BleepingComputer.com: Rootkit.agent, And Various Trojans And Malware

Hi, I was sent by someone from the "Am I infected" forum. I am no longer infected, Kaspersky found "0" of everything, so there is no Kaspersy log to post. I am running Windows XP home edition SP2. I had numerous infections, but the one I was sent here about was the Rootkit.Agent. I guess this was the most dangerous one, because of security breach. I guess I am asking if my computer is better now? Should I reformat to continue running it until I can build a new system? I cannot wipe the system clean becaue all I have is the windows XP upgrade, a person had put the original windows on my system and is no longer available, my new guy is mean and refuses to wipe clean and reload, because I have bad boot sector and part of it cannot be written on, has to be unused. Anyway, I just need to know I can be ok using this system for routine things for now, email, games, school, and I will do critical things like banking and bills from a more secure system. If you need my logs from SAS or MBAM let me know.
Here is my DSS log:
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel Celeron processor
Percentage of Memory in Use: 55%
Physical Memory (total/avail): 254.55 MiB / 113.2 MiB
Pagefile Memory (total/avail): 624.66 MiB / 411.12 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1930.18 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 6.83 GiB total, 2.9 GiB free.
D: is Fixed (NTFS) - 29.3 GiB total, 2.16 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST340810A - 37.27 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 6.83 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 29.3 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.
Windows Internal Firewall is enabled.

AntivirusOverride is set.

AV: ThreatFire v3.5.0.21 (PC Tools) Disabled
AV: Kaspersky Anti-Virus v7.0.1.325 (Kaspersky Lab)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\kav\\kav7\\setup.exe"="C:\\kav\\kav7\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Shannon\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=HOME-WN63E3BA06
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Shannon
LOGONSERVER=\\HOME-WN63E3BA06
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0806
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Shannon\LOCALS~1\Temp
TMP=C:\DOCUME~1\Shannon\LOCALS~1\Temp
USERDOMAIN=HOME-WN63E3BA06
USERNAME=Shannon
USERPROFILE=C:\Documents and Settings\Shannon
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Shannon (admin)
Administrator (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> MsiExec.exe /I{8A42F680-2DD6-11D4-9A8C-0040F6982C20}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
BitTorrent --> C:\Program Files\BitTorrent\uninst.exe
Google Gmail Notifier --> "C:\Program Files\Google\Gmail Notifier\UninstallGmail.exe"
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Kaspersky Anti-Virus 7.0 --> MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
Kaspersky Anti-Virus 7.0 --> MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
Lexmark 730 Series --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxcfUNST.EXE -NOLICENSE
Microsoft Office XP Professional --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0050048383C9}
PaperPort 8.0 SE --> MsiExec.exe /I{AEF2D1F3-0696-11D5-8E6A-00C04F7FA234}
SUPERAntiSpyware Professional --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TypingMaster Pro --> "C:\Program Files\TypingMaster\unins000.exe"
Visioneer OneTouch 7300 --> C:\PROGRA~1\VISION~1\UNWISE.EXE C:\PROGRA~1\VISION~1\INSTALL.LOG
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Word Riot Deluxe --> "C:\Program Files\Oberon Media\Word Riot Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Word Riot Deluxe\install.log"


-- Application Event Log -------------------------------------------------------

Event Record #/Type3077 / Warning
Event Submitted/Written: 05/18/2008 01:25:15 PM
Event ID/Source: 5603 / WinMgmt
Event Description:
A provider, OffProv10, has been registered in the WMI namespace, Root\MSAPPS10, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Event Record #/Type3076 / Warning
Event Submitted/Written: 05/18/2008 01:25:15 PM
Event ID/Source: 5603 / WinMgmt
Event Description:
A provider, OffProv10, has been registered in the WMI namespace, Root\MSAPPS10, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Event Record #/Type3050 / Error
Event Submitted/Written: 05/11/2008 08:19:59 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application taskmgr.exe, version 5.1.2600.2180, faulting module taskmgr.exe, version 5.1.2600.2180, fault address 0x0000b5f2.
Processing media-specific event for [taskmgr.exe!ws!]

Event Record #/Type3039 / Success
Event Submitted/Written: 05/11/2008 09:24:52 AM
Event ID/Source: 12001 / usnjsvc
Event Description:


Event Record #/Type3038 / Error
Event Submitted/Written: 05/11/2008 09:24:47 AM
Event ID/Source: 215 / ESENT
Event Description:
wlmail (2276) WindowsLiveMail0: The backup has been stopped because it was halted by the client or the connection with the client failed.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type3913 / Error
Event Submitted/Written: 05/19/2008 01:31:44 AM
Event ID/Source: 7026 / Service Control Manager
Event Description:
The following boot-start or system-start driver(s) failed to load:
TfFsMon
TfSysMon

Event Record #/Type3912 / Error
Event Submitted/Written: 05/19/2008 01:29:33 AM / 05/19/2008 01:30:14 AM
Event ID/Source: 4 / ACPI
Event Description:
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0x71), which lies in the 0x70 - 0x71 protected
address range. This could lead to system instability. Please contact your system vendor for technical assistance.

Event Record #/Type3911 / Error
Event Submitted/Written: 05/19/2008 01:29:33 AM / 05/19/2008 01:30:14 AM
Event ID/Source: 5 / ACPI
Event Description:
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0x70), which lies in the 0x70 - 0x71 protected
address range. This could lead to system instability. Please contact your system vendor for technical assistance.

Event Record #/Type3907 / Error
Event Submitted/Written: 05/19/2008 01:28:57 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The lxcf_device service failed to start due to the following error:
%%1053

Event Record #/Type3906 / Error
Event Submitted/Written: 05/19/2008 01:28:57 AM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Timeout (30000 milliseconds) waiting for the lxcf_device service to connect.



-- End of Deckard's System Scanner: finished at 2008-05-19 09:18:05 ------------


Any help you can give me would be greatly appreciated. Thanks.

hi, still awaiting response....

Nevermind on this isssue, it was NOT better, and kept getting hit, so I am shutting it down for good, the computer was modified since this post anyway. So thanks, but it's dead now.

OK, this is the deal, I have had to use restore point because I have data I want off my puter and Kapersky took it over, should I start over from scratch? And, can I NOT use Kapersky? I have MBAM. Anything else, I just really do not want to use Kapersky.

Hello dorkpixie. to BleepingComputer.com

My name is Billy O'Neal and I will be helping you. (Billy or Bill is fine)

We apologize for the delay in response we get overwhelmed at times but we are trying our best to keep up.
If you have since resolved the original problem you were having would appreciate you letting us know If not please perform the following below so I can have a look at the current condition of your machine.

Thanks and again sorry for the delay.

If you still would like help, please follow the following instructions:

Please download Deckard's System Scanner (DSS) and save to your Desktop.
alternate download site

DSS will do the following:

• Create a new System Restore point in Windows XP and Vista.
  
• Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives.
  
• Check some important areas of your system and produce a report for an analyst to review.
  
• Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes.

You must be logged onto an account with administrator privileges when using.

• Close all applications and windows.
  
• Double-click on dss.exe to run it and follow the prompts.
  
• If your anti-virus or firewall complains, please allow this script to run as it is not
  malicious.
  
• When the scan is complete, two text files will open in Notepad:
  • main.txt <- this one will be maximized
    
  • extra.txt <- this one will be minimized
  
  
• If not, they both can be found in the C:\Deckard\System Scanner folder.
  
• Please copy (Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your next reply.

-- When running DSS, some firewalls may warn that it is trying to access the Internet especially if your asked to download the most current version of HijackThis. Please ensure that you allow it permission to do so.
-- If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful.


In your next reply, please make sure the following reports are present:

• DSS's Main.txt
  
• DSS's Extra.txt

(In the event you lost your copy, you can download a new one from here: Deckard's System Scanner)

Deckard's System Scanner v20071014.68
Run by Shannon on 2008-06-16 08:17:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
26: 2008-06-16 12:17:39 UTC - RP191 - Deckard's System Scanner Restore Point
25: 2008-06-15 23:02:09 UTC - RP190 - System Checkpoint
24: 2008-06-14 22:31:43 UTC - RP189 - System Checkpoint
23: 2008-06-13 19:20:57 UTC - RP188 - System Checkpoint
22: 2008-06-12 19:19:55 UTC - RP187 - System Checkpoint


-- First Restore Point --
1: 2008-05-22 15:33:00 UTC - RP166 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 255 MiB (512 MiB recommended).


-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-16 08:19:00
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\lxcfcoms.exe
C:\Documents and Settings\Shannon\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?tab=mw
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Bingo Luau by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/fre...bingo-en_US.cab
O16 - DPF: Bowling by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/bow...wling-en_US.cab
O16 - DPF: Dominoes v2 by pogo () - http://game1.pogo.com/v/8.1.9.1/applet/dom...mino2-en_US.cab
O16 - DPF: Euchre by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/euc...uchre-en_US.cab
O16 - DPF: High Stakes Pool by pogo () - http://game1.pogo.com/v/8.1.9.1/applet/pool2/pool-en_US.cab
O16 - DPF: Hog Heaven Slots by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/fancy/fancy-en_US.cab
O16 - DPF: Lottso by pogo () - http://game1.pogo.com/v/8.1.9.1/applet/lot...ottso-en_US.cab
O16 - DPF: Phlinx by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/fli...inger-en_US.cab
O16 - DPF: Poppit by pogo () - http://game3.pogo.com/v/8.1.9.11/applet/po...ppit2-en_US.cab
O16 - DPF: Pseudoku by pogo () - http://game3.pogo.com/v/8.1.9.22/applet/ps...udoku-en_US.cab
O16 - DPF: Spider Solitaire by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/spi...pider-en_US.cab
O16 - DPF: Squelchies by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/squ...chies-en_US.cab
O16 - DPF: Sweet Tooth 2 by Pogo () - http://game3.pogo.com/v/8.2.0.16/applet/sw...ooth2-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo () - http://game1.pogo.com/v/8.1.9.7/applet/tur...rbo22-en_US.cab
O16 - DPF: WordJong by pogo () - http://game3.pogo.com/v/8.1.9.1/applet/wor...djong-en_US.cab
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa...erInstaller.CAB
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_05) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: lxcf_device - Unknown owner - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe


--
End of file - 5406 bytes

-- File Associations -----------------------------------------------------------

.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S0 TfFsMon - c:\windows\system32\drivers\tffsmon.sys (file missing)
S0 TfSysMon - c:\windows\system32\drivers\tfsysmon.sys (file missing)
S3 catchme - c:\docume~1\shannon\locals~1\temp\catchme.sys (file missing)
S3 iAimTV2 - c:\windows\system32\drivers\watv03nt.sys (file missing)
S3 TfNetMon - c:\windows\system32\drivers\tfnetmon.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-05-16 and 2008-06-16 -----------------------------

2008-06-08 12:14:35 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-19 22:46:26 0 d-------- C:\WINDOWS\Internet Logs
2008-05-19 09:13:40 0 d-------- C:\Program Files\Trend Micro
2008-05-19 01:11:32 96645 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-05-19 01:11:32 87941 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-05-19 01:10:15 8736 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-05-19 01:10:15 1661216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-05-19 01:10:14 0 d-------- C:\Program Files\Kaspersky Lab
2008-05-19 01:10:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab(2)
2008-05-18 18:37:01 0 d-------- C:\WINDOWS\ERUNT
2008-05-18 13:46:24 0 d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-05-18 13:45:29 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-05-18 13:45:29 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-05-18 13:45:29 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-05-18 13:45:29 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-05-18 13:45:29 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-05-18 13:45:29 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-05-18 13:45:29 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-05-18 13:45:29 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-05-18 13:45:29 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-05-18 13:45:29 0 d---s---- C:\Documents and Settings\Administrator\Cookies
2008-05-18 13:45:29 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-05-18 13:45:29 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-05-18 13:45:28 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-05-18 13:45:28 524288 --ah----- C:\Documents and Settings\Administrator\ntuser.dat
2008-05-18 04:18:54 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-18 04:18:36 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-05-18 04:18:36 0 d-------- C:\Documents and Settings\Shannon\Application Data\SUPERAntiSpyware.com
2008-05-18 02:26:26 0 d-------- C:\Documents and Settings\Shannon\Application Data\Malwarebytes
2008-05-18 02:26:15 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-18 02:26:10 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware


-- Find3M Report ---------------------------------------------------------------

2008-06-09 22:24:14 0 d-------- C:\Program Files\Lx_cats
2008-06-08 12:14:35 0 d-------- C:\Program Files\Common Files
2008-05-24 18:49:06 17144 --a------ C:\Documents and Settings\Shannon\Application Data\GDIPFONTCACHEV1.DAT
2008-05-21 11:24:48 0 d-------- C:\Program Files\Google
2008-05-15 22:07:55 0 d-------- C:\Program Files\Common Files\PC Tools
2008-05-15 19:07:31 0 d-------- C:\Program Files\ThreatFire
2008-05-11 20:25:12 0 d-------- C:\Program Files\Windows Live
2008-05-10 11:45:47 0 d-------- C:\Program Files\Yahoo!
2008-05-08 11:47:12 0 d-------- C:\Program Files\Visioneer OneTouch
2008-05-08 11:44:31 0 d-------- C:\Program Files\Viewpoint
2008-05-04 15:43:26 0 d-------- C:\Program Files\Common Files\scansoft shared
2008-05-02 20:13:14 0 d-------- C:\Program Files\Oberon Media
2008-04-30 23:25:44 0 d-------- C:\Documents and Settings\Shannon\Application Data\BitTorrent
2008-04-30 23:21:33 0 d-------- C:\Program Files\BitTorrent
2008-04-30 09:29:43 0 d-------- C:\Documents and Settings\Shannon\Application Data\Pogo Games
2008-04-29 22:03:00 0 d-------- C:\Documents and Settings\Shannon\Application Data\McGraw-HillLicensing
2008-04-29 15:17:37 0 d-------- C:\Documents and Settings\Shannon\Application Data\Help
2008-04-29 14:59:36 0 d-------- C:\Program Files\Scansoft
2008-04-29 14:58:42 0 d-------- C:\Program Files\Common Files\InstallShield
2008-04-27 11:04:03 0 dr------- C:\Program Files\TypingMaster
2008-04-26 14:29:30 0 d-------- C:\Program Files\Common Files\AOL
2008-04-26 13:50:42 0 d-------- C:\Program Files\Messenger
2008-04-25 01:14:59 0 d-------- C:\Program Files\MSN Games
2008-04-17 14:55:48 0 d-------- C:\Documents and Settings\Shannon\Application Data\TypingMaster7


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 08:51 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 05:25 AM]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [09/23/2002 09:25 AM]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [09/23/2002 09:50 AM]
"OneTouch Monitor"="C:\Program Files\Visioneer OneTouch\OneTouchMon.exe" [11/20/2003 06:13 AM]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [07/20/2005 01:47 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" []
"TypingSatellite"="C:\Program Files\TypingMaster\KBOOST.EXE" [01/11/2005 11:47 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/28/2008 10:33 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [05/13/2008 10:13 AM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 01:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"




-- End of Deckard's System Scanner: finished at 2008-06-16 08:20:52 ------------

extra
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel Celeron processor
Percentage of Memory in Use: 49%
Physical Memory (total/avail): 254.55 MiB / 129.48 MiB
Pagefile Memory (total/avail): 724.77 MiB / 495.18 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1931.33 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 6.83 GiB total, 2.16 GiB free.
D: is Fixed (NTFS) - 29.3 GiB total, 2.14 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST340810A - 37.27 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 6.83 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 29.3 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is disabled.
Windows Internal Firewall is enabled.

AV: ThreatFire v3.5.0.21 (PC Tools) Disabled

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Shannon\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=HOME-WN63E3BA06
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Shannon
LOGONSERVER=\\HOME-WN63E3BA06
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0806
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Shannon\LOCALS~1\Temp
TMP=C:\DOCUME~1\Shannon\LOCALS~1\Temp
USERDOMAIN=HOME-WN63E3BA06
USERNAME=Shannon
USERPROFILE=C:\Documents and Settings\Shannon
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Shannon (admin)
Administrator (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> MsiExec.exe /I{8A42F680-2DD6-11D4-9A8C-0040F6982C20}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX --> C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81100000003}
BitTorrent --> C:\Program Files\BitTorrent\uninst.exe
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Lexmark 730 Series --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxcfUNST.EXE -NOLICENSE
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins001.exe"
Microsoft Office XP Professional --> MsiExec.exe /I{91110409-6000-11D3-8CFE-0050048383C9}
PaperPort 8.0 SE --> MsiExec.exe /I{AEF2D1F3-0696-11D5-8E6A-00C04F7FA234}
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TypingMaster Pro --> "C:\Program Files\TypingMaster\unins000.exe"
Visioneer OneTouch 7300 --> C:\PROGRA~1\VISION~1\UNWISE.EXE C:\PROGRA~1\VISION~1\INSTALL.LOG
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Word Riot Deluxe --> "C:\Program Files\Oberon Media\Word Riot Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Word Riot Deluxe\install.log"


-- Application Event Log -------------------------------------------------------

Event Record #/Type3103 / Error
Event Submitted/Written: 05/29/2008 05:54:45 PM
Event ID/Source: 11706 / MsiInstaller
Event Description:
Product: Microsoft Office XP Professional -- Error 1706. Setup cannot find the required files. Check your connection to the network, or CD-ROM drive. For other potential solutions to this problem, see C:\Program Files\Microsoft Office\Office10\1033\SETUP.HLP.

Event Record #/Type3102 / Warning
Event Submitted/Written: 05/29/2008 05:54:26 PM
Event ID/Source: 1001 / MsiInstaller
Event Description:
Detection of product '{91110409-6000-11D3-8CFE-0050048383C9}', feature 'OUTLOOKFiles' failed during request for component '{DE6A97CD-93BF-455C-A45F-7694344B686F}'

Event Record #/Type3095 / Error
Event Submitted/Written: 05/20/2008 09:10:42 AM
Event ID/Source: 8 / crypt32
Event Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Event Record #/Type3094 / Error
Event Submitted/Written: 05/20/2008 09:10:42 AM
Event ID/Source: 8 / crypt32
Event Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.

Event Record #/Type3093 / Error
Event Submitted/Written: 05/20/2008 09:09:48 AM
Event ID/Source: 8 / crypt32
Event Description:
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type4488 / Warning
Event Submitted/Written: 06/11/2008 08:30:52 AM
Event ID/Source: 36 / W32Time
Event Description:
The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Event Record #/Type4469 / Error
Event Submitted/Written: 06/08/2008 11:58:54 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Application Management service terminated with the following error:
%%126

Event Record #/Type4466 / Error
Event Submitted/Written: 06/08/2008 11:58:54 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Application Management service terminated with the following error:
%%126

Event Record #/Type4463 / Error
Event Submitted/Written: 06/08/2008 11:58:54 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Application Management service terminated with the following error:
%%126

Event Record #/Type4460 / Error
Event Submitted/Written: 06/08/2008 11:58:54 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Application Management service terminated with the following error:
%%126



-- End of Deckard's System Scanner: finished at 2008-06-16 08:20:52 ------------

What I don't understand is all this stuff about windows live messenger and yahoo messenger. I uninstalled those programs so that people can't hack inot my puter using them. I also disable my internet connection wehn I am not using my computer now. It's been almost a month since I initialy posted, I don't use my computer for critical things anymore, but you tell me from the logs if things are ok now. Thanks.

Hello, Dorkpixie.

You have a Peer-To-Peer program installed.
Your log shows that you are using so called peer-to-peer or file-sharing programs (in your case Bittorrent). These programs allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organizations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."

It appears your only Anti-Virus program, ThreatFire, is disabled. Either you should reenable it, or follow these instructions:


We need to move some files..
Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  TfFsMon <delete service>
  TfSysMon <delete service>
  catchme <delete service>
  iAimTV2 <delete service>
  TfNetMon <delete service>

  
  
  
• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
  
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Scroll down to where it says "Java Runtime Environment (JRE)6 Update 6...allows end-users to run Java applications".
  
• Click the "Download" button to the right.
  
• Select your Platform: "Windows".
  
• Select your Language: "English".
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• Click Continue and the page will refresh.
  
• Click on the link to download Windows Offline Installation and save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java version.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u6-windows-i586-p.exe
  
• Follow the on screen instructions to install the latest Java version.

I would like to check our work.

• Please go to ESET OnlineScan (NOD32)
  
• You will then see the Terms of Use, tick the check-box infront of YES, I accept the Terms of Use
  
• Now click Start
  
• Should you face a Security Warning that asks if you want to install and run a file called "OnlineScanner.cab", click Yes
  
• Click Start
  • Note: (the Onlinescanner will now prepare itself for running on your pc)
  
  
• To do a full-scan, tick: "Remove found threats" and "Scan potentially unwanted applications"
  
• Press Scan
  
• The Onlinescan will now start and scan your pc (this could take a while)
  
• When the scan has finished, it will show a screen with two tabs "overview" and "details" and the option to get information or buy software, just close the window
  
• Click Start >> Run... >> type: C:\Program Files\EsetOnlineScanner\log.txt
  
• The Scanresults will now open in Notepad
  
• Click into the text area, right-click and chose "select all" (or use <Control>+A)
  
• Right-click again and chose "Copy" (or <Control>+C)
  
• Close/Exit Notepad
  
• Navigate to this thread and post your log along with anything else requested from us, by right-clicking and "paste" (or ctrl+v) in the text area of the reply post you just created.

Note: For Vista Users: Eset is compatible but Internet Explorer must be run as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select "Run as Administrator" from the context menu.)

Your Microsoft Windows installation is out of date.
Whenever a security problem in its software is found, Microsoft will usually create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC
Go here to check for & install updates to Microsoft applications.
Note: The update process uses ActiveX, so you will need to use Internet Explorer for it, and allow the ActiveX control that it wants to install.

Please reboot and repeat the update process until there are no more updates to install.

When you are finished, please post a new HijackThis log here in a reply. Also, please let me know of any problems you may have encountered.

In your next reply, please make sure the following reports are present:

• OTMoveIt2's log
  
• ESET's log
  
• A new DSS Main.txt

(In the event you lost your copy, you can download a new one from here: Deckard's System Scanner)

Good luck,
Billy3

I'll get on this asap... I am in process of moving and helping rents move and my grandpa just passed , and i work and have kid so been really busy, will do this soon and post for you... fyi, i have peer to peer installed but have never used it... not sure I ever will but thanx. post soon ty for everything so far.

OK. We will keep this topic open for you

Sorry to hear about your grandfather.

Good luck!

Billy3

Ok in looking at this two things.... if I delete my java, will this new java replace it? second I don't do windows updates... the reason is, last time I did it messed up my puter really badly... it was nice having the new explorer but everything else stopped working ... I have hardly any memory and all of my drives are about full, I do the best I can though until I can buy new puter... which will be a bit. I will have my logs for you soon, I just wanted you to know my issues. Thanks.

Yes, the new Java will replace it.

Windows updates are VERY important. If you don't want to install Internet Exploder 7, that's fine, but the updates to the system itself need to be there to prevent reinfection. Not even the the most perfect anti-virus program can protect you if a malware program is able to subvert windows itself.

If you still don't want to updated windows, please know that you will likely be reinfected in the future.

Billy3

Billy3

OK here is all of my logs... I will redo my java later... I am truly uncertain whether this system will take any more files... thus I am uncertain that windows updates will be a good thing, like I said last time I allowed the undates to relaod my entire system froze and almost crashed... I mean at this point I stay unconnected when not at my puter and go to very few sites and download barely anything...unless I know it is trusted. I hope this will be enough to prevent re-infection until I can afford to build a new computer and try to figure out a way to get a copy of Windows XP (I really do not want Vista ever).... OK so here's the logs...


TfFsMon service deleted successfully.
TfSysMon service deleted successfully.
catchme service deleted successfully.
iAimTV2 service deleted successfully.
TfNetMon service deleted successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 06282008_134812

The Eset log said it scanned around 20,000 files and that nothing was found....
when I tried to find it on my puter in "run" and the commands you gave me it
said it was not found....

Here is my new DSS

Deckard's System Scanner v20071014.68
Run by Shannon on 2008-06-28 15:19:15
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 255 MiB (512 MiB recommended).


-- HijackThis (run as Shannon.exe) ---------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:37 PM, on 6/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\lxcfcoms.exe
C:\Documents and Settings\Shannon\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Shannon.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [TypingSatellite] "C:\Program Files\TypingMaster\KBOOST.EXE"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Bingo Luau by pogo - http://game3.pogo.com/v/8.1.9.1/applet/fre...bingo-en_US.cab
O16 - DPF: Bowling by pogo - http://game3.pogo.com/v/8.1.9.1/applet/bow...wling-en_US.cab
O16 - DPF: Dominoes v2 by pogo - http://game1.pogo.com/v/8.1.9.1/applet/dom...mino2-en_US.cab
O16 - DPF: Euchre by pogo - http://game3.pogo.com/v/8.1.9.1/applet/euc...uchre-en_US.cab
O16 - DPF: High Stakes Pool by pogo - http://game1.pogo.com/v/8.1.9.1/applet/pool2/pool-en_US.cab
O16 - DPF: Hog Heaven Slots by pogo - http://game3.pogo.com/v/8.1.9.1/applet/fancy/fancy-en_US.cab
O16 - DPF: Lottso by pogo - http://game1.pogo.com/v/8.1.9.1/applet/lot...ottso-en_US.cab
O16 - DPF: Phlinx by pogo - http://game3.pogo.com/v/8.1.9.1/applet/fli...inger-en_US.cab
O16 - DPF: Poppit by pogo - http://game3.pogo.com/v/8.1.9.11/applet/po...ppit2-en_US.cab
O16 - DPF: Pseudoku by pogo - http://game3.pogo.com/v/8.1.9.22/applet/ps...udoku-en_US.cab
O16 - DPF: Spider Solitaire by pogo - http://game3.pogo.com/v/8.1.9.1/applet/spi...pider-en_US.cab
O16 - DPF: Squelchies by pogo - http://game3.pogo.com/v/8.1.9.1/applet/squ...chies-en_US.cab
O16 - DPF: Sweet Tooth 2 by Pogo - http://game3.pogo.com/v/8.2.0.16/applet/sw...ooth2-en_US.cab
O16 - DPF: Turbo 21 v2 by pogo - http://game1.pogo.com/v/8.1.9.7/applet/tur...rbo22-en_US.cab
O16 - DPF: WordJong by pogo - http://game3.pogo.com/v/8.1.9.1/applet/wor...djong-en_US.cab
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa...erInstaller.CAB
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: lxcf_device - - C:\WINDOWS\System32\lxcfcoms.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

--
End of file - 4944 bytes

-- Files created between 2008-05-28 and 2008-06-28 -----------------------------

2008-06-28 13:56:11 0 d-------- C:\Program Files\EsetOnlineScanner
2008-06-28 13:53:27 0 d-------- C:\Documents and Settings\Shannon\.SunDownloadManager
2008-06-16 08:51:12 0 d-------- C:\WINDOWS\LastGood
2008-06-08 12:14:35 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard


-- Find3M Report ---------------------------------------------------------------

2008-06-26 19:36:48 0 d-------- C:\Program Files\Lx_cats
2008-06-08 12:15:08 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-08 12:14:35 0 d-------- C:\Program Files\Common Files
2008-05-24 18:49:06 17144 --a------ C:\Documents and Settings\Shannon\Application Data\GDIPFONTCACHEV1.DAT
2008-05-21 11:26:23 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-21 11:24:48 0 d-------- C:\Program Files\Google
2008-05-19 09:13:40 0 d-------- C:\Program Files\Trend Micro
2008-05-19 01:10:14 0 d-------- C:\Program Files\Kaspersky Lab
2008-05-18 04:18:36 0 d-------- C:\Documents and Settings\Shannon\Application Data\SUPERAntiSpyware.com
2008-05-18 02:26:26 0 d-------- C:\Documents and Settings\Shannon\Application Data\Malwarebytes
2008-05-15 22:07:55 0 d-------- C:\Program Files\Common Files\PC Tools
2008-05-15 19:07:31 0 d-------- C:\Program Files\ThreatFire
2008-05-11 20:25:12 0 d-------- C:\Program Files\Windows Live
2008-05-10 11:45:47 0 d-------- C:\Program Files\Yahoo!
2008-05-08 11:47:12 0 d-------- C:\Program Files\Visioneer OneTouch
2008-05-08 11:44:31 0 d-------- C:\Program Files\Viewpoint
2008-05-04 15:43:26 0 d-------- C:\Program Files\Common Files\scansoft shared
2008-05-02 20:13:14 0 d-------- C:\Program Files\Oberon Media
2008-04-30 23:25:44 0 d-------- C:\Documents and Settings\Shannon\Application Data\BitTorrent
2008-04-30 23:21:33 0 d-------- C:\Program Files\BitTorrent
2008-04-30 09:29:43 0 d-------- C:\Documents and Settings\Shannon\Application Data\Pogo Games
2008-04-29 22:03:00 0 d-------- C:\Documents and Settings\Shannon\Application Data\McGraw-HillLicensing
2008-04-29 15:17:37 0 d-------- C:\Documents and Settings\Shannon\Application Data\Help
2008-04-29 14:59:36 0 d-------- C:\Program Files\Scansoft
2008-04-29 14:58:42 0 d-------- C:\Program Files\Common Files\InstallShield


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 08:51 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 05:25 AM]
"PaperPort PTD"="C:\Program Files\Scansoft\PaperPort\pptd40nt.exe" [09/23/2002 09:25 AM]
"IndexSearch"="C:\Program Files\Scansoft\PaperPort\IndexSearch.exe" [09/23/2002 09:50 AM]
"OneTouch Monitor"="C:\Program Files\Visioneer OneTouch\OneTouchMon.exe" [11/20/2003 06:13 AM]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [07/20/2005 01:47 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" []
"TypingSatellite"="C:\Program Files\TypingMaster\KBOOST.EXE" [01/11/2005 11:47 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/28/2008 10:33 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [05/13/2008 10:13 AM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 01:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"




-- End of Deckard's System Scanner: finished at 2008-06-28 15:20:18 ------------


Another FYI... there are alot of things on this list that have been uninstalled, such as threat fire.

dorkpixie, you now appear to be clean. Congratulations!

It appears that the Authentium SDK is used by other legit anti-malware programs, so you don't have to worry about it.

You may wish to disalble system restore's monitoring of the D Drive if you are looking to free up some space.

http://bertk.mvps.org/html/drivedisable.html

Either way, you should definitely follow the instructions listed below for "Setting a new restore point and clearing out old ones...."

We need to clean up our tools.

• Please download OTMoveIt2 by OldTimer and save it to your desktop.
  
• Click the Clean Up button.
  
  
• Accept any prompts.
  
• This will remove any tools we used, including OTMoveIt, and will require a reboot.

Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints: Malware Complaints. Just find your country room and register your complaint.
Your machine was not infected.

Below are some steps to follow in order to dramatically lower the chances of reinfection.
You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented.

• Set a New Restore Point to prevent possible reinfection from an old one.
  Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
  IF YOU USE WINDOWS XP:
  You can view a video of the following instructions.
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
    
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
    
  • Then go to Start > Run and type: Cleanmgr
    
  • Click "OK".
    
  • Click the "More Options" Tab.
    
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
  Note: You should only do this once!
  
  IF YOU USE WINDOWS VISTA:
  • Go to Start -> Control Panel -> System and Maintenance -> System.
    
  • Select "System Protection" in the upper left hand corner.
    
  • Click the button marked "Create" in the bottom of the window.
    
  • Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
    
  • Open Vista's Searchbox (on your start menu) and type in "cleanmgr.exe"
    
  • Click "OK".
    
  • Click the "More Options" Tab.
    
  • Click "Clean Up", and then "Delete" in the "System Restore and Shadow Copies" section to remove all previous restore points except the newly created one.
  Note: You should only do this once!
  
  
• Make sure you install all the security updates for Windows, Internet Explorer & Microsoft Office
  Whenever a security problem in its software is found, Microsoft will usually create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your PC, so keeping up with these patches will help to prevent malicious software being installed on your PC
  Go here to check for & install updates to Microsoft applications.
  Note: The update process uses ActiveX, so you will need to use Internet Explorer for it, and allow the ActiveX control that it wants to install.
  
  
• Keep your non-Microsoft applications updated as well
  Microsoft isn't the only company whose products can contain security vulnerabilities, to check for other vulnerable programs running on your PC that are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month.
  
  
• Make Internet Explorer more secure
  • Click Start -> Run
    
  • Type "Inetcpl.cpl" (without quotes) & click OK.
    
  • Click on the Security tab.
    
  • Click "Reset all zones to default level"
    
  • Make sure the Internet Zone is selected & click "Custom level"
    
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls") to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    
  • Click OK, then Apply, then OK to exit the Internet Properties page.
  
  
• Install SpywareBlaster & make sure to update it regularly
  SpywareBlaster sets killbits in the registry to prevent known malicious ActiveX controls from installing themselves on your computer.
  If you don't know what ActiveX controls are, see here
  You can download SpywareBlaster from here.
  
  
• Install and use Spybot Search & Destroy
  Instructions are located here
  Make sure you update, reimmunize & scan regularly.
  
  
• Make use of the HOSTS file included with Spybot Search & Destroy
  Every version of Microsoft Windows includes a hosts file. A hosts file is a bit like a phone book: it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites.
  Spybot Search & Destroy has a good HOSTS file built in. To enable it,
  • Run Spybot Search & Destroy
    
  • Click the Mode button on the toolbar, and then place a tick next to Advanced mode.
    
  • Click Yes.
    
  • In the left hand pane of Spybot Search & Destroy, click on "Tools", and then on Hosts File.
    
  • Click on "Add Spybot-S&D hosts list"
  Note: On some PCs, having a custom HOSTS file installed can cause a significant slowdown. Following these instructions should resolve the issue
  • Click Start -> Run.
    
  • Type "services.msc" (without quotes) & click OK.
    
  • In the list, find the service called "DNS Client" & double click on it.
    
  • On the dropdown box, change the setting from "Automatic" to "Manual".
    
  • Click OK.
    
  • Exit/close the Services window
  For a more detailed explanation of the HOSTS file, click here.
  
  
• Install a-squared Free & update and scan with it regularly
  a-squared free is a product from Emsi Software provided free for private use that can detect and remove a variety of malicious software. You can get it here
  Note: If you have a dialup internet connection, you may also like to install a-squared Anti-Dialer which provides some real time protection against premium rate dialers
  
  
• Finally I am trying to make one point very clear. It is absolutely essential to keep all of your security programs up to date!

Billy3

Hi,

Since the issue seems to be resolved topic is now closed. Glad we could help.
If you need topic re-opened please PM a member of the Moderating Team with a link to your topic.
New issues please begin a new topic.

Take care & surf safe!

Blender