix /u
  
  
  
  
• ANTIVIRUS SOFTWARE
  It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
  
  
• Microsoft Windows Update → http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
  
• http://www.mozilla.o...oducts/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
  
• http://www.aumha.org...erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://www.spywarein...showtopic=60955

After doing all these, your system will be optimised against future threats.
.
Have a safe & happy computing day.

Kindly respond to this thread once more so we can mark this thread as resolved.

[smokeylonesome]

You are great, I was on the verge of wiping the entire drive and starting over. Many many thanks.

One each Smokeylonesome