Infected with unknown virus - Outlook 2007 sending spam upon open.

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

Infected with unknown virus - Outlook 2007 sending spam upon open., All scans recommend scans coming up clean - can't find this bugger

Options

CoachMcGuirk View Member Profile	Oct 6 2008, 02:57 PM Post #1
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	I've recently begun experiencing a problem with my Outlook 2007. When I open the program, some malicious program is sending out a number of spam emails using my default email account in Outlook. The spam bot does not appear to be sending emails to my Outlook contacts, rather seemingly random addresses. I've gotten bounce-back emails showing undeliverable mail from my account that I obviously didn't send (your standard spam topics). I'm generally fairly competent in removal, but this one has me completely stumped. I've done all the recommend scans and they all come up clean. Google search reveals I'm not the only one to see this (seems to be a recently occurring problem), but no posted solutions that I could find. Time to turn it over to the generous experts here. Any help you can provide, I would really appreciate it. Thank you so much! HJT Log Below: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:55:40 PM, on 10/6/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\msftesql.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\My Lockbox\flockbox.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe O4 - HKLM\..\Run: [flockbox] C:\Program Files\My Lockbox\flockbox.exe /a O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Startup: DING!.lnk = C:\Program Files\Southwest Airlines\Ding\Ding.exe O4 - Startup: Microsoft Office Outlook.lnk = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE O4 - Global Startup: ColorVisionStartup.lnk = C:\Program Files\ColorVision\Utility\ColorVisionStartup.exe O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ? O4 - Global Startup: Privoxy.lnk = C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.kaspersky.com O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1182203302703 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1182203280921 O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.mpix.com/Customer/Uploading/act...geUploader4.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - F:\Pictures\Seattle Night\DSC02574.JPG -- End of file - 9597 bytes

3 Pages

1 2 3 >

Replies (1 - 14)

Billy O'Neal View Member Profile	Oct 11 2008, 05:53 PM Post #2
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, CoachMcGuirk. to BleepingComputer.com My name is Billy O'Neal and I will be helping you. (Billy or Bill is fine, if you like.) I want to apologise that it has taken so long to get back to you. We on the HJT Team are working as fast as possible to get your log answered. If you do not still need help, please let me know, so that I can move on to other users who still need help. Please take note of the following: While a HJT Team member is working with you, please refrain from making any changes to your computer. Also, even if things appear to be running better, there is no guarantee that everything is finished. Please continue to check this forum post in order to ensure we get your system completely clean. We do not want to clean you part-way up, only to have the system re-infect itself. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. Please reply using the button in the lower left hand corner of your screen. Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave, and if there is no contact for that amount of time I will have to assume you have "vanished" . If you would still like help, please follow the instructions below: We need to create an OTViewIt Report Please download OTViewIt by OldTimer. Save it to your desktop. Double click on the [acronym=OTViewIt Desktop Icon][/acronym] icon on your desktop. Click the "Scan All Users" checkbox. Push the [acronym=Run Scan][/acronym] button. Two reports will open, copy and paste them in a reply here: OTViewIt.txt <-- Will be opened Extra.txt <-- Will be minimized Please do an online scan with Kaspersky WebScanner. Please visit the Kaspersky Online Scanner website. Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. Click on the Accept button and install any components it needs. The program will install and then begin downloading the latest definition files. After the files have been downloaded on the left side of the page in the Scan section select My Computer This will start the program and scan your system. The scan will take a while, so be patient and let it run. Once the scan is complete, click on View scan report Now, click on the Save Report as button. Save the file to your desktop. Copy and paste that information in your next post. In your next reply, please include the following: OTViewIt.txt Extra.txt Kaspersky's Log Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Oct 12 2008, 01:15 PM Post #4
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, CoachMcGuirk. That all looks clean. Are you still getting the emails? I do note that anyone who is putting your address in the From field will cause you to get bounce back emails even if you did not send the mail. Are you positive they are being sent from your machine? Viewpoint is considered foistware instead of malware because it is installed without users approval, but doesn't spy or do anything "bad". You may like to read this article about the potential of this Viewpoint software here: http://www.clickz.com/news/article.php/3561546 I suggest you remove the program now. Click on Start > Run... > and then paste the following into the "Open" field: "appwiz.cpl" and press OK. From within Add or Remove Programs uninstall the following if they exist: Viewpoint, Viewpoint Manager, and/or Viewpoint Media Player. Please Set Your System to Show Hidden Files If you are using Windows XP or earlier: Go to Start -> My Computer (Or click the My Computer icon on your desktop) Go to the Tools Menu -> Folder Options. Select the "View" tab. Where you see , click the radio button. Uncheck "Hide extensions for known file types" Uncheck "Hide protected operating system files" Click Ok. Exit/Close My Computer. If you are using Windows Vista: Please go to Start -> Computer Click on Click on Select the "View" tab. Where you see , click the radio button. Uncheck "Hide extensions for known file types" Uncheck "Hide protected operating system files" Click Ok. Exit/Close My Computer. We need to uninstall one or more programs Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present): J2SE Runtime Environment 5.0 Update 11, Java™ SE Runtime Environment 6 Update 1, Java™ 6 Update 2, Java™ 6 Update 3, Java™ 6 Update 4, Java™ 6 Update 5, Java™ 6 Update 6 We need to upload a file for further inspection Please go to this page. Where it asks for the "Link to where the file was requested" copy and paste in CODE http://www.bleepingcomputer.com/forums/topic173074.html#entry972222 Where it says "Browse to the file you want to submit", browse to CODE C:\WINDOWS\system32\f75100.sys Press the button. I would like us to use ESET (NOD32)'s Online Scanner Please go to ESET OnlineScan (NOD32) You will then see the Terms of Use, tick the check-box infront of YES, I accept the Terms of Use Now click Start Should you face a Security Warning that asks if you want to install and run a file called "OnlineScanner.cab", click Yes Click Start Note: (the Onlinescanner will now prepare itself for running on your pc) To do a full-scan, tick: "Remove found threats" and "Scan potentially unwanted applications" Press Scan The Onlinescan will now start and scan your pc (this could take a while) When the scan has finished, it will show a screen with two tabs "overview" and "details" and the option to get information or buy software, just close the window Click Start >> Run... >> type: C:\Program Files\EsetOnlineScanner\log.txt The Scanresults will now open in Notepad Click into the text area, right-click and chose "select all" (or use <Control>+A) Right-click again and chose "Copy" (or <Control>+C) Close/Exit Notepad Navigate to this thread and post your log along with anything else requested from us, by right-clicking and "paste" (or ctrl+v) in the text area of the reply post you just created. Note: For Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.) In your next reply, please include the following: ESET OnlineScan's Log Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

CoachMcGuirk View Member Profile	Oct 12 2008, 07:19 PM Post #5
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	Thanks again Billy! Yes, I am reasonably sure that the emails are being sent from my computer. When I get the bounce-back emails the time sent corresponds to when I opened outlook on my computer. If I access my email through the web interface of my mail server, I do not get any of the bounce backs. I have gotten around it by creating a default dummy email account in outlook as the malware seems to only use the default address. When I do this, I can see that outlook is "preparing to send x messages" from the dummy account, but can't as all the account information is made up. I can't see the email in the drafts our outbox folder, however. I've uploaded the file you requested, removed the programs you've recommend and made the system changes. I ran ESET online scanner and will include the results below, but, unfortunately, it didn't seem to find anything. This thing is driving me crazy! ESET Online Scanner Results: # version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3515 (20081011) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=d6718e7584fe5346806636a308d68d1a # end=finished # remove_checked=true # unwanted_checked=true # utc_time=2008-10-13 12:09:07 # local_time=2008-10-12 07:09:07 (-0600, Central Daylight Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=789286 # found=0 # scan_time=18415

Billy O'Neal View Member Profile	Oct 12 2008, 08:41 PM Post #6
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, CoachMcGuirk. We need to scan for rootkits with GMER Please download gmer.zip and save to your desktop. alternate download site 1 alternate download site 2 Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.) When you have done this, disconnect from the Internet and close all running programs. Note: There is a small chance this application may crash your computer so save any work you have open. Double-click on Gmer.exe to start the program. Allow the gmer.sys driver to load if asked. If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO. Click on "Settings", then check the first five settings: System Protection and Tracing Processes Save created processes to the log Drivers Save loaded drivers to the log You will be prompted to restart your computer. Please do so. Run Gmer again and click on the Rootkit tab. Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive. Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All". Important! Please do not select the "Show all" checkbox during the scan. Click on the "Scan" and wait for the scan to finish. Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan. When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply. Note: If you have any problems, try running GMER in Safe Mode In your next reply, please include the following: GMER's Log Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

CoachMcGuirk View Member Profile	Oct 12 2008, 10:06 PM Post #7
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	Thank you, Billy! Below is my GMER log as per your request. GMER Log: GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2008-10-12 22:03:28 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.14 ---- SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xA544D930] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xA5458A80] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xA544DF20] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xA54596E0] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xA5459440] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xA54598B0] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xA544DD70] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xA545A250] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xA5459CB0] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xA545A080] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xA544E120] SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xA5459140] INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) B9AC959A INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) B9AC9655 ---- Kernel code sections - GMER 1.0.14 ---- ? srescan.sys The system cannot find the file specified. ! ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [A5463330] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [A544E5C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [A544E770] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [A544E2D0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [A544E670] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ---- Devices - GMER 1.0.14 ---- AttachedDevice \FileSystem\Ntfs \Ntfs MPRIFL.SYS (My Private Folder driver/FSPro Labs) Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) Device ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ---- Registry - GMER 1.0.14 ---- Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e066 92b 0xE2 0x63 0x26 0xF1 ... Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c 59b 0x6A 0x9C 0xD6 0x61 ... Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd 016 0x7A 0x45 0x05 0xFD ... Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561a a48 0x86 0x8C 0x21 0x01 ... Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818 472 0xF5 0x1D 0x4D 0x73 ... Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522 f5d 0x50 0x93 0xE5 0xAB ... Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27 b7b 0xFB 0xA7 0x78 0xE6 ... Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f9 93d 0x83 0x6C 0x56 0x8B ... Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d84 4a3 0x51 0xFA 0x6E 0x91 ... Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb278 35b 0x37 0xA4 0xAA 0xC3 ... Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e 3c6 0x2A 0xB7 0xCC 0xB5 ... Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791 ec2 0x6C 0x43 0x2D 0x1E ... ---- EOF - GMER 1.0.14 ----

Billy O'Neal View Member Profile	Oct 13 2008, 03:21 PM Post #8
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	When you get the delivery status failure notification, the message that attempted to send should be put on the bottom of the delivery status failure. Can you post the contents of one of these bounce back messages? Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

CoachMcGuirk View Member Profile	Oct 13 2008, 03:30 PM Post #9
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	I will try to do that the next time I get one. I've cleared them all out of my inbox currently and it doesn't seem too predictable as to when they are sent and come back, but will post here the next time I see it. Thanks again!

Billy O'Neal View Member Profile	Oct 13 2008, 03:50 PM Post #10
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Excellent This is a note to myself to leave this topic open longer than the usual timeout of 5 days. Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

Billy O'Neal View Member Profile	Oct 19 2008, 09:13 PM Post #11
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello. This is my 7 day checkup. Have you had any more issues? Are you still here? Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

CoachMcGuirk View Member Profile	Oct 19 2008, 09:22 PM Post #12
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	Hi Billy, Yeah, I'm still around but haven't seen the issue pop up again, so I've been unable to post the contents of one of the spam messages yet. Thanks!

Billy O'Neal View Member Profile	Oct 19 2008, 09:35 PM Post #13
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	QUOTE(CoachMcGuirk @ Oct 19 2008, 10:22 PM) Hi Billy, Yeah, I'm still around but haven't seen the issue pop up again, so I've been unable to post the contents of one of the spam messages yet. Thanks! You're welcome On a positive note... maybe the nastie is gone? Is the lack of sending emails a bad thing? LOL I'll leave this open another week before checking up again, Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

CoachMcGuirk View Member Profile	Oct 22 2008, 08:57 PM Post #14
Member Group: Members Posts: 15 Joined: 20-August 08 Member No.: 231,734	Hi Billy, Thanks for bearing with me while we waited to see if the problem still occurred. Unfortunately, I got a few bounced back emails today of the same nature. It appears the emails it sends are blank other than the subject...though one had some garbled text (possibly a translation of an attachment?). They do have all seem to have an attachment of "winmail.dat", though it appears as though they are 0kb in size. Below are a few examples of the emails it is sending (i've not included identifying info where available). Really appreciate any more ideas you have. This is so frustrating! Bounce Back 1 from Mail Delivery Subsystem <mailer-daemon@googlemail.com> date Wed, Oct 22, 2008 at 8:23 PM subject Delivery Status Notification (Failure) Reply This is an automatically generated Delivery Status Notification Delivery to the following recipient failed permanently: Brandi-kiurut@edc.dk Technical details of permanent failure: Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 No such user (Brandi-kiurut@edc.dk) (state 14). ----- Original message ----- Received: by 10.65.189.20 with SMTP id r20mr9356402qbp.51.1224725030325; Wed, 22 Oct 2008 18:23:50 -0700 (PDT) Return-Path: <MyEmailAddress> Received: from MyWindowsComputerName (MyIPAddress) by mx.google.com (version=TLSv1/SSLv3 cipher=RC4-MD5); Wed, 22 Oct 2008 18:23:50 -0700 (PDT) To: <Brandi-kiurut@EDC.DK> Subject: Not read: ladies say size doesnot matter, but we know, it does! Date: Wed, 22 Oct 2008 20:23:50 -0500 Message-ID: <005b01c934ae$04be6430$0e3b2c90$@com> MIME-Version: 1.0 Content-Type: application/ms-tnef; name="winmail.dat" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="winmail.dat" X-Mailer: Microsoft Office Outlook 12.0 thread-index: AckcQnJtNvnhmxkYR2eQSVgxQzJ/0AYa3mKr X-MS-TNEF-Correlator: 00000000581BECDFD61CB047B09CF50C49640BB224752500 From: MyName <MyEmailAddress> eJ8+IjgBAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEIgAcAFwAAAFJFUE9SVC5J UE0uTm90ZS5JUE5OUk4AtwYBCoABACEAAABFOTg1ODRFOTI5OEE0NjQxQjY1NDZDNTFFNzRDNkE0 NQAbBwEDkAYAkAIAABgAAAALACkAAAAAAEAAMgCAYfjrrTTJAR4ASQABAAAANgAAAGxhZGllcyBz YXkgc2l6ZSBkb2Vzbm90IG1hdHRlciwgYnV0IHdlIGtub3csIGl0IGRvZXMhAAAAAgFMAAEAAABa AAAAAAAAAIErH6S+oxAZnW4A3QEPVAIAAAGAQgByAGEAbgBkAGkAAABTAE0AVABQAAAAQgByAGEA bgBkAGkALQBrAGkAdQByAHUAdABAAEUARABDAC4ARABLAAAAAAAeAE0AAQAAAAcAAABCcmFuZGkA AEAATgCAHHhsQhzJAUAAVQCA/W1yQhzJAR4AcAABAAAANgAAAGxhZGllcyBzYXkgc2l6ZSBkb2Vz bm90IG1hdHRlciwgYnV0IHdlIGtub3csIGl0IGRvZXMhAAAAAgFxAAEAAAAbAAAAAckcQnJtNvnh mxkYR2eQSVgxQzJ/0AYa3mKrAB4AcgABAAAAAQAAAAAAAAAeAHMAAQAAAAEAAAAAAAAAHgB0AAEA AAASAAAAY2ZvcmdpZUBnbWFpbC5jb20AAAALAAgMAAAAAAsAAQ4BAAAAAwAUDgEAAAAeAAEQAQAA ----- Message truncated ----- Bounce Back 2 Your message To: Pauliina-sargdraa@royallabel.com Subject: Not read: Short way to long male power. Sent: Wed, 22 Oct 2008 21:23:50 -0400 did not reach the following recipient(s): Pauliina-sargdraa@royallabel.com on Wed, 22 Oct 2008 21:23:59 -0400 The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address. <royal-mail.royallabel.com #5.1.1> Final-Recipient: RFC822; Pauliina-sargdraa@royallabel.com Action: failed Status: 5.1.1 X-Supplementary-Info: <royal-mail.royallabel.com #5.1.1> X-Display-Name: Pauliina-sargdraa@royallabel.com Bounce Back 3 from Mail Delivery System <MAILER-DAEMON@hammer.wmhost.com> date Wed, Oct 22, 2008 at 8:40 PM subject Undelivered Mail Returned to Sender mailed-by hammer.wmhost.com [winmail.dat] Reply This is the mail system at host hammer.wmhost.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <badivate_1950@fourkeys.fi>: unknown user: "badivate_1950@fourkeys.fi"

Billy O'Neal View Member Profile	Oct 23 2008, 01:48 PM Post #15
Look buddy -- I'm an Engineer Group: HJT Team Coach Posts: 8,510 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, CoachMcGuirk. Please remove ZoneAlarm firewall before preforming the following instructions. Don't worry, we can reinstall it later if you wish. It can be removed via Add/Remove programs. ZoneAlarm is appearing in the GMER logs and obscuring whether things are really hooked or not QUOTE Received: from MyWindowsComputerName (MyIPAddress) This is information I need. If you want to obsure the information here publicly, that's fine, but could you please send the IP address over PM? That information is public anyway.. every single time you connect to another machine on the internet your IP address is shown. It's just like the home address of the machine. It does not identify you personally, but it can go a long way toward pinning down what's going on with the machine. We need to scan for rootkits with GMER Please download gmer.zip and save to your desktop. alternate download site 1 alternate download site 2 Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.) When you have done this, disconnect from the Internet and close all running programs. Note: There is a small chance this application may crash your computer so save any work you have open. Double-click on Gmer.exe to start the program. Allow the gmer.sys driver to load if asked. If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO. Click on "Settings", then check the first five settings: System Protection and Tracing Processes Save created processes to the log Drivers Save loaded drivers to the log You will be prompted to restart your computer. Please do so. Run Gmer again and click on the Rootkit tab. Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive. Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All". Important! Please do not select the "Show all" checkbox during the scan. Click on the "Scan" and wait for the scan to finish. Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan. When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply. Note: If you have any problems, try running GMER in Safe Mode In your next reply, please include the following: GMER's Log A New HiJack This log Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please consider a donation (by clicking this link). And that means I solve problems. Not problems like "What is beauty?" .. 'cause that would fall under the purview of your conundrums of philosophy....

« Next Oldest · HijackThis Logs and Virus/Trojan/Spyware/Malware Removal · Next Newest »

3 Pages

1 2 3 >

2 User(s) are reading this topic (2 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Switch to: Standard · Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 21st November 2009 - 09:05 PM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides