Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Redirects, popups and blocked websites and DLs


  • This topic is locked This topic is locked
45 replies to this topic

#1 jpd9930

jpd9930

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 01 February 2009 - 09:39 AM

I have a computer that has Redirects, popups and blocked websites and DLs. Most websites are fine but alot of the help websites (like bleepingcomputers) are blocked. I cant DL alot of the recovery software nor can I use any program that has to connect to the web to DL.

for example I just searched google for hijackthis...found the trendmicro site but I get popups from shopica and shopzilla when I click on the link. I can look around microsoft but get popups when I try to get updates. I also DLed the new HJT and moved it the infected computer. I clicked on the Icon got the run prompt. I clicked run but all it did was show the hour glass for a about 10 seconds then nothing. It shows as an application in propterties.

I have run lots of Diag software but I'll start from scratch on your suggestions.

As I said I cant get into bleeping computer nor can I download any helpful software so I cant get DDS and run it.

here is a older version of hijackthis' log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:45 AM, on 2/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jonasbrothersfan.com/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {605B3D3F-4F33-41D0-BA27-98238E1E839F} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {6ABC5436-9C5B-4F51-816B-07907DA3CA60} - C:\WINDOWS\system32\ssqNFUNH.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [2c4c9aba] rundll32.exe "C:\WINDOWS\system32\mwuabxeg.dll",b
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Cap'n Rod\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Cap'n Rod\Application Data\SpeedRunner\SpeedRunner.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (WficaCtl Object) - https://www.webpcfos.com/webpcfos/Citrix/wfica.cab
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) - https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1156968741906
O17 - HKLM\System\CCS\Services\Tcpip\..\{52FDB74A-52E4-4A12-A7A1-3440E8DA1BE7}: NameServer = 4.2.2.2,4.2.2.1
O20 - AppInit_DLLs: etrtbp.dll
O20 - Winlogon Notify: rqRKDsqO - rqRKDsqO.dll (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Edited by jpd9930, 01 February 2009 - 01:44 PM.


BC AdBot (Login to Remove)

 


#2 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 03 February 2009 - 05:15 AM

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

When finished, it shall produce a log for you. Post that log and a fresh HijackThis log in your next reply..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#3 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 03 February 2009 - 07:52 PM

OK, Tried

I had combofix already on the computer. I had run it before. This time I get the command consule and blinking cursor for about 5 minutes. Then the consule closes with no saved log. I redownloaded it from another computer to the desktop but I get the same results.

I decided to run hijackthis and post that anyway...I clicked the icon and got the run prompt. I clicked that and got the hourglass for about 10 seconds then nothing. I checked Task manager and I have a hjtinstall.exe in my processes.

As you can see HJT did work but not now. Same with combofix

rebooted the system with the same results

Please dont forget I have to be able to download the entire program not run and installer.

Edited by jpd9930, 03 February 2009 - 07:58 PM.


#4 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 03 February 2009 - 10:09 PM

Please download Malwarebytes' Anti-Malware from HERE or HERE

Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan"

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.




NEXT


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run RSIT
  • Before you click "Continue", make sure you change the List files/folders created or modified in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt and info.txt in your next reply.



NEXT


Please download GMER and unzip it to your Desktop.
  • Open the program and click on the Rootkit tab.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for ‘Show All’.
  • Click on Scan.
  • When the scan has run click Copy and paste the results into a Notepad >> save it and attach in this thread.


Post me these logs in your next reply.. Post each log in separate post..

1. Malwarebytes'
2. RSIT log.txt
3. RSIT info.txt
4. Attach GMER result..

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#5 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 04 February 2009 - 10:06 AM

First I want to thank you for helping me..I know that this is done as your time allows...I dont meant to be rude but to help me you really need to read what I post to you. I can not use that computer to connect to the internet for anything that appears to be crime fighting software. In otherwords I can not use things like Malwarebytes' Anti-Malware because it is a setup.exe type file. The only types I can use are ones that are complete downloads and executables in one file. And even that is proving to be difficult.

with that said:

Malwarebytes' Anti-Malware failed to run...it is not an internet connection problem.

RSIT logs will follow in seperate posts per your request.

GMER would not run. It did the same thing as hijackthis and combofix. Namely it would just give me a hourglass and a .exe file would appear in the task manager processes field.

Edited by jpd9930, 04 February 2009 - 10:12 AM.


#6 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 04 February 2009 - 10:09 AM

info.txt logfile of random's system information tool 1.05 2009-02-04 09:27:13

======Uninstall list======

-->"C:\Program Files\eAcceleration\Station\station.exe" /UnRegister
-->C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\Spyware Guard 2008\uninstall.exe
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->MsiExec.exe /I{95D9B4D8-B091-4fab-80EA-313EB4B82FD6}
-->MsiExec.exe /I{EB997E90-5EB0-4eb5-90D0-90B1D2F0CA03}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
Ad-Aware-->"C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe Acrobat 4.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 4.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 4.0\NT\Uninst.dll"
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
ArcSoft PhotoImpression 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D433ABC3-0CD8-4BB0-B6A9-84501B4B47B7}\Setup.exe" -l0x9
BCM V.92 56K Modem-->C:\WINDOWS\BCMSMU.exe quiet
Broadcom Management Programs-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{89EE857B-8970-4F9F-AB58-A1C873AC72B3} /l1033
Deewoo Network Manager removal-->C:\WINDOWS\system32\tcnttsdl.exe -UPop
Dell AIO Printer A920-->C:\WINDOWS\System32\spool\drivers\w32x86\3\DLBKUN5C.EXE -dDell AIO Printer A920
Dell Digital Jukebox Driver-->C:\Program Files\Dell\Digital Jukebox Drivers\DrvUnins.exe /s
Dell Media Experience-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\setup.exe" -uninstall
Dell Solution Center-->MsiExec.exe /X{11F1920A-56A2-4642-B6E0-3B31A12C9288}
Dell Support-->MsiExec.exe /X{43FCA273-9534-40DB-B7C5-D7758875616A}
DS21Patch-->MsiExec.exe /I{9B79DCB0-AAD7-456B-8D07-433C936FA24B}
EarthLink Setup Files-->MsiExec.exe /X{9B2CFE3B-7F55-4786-A20D-BB244914F6D8}
EPSON CX 4200 4800 Guide-->C:\Program Files\epson\guide\cx4200_4800_e\uninstall.exe
EPSON Printer Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
FaxTools-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F45298E5-0083-426F-A668-1A2C5F04B8A0}\setup.exe" -l0x9 ControlPanel
Finding Nemo: Nemo's Underwater World of Fun Special Edition-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{77FCC1D4-E78E-46A4-80A6-7F456FA9AC90} NemoUWF2Uninstall
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar3.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel® Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Internet Explorer Default Page-->MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395}
Jasc Paint Shop Photo Album-->MsiExec.exe /I{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}
Jasc Paint Shop Pro 8 Dell Edition-->MsiExec.exe /I{81A34902-9D0B-4920-A25C-4CDC5D14B328}
Java 2 Runtime Environment, SE v1.4.2-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142000}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Encarta Encyclopedia Standard 2004-->MsiExec.exe /I{04410044-9149-45C6-A806-F2BF9CFCE762}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Money 2004 System Pack-->MsiExec.exe /I{8C64E145-54BA-11D6-91B1-00500462BE80}
Microsoft Money 2004-->MsiExec.exe /I{1D643CD7-4DD6-11D7-A4E0-000874180BB3}
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0050048383C9}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MUSICMATCH® Jukebox-->C:\PROGRA~1\MUSICM~1\MUSICM~2\unmatch.exe
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
Reading Blaster Ages 6-7-->C:\WINDOWS\UnRB67.exe
RealOne Player-->C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
Search Assistant Leftsidebuddy-->C:\WINDOWS\system32\ehqwanszrwgk.dll-uninst.exe
Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 8 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP8$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Shockwave-->C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\Install.log
TL-WN321G Wireless Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B468AE7B-C667-4073-BED8-EAD17D5EE08C}\setup.exe" -l0x9 -removeonly
Trend Micro PC-cillin Internet Security 2007-->msiexec.exe /i {BB4B6355-D38A-492C-873B-A1B2CF6C3832}
Trend Micro PC-cillin Internet Security 2007-->MsiExec.exe /X{BB4B6355-D38A-492C-873B-A1B2CF6C3832}
Typing Instructor for Kids II-->C:\Program Files\Typing Instructor for Kids II\unwise.exe
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Windows Support Tools-->MsiExec.exe /I{8398B542-3CC4-44D9-83DF-696CCE70124B}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WordPerfect Office 11-->MsiExec.exe /I{54F90B55-BEB3-4F0D-8802-228822FA5921}

=====HijackThis Backups=====

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\tcnttsdl.exe DWmmm01
O4 - HKLM\..\Run: [{C9-9A-A1-15-DW}] C:\windows\system32\rqwnw64k.exe DWmmm01
O4 - Startup: Deewoo.lnk = C:\WINDOWS\SYSTEM32\tcnttsdl.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\SYSTEM32\rqwnw64k.exe
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.spyguardpro.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.virusremover2008.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.antispyexpert.com (HKLM)
O15 - Trusted Zone: *.amaena.com (HKLM)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\tcnttsdl.exe DWmmm01
O15 - Trusted Zone: *.amaena.com
O4 - Startup: Deewoo.lnk = C:\WINDOWS\SYSTEM32\tcnttsdl.exe
O15 - Trusted Zone: *.imagesrvr.com
O4 - Startup: DW_Start.lnk = C:\WINDOWS\SYSTEM32\dwwnw64r.exe
O15 - Trusted Zone: *.gomyhit.com
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\Cap'n Rod\Application Data\gadcom\gadcom.exe" 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O15 - Trusted Zone: *.spyguardpro.com
O4 - HKLM\..\Run: [{C9-9A-A1-15-DW}] C:\windows\system32\dwwnw64r.exe DWmmm01
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.virusremover2008.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.safetydownload.com
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O15 - Trusted Zone: *.antispyexpert.com
O15 - Trusted Zone: *.antimalwareguard.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: leftsidebuddy search enhancer - {9C0C2ED8-F47E-C01F-ABAE-059E6D3259FF} - C:\WINDOWS\system32\ehqwanszrwgk.dll
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

======Security center information======

AV: Trend Micro PC-cillin Internet Security 2007 (disabled) (outdated)
FW: Trend Micro PC-cillin Internet Security (Firewall) (disabled)

System event log

Computer Name: ELIZABETH
Event Code: 7036
Message: The Terminal Services service entered the running state.

Record Number: 5
Source Name: Service Control Manager
Time Written: 20090125155110.000000-300
Event Type: information
User:

Computer Name: ELIZABETH
Event Code: 7035
Message: The Remote Access Connection Manager service was successfully sent a start control.

Record Number: 4
Source Name: Service Control Manager
Time Written: 20090125155110.000000-300
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: ELIZABETH
Event Code: 7035
Message: The Fax service was successfully sent a stop control.

Record Number: 3
Source Name: Service Control Manager
Time Written: 20090125155110.000000-300
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: ELIZABETH
Event Code: 6005
Message: The Event log service was started.

Record Number: 2
Source Name: EventLog
Time Written: 20090125155017.000000-300
Event Type: information
User:

Computer Name: ELIZABETH
Event Code: 6009
Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090125155017.000000-300
Event Type: information
User:

Application event log

Computer Name: ELIZABETH
Event Code: 0
Message:
Record Number: 1034
Source Name: .NET Runtime
Time Written: 20071227030135.000000-300
Event Type: error
User:

Computer Name: ELIZABETH
Event Code: 0
Message:
Record Number: 1033
Source Name: gusvc
Time Written: 20071226111950.000000-300
Event Type: information
User:

Computer Name: ELIZABETH
Event Code: 0
Message:
Record Number: 1032
Source Name: gusvc
Time Written: 20071226111747.000000-300
Event Type: information
User:

Computer Name: ELIZABETH
Event Code: 0
Message:
Record Number: 1031
Source Name: .NET Runtime
Time Written: 20071226030133.000000-300
Event Type: error
User:

Computer Name: ELIZABETH
Event Code: 0
Message:
Record Number: 1030
Source Name: gusvc
Time Written: 20071225105900.000000-300
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Support Tools\;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\Java\j2re1.4.2\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\j2re1.4.2\lib\ext\QTJava.zip

-----------------EOF-----------------

Logfile of random's system information tool 1.05 (written by random/random)
Run by Cap'n Rod at 2009-02-04 09:27:09
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 53 GB (70%) free of 76 GB
Total RAM: 1150 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:11 AM, on 2/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Cap'n Rod\Desktop\HJTInstall.exe
C:\Documents and Settings\Cap'n Rod\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Cap'n Rod.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jonasbrothersfan.com/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {605B3D3F-4F33-41D0-BA27-98238E1E839F} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {6ABC5436-9C5B-4F51-816B-07907DA3CA60} - C:\WINDOWS\system32\ssqNFUNH.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [2c4c9aba] rundll32.exe "C:\WINDOWS\system32\mwuabxeg.dll",b
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Cap'n Rod\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\Cap'n Rod\Application Data\SpeedRunner\SpeedRunner.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (WficaCtl Object) - https://www.webpcfos.com/webpcfos/Citrix/wfica.cab
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) - https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1156968741906
O17 - HKLM\System\CCS\Services\Tcpip\..\{52FDB74A-52E4-4A12-A7A1-3440E8DA1BE7}: NameServer = 4.2.2.2,4.2.2.1
O20 - AppInit_DLLs: etrtbp.dll
O20 - Winlogon Notify: rqRKDsqO - rqRKDsqO.dll (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 5807 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\ISP signup reminder 1.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6ABC5436-9C5B-4F51-816B-07907DA3CA60}]
C:\WINDOWS\system32\ssqNFUNH.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2003-04-07 155648]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2003-04-07 114688]
"EPSON Stylus CX4800 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE [2005-02-01 98304]
"BCMSMMSG"=C:\WINDOWS\BCMSMMSG.exe [2003-08-29 122880]
"pccguide.exe"=C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe [2006-08-25 3112960]
"2c4c9aba"=C:\WINDOWS\system32\mwuabxeg.dll []
"Ad-Watch"=C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-01-18 506712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"OE"=C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe [2006-08-18 315392]
"Twain"=C:\Documents and Settings\Cap'n Rod\Application Data\Twain\Twain.exe []
"SpeedRunner"=C:\Documents and Settings\Cap'n Rod\Application Data\SpeedRunner\SpeedRunner.exe []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE
TL-WN321G Wireless Utility.lnk - C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="etrtbp.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-04-07 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqRKDsqO]
rqRKDsqO.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\ssqNFUNH

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\WINDOWS\SYSTEM32\LEXPPS.EXE"="C:\WINDOWS\SYSTEM32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Disabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Disabled:Yahoo! FT Server"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 3 months======

2009-02-04 09:27:09 ----D---- C:\rsit
2009-02-01 09:00:01 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-02-01 08:58:46 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-02-01 08:58:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-02-01 08:57:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-02-01 08:57:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-02-01 08:57:34 ----A---- C:\WINDOWS\system32\ehqwanszrwgk.dll-uninst.exe
2009-02-01 08:57:31 ----A---- C:\WINDOWS\system32\gside2.exe
2009-02-01 08:57:21 ----A---- C:\WINDOWS\system32\MRT.INI
2009-01-25 15:27:15 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-01-25 14:58:11 ----HDC---- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 14:57:54 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2009-01-25 14:47:09 ----D---- C:\VundoFix Backups
2009-01-25 14:47:09 ----A---- C:\VundoFix.txt
2009-01-25 14:46:57 ----A---- C:\WINDOWS\system32\canwdqck.dll
2009-01-25 14:46:56 ----ASH---- C:\WINDOWS\system32\gexbauwm.ini
2009-01-25 12:46:20 ----A---- C:\WINDOWS\system32\ddcAqRkj.dll
2009-01-25 00:51:54 ----A---- C:\WINDOWS\system32\nomkaeto.dll
2009-01-25 00:51:54 ----A---- C:\WINDOWS\system32\hczraf.dll
2009-01-25 00:51:51 ----ASH---- C:\WINDOWS\system32\nqrpgeux.ini
2009-01-24 01:13:39 ----A---- C:\WINDOWS\system32\gsnd.exe
2009-01-24 00:50:23 ----ASH---- C:\WINDOWS\system32\bioruftj.ini
2009-01-24 00:50:19 ----A---- C:\WINDOWS\system32\eidmbhys.dll
2009-01-24 00:50:19 ----A---- C:\WINDOWS\system32\dawmih.dll
2009-01-23 21:00:21 ----A---- C:\WINDOWS\system32\Install7x.dll
2009-01-23 21:00:21 ----A---- C:\WINDOWS\system32\AegisI5.exe
2009-01-23 20:25:52 ----A---- C:\WINDOWS\_delis32.ini
2009-01-19 07:39:00 ----A---- C:\WINDOWS\system32\ehqwanszrwgk.dll
2008-12-23 17:29:41 ----ASH---- C:\WINDOWS\system32\dvvoxvrr.ini
2008-12-23 14:16:47 ----A---- C:\WINDOWS\system32\omcode.dll
2008-12-23 14:16:46 ----A---- C:\WINDOWS\system32\vxdagcln.dll
2008-12-21 15:40:41 ----A---- C:\WINDOWS\system32\qkyuskqp.dll
2008-12-12 22:50:31 ----A---- C:\WINDOWS\system32\uwvemn.dll
2008-12-12 22:50:30 ----A---- C:\WINDOWS\system32\hbhkxxix.dll
2008-12-12 22:49:56 ----A---- C:\WINDOWS\system32\gside.exe
2008-12-07 11:17:47 ----A---- C:\WINDOWS\system32\winscenter.exe
2008-12-05 18:00:18 ----A---- C:\WINDOWS\vmreg.dll
2008-12-05 18:00:18 ----A---- C:\WINDOWS\reged.exe
2008-12-05 18:00:17 ----A---- C:\WINDOWS\sysexplorer.exe
2008-12-05 18:00:17 ----A---- C:\WINDOWS\syscert.exe
2008-12-05 18:00:17 ----A---- C:\WINDOWS\sys.com
2008-12-05 18:00:17 ----A---- C:\WINDOWS\spoolsystem.exe
2008-12-05 17:59:55 ----A---- C:\WINDOWS\system32\adnzpe.dll
2008-12-05 17:59:54 ----A---- C:\WINDOWS\system32\kawqdapk.dll
2008-12-05 17:59:54 ----A---- C:\Documents and Settings\All Users\Application Data\svhost.exe
2008-12-05 17:59:51 ----A---- C:\WINDOWS\system32\kifdpfnt.exe
2008-12-05 17:57:47 ----ASH---- C:\WINDOWS\system32\sqvmesbr.ini
2008-12-05 17:57:46 ----A---- C:\WINDOWS\system32\rbsemvqs.dll
2008-12-04 15:18:48 ----D---- C:\Documents and Settings\Cap'n Rod\Application Data\SpeedRunner
2008-12-04 15:14:08 ----A---- C:\WINDOWS\system32\xzabqd.dll
2008-12-04 15:14:07 ----A---- C:\WINDOWS\system32\mtblnlaj.dll
2008-12-04 15:13:50 ----D---- C:\Documents and Settings\Cap'n Rod\Application Data\Twain
2008-12-04 15:11:08 ----A---- C:\WINDOWS\system32\tlmqrw.dll
2008-12-04 15:11:07 ----A---- C:\WINDOWS\system32\dbnlripn.dll
2008-12-04 15:09:16 ----ASH---- C:\WINDOWS\system32\ksqcfwke.ini
2008-12-04 15:08:51 ----D---- C:\Program Files\Webtools
2008-12-04 15:08:38 ----A---- C:\WINDOWS\system32\276f5ec4-.txt
2008-12-04 15:08:06 ----ASH---- C:\WINDOWS\system32\HNUFNqss.ini2
2008-12-04 15:08:05 ----ASH---- C:\WINDOWS\system32\HNUFNqss.ini
2008-12-04 15:03:55 ----D---- C:\Program Files\Mjcore
2008-12-04 15:03:10 ----A---- C:\WINDOWS\system32\rqwnw64k.exe
2008-12-03 17:48:25 ----D---- C:\Documents and Settings\Cap'n Rod\Application Data\gadcom
2008-12-03 17:48:21 ----A---- C:\WINDOWS\system32\g86.exe
2008-12-03 17:48:16 ----A---- C:\WINDOWS\system32\dwwnw64r.exe
2008-12-03 17:48:12 ----D---- C:\WINDOWS\system32\VC
2008-12-03 17:48:12 ----D---- C:\WINDOWS\system32\uv9
2008-12-03 17:48:12 ----D---- C:\WINDOWS\system32\ki3
2008-12-03 17:48:12 ----D---- C:\WINDOWS\system32\bin
2008-12-03 17:47:57 ----A---- C:\WINDOWS\system32\prunnet.exe
2008-11-30 21:59:06 ----D---- C:\Program Files\QuickTime
2008-11-17 03:01:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-11-17 03:00:35 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-16 16:10:43 ----D---- C:\WINDOWS\Prefetch
2008-11-16 13:41:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-16 13:41:18 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-16 13:40:41 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-16 13:40:03 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-16 13:39:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-16 13:38:44 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-16 13:38:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-16 13:37:28 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-16 13:36:52 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-16 13:36:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-11-16 13:35:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-16 13:34:59 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-16 13:34:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-11-16 13:33:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-16 13:33:03 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-16 13:32:27 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-16 13:31:48 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-16 13:31:09 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-16 13:24:41 ----D---- C:\WINDOWS\system32\scripting
2008-11-16 13:24:37 ----D---- C:\WINDOWS\l2schemas
2008-11-16 13:24:36 ----D---- C:\WINDOWS\system32\en
2008-11-16 13:01:44 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-11-13 03:01:43 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$
2008-11-13 03:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$

======List of files/folders modified in the last 3 months======

2009-02-03 19:43:30 ----D---- C:\WINDOWS\Temp
2009-02-03 19:42:56 ----A---- C:\WINDOWS\ModemLog_BCM V.92 56K Modem.txt
2009-02-03 19:41:35 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-02-01 15:27:01 ----D---- C:\WINDOWS\SYSTEM32
2009-02-01 09:14:12 ----D---- C:\WINDOWS
2009-02-01 09:13:46 ----D---- C:\Program Files\Internet Explorer
2009-02-01 09:00:04 ----HD---- C:\WINDOWS\INF
2009-02-01 09:00:03 ----D---- C:\WINDOWS\system32\CatRoot2
2009-02-01 08:59:37 ----A---- C:\WINDOWS\imsins.BAK
2009-02-01 08:59:33 ----RSHD---- C:\WINDOWS\system32\DLLCACHE
2009-02-01 08:59:19 ----HD---- C:\WINDOWS\$hf_mig$
2009-02-01 08:59:05 ----SHD---- C:\WINDOWS\Installer
2009-02-01 08:58:47 ----D---- C:\WINDOWS\system32\DRIVERS
2009-02-01 08:57:16 ----SD---- C:\WINDOWS\Tasks
2009-02-01 08:47:44 ----SD---- C:\Documents and Settings\Cap'n Rod\Application Data\Microsoft
2009-01-25 19:30:31 ----D---- C:\Documents and Settings\Cap'n Rod\Application Data\MSN6
2009-01-25 19:27:59 ----AD---- C:\Program Files
2009-01-25 19:16:23 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-25 16:48:09 ----D---- C:\WINDOWS\WinSxS
2009-01-25 16:47:19 ----D---- C:\Program Files\Google
2009-01-25 15:54:10 ----D---- C:\Documents and Settings
2009-01-25 15:01:54 ----N---- C:\WINDOWS\SYSTEM.INI
2009-01-25 14:58:36 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-01-25 14:57:55 ----D---- C:\Program Files\Lavasoft
2009-01-25 12:51:03 ----D---- C:\Downloads
2009-01-25 12:51:02 ----SHD---- C:\RECYCLER
2009-01-25 11:55:57 ----A---- C:\YServer.txt
2009-01-25 11:48:17 ----AD---- C:\Program Files\Common Files
2009-01-24 01:04:10 ----D---- C:\Program Files\Trend Micro
2009-01-24 01:02:02 ----D---- C:\hijackthis
2009-01-23 20:59:44 ----HD---- C:\Program Files\InstallShield Installation Information
2009-01-23 20:59:38 ----D---- C:\Program Files\TP-LINK
2009-01-23 20:56:19 ----D---- C:\WINDOWS\Help
2009-01-23 20:45:23 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-01-23 20:31:45 ----D---- C:\Program Files\Yahoo!
2009-01-23 20:26:24 ----A---- C:\WINDOWS\wininit.ini
2009-01-23 20:24:57 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2009-01-23 20:19:38 ----D---- C:\WINDOWS\occache
2009-01-09 17:35:30 ----A---- C:\WINDOWS\system32\MRT.exe
2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-05 17:59:55 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-12-05 14:41:22 ----A---- C:\WINDOWS\OEWABLog.txt
2008-12-03 17:48:15 ----D---- C:\temp
2008-11-20 05:00:00 ----A---- C:\WINDOWS\system32\_pmxnhmtuee.dll
2008-11-16 16:12:38 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-16 16:11:28 ----A---- C:\WINDOWS\SETUPLOG.TXT
2008-11-16 16:10:19 ----D---- C:\WINDOWS\system32\WBEM
2008-11-16 16:10:19 ----D---- C:\WINDOWS\system32\Setup
2008-11-16 16:10:19 ----D---- C:\WINDOWS\IME
2008-11-16 16:10:19 ----D---- C:\WINDOWS\AppPatch
2008-11-16 16:10:19 ----D---- C:\Program Files\Messenger
2008-11-16 16:10:18 ----RSD---- C:\WINDOWS\Fonts
2008-11-16 13:42:12 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-16 13:36:31 ----D---- C:\WINDOWS\SECURITY
2008-11-16 13:25:31 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-16 13:25:29 ----D---- C:\Program Files\Windows Media Player
2008-11-16 13:25:04 ----D---- C:\WINDOWS\network diagnostic
2008-11-16 13:24:43 ----D---- C:\WINDOWS\system32\en-US
2008-11-16 13:24:42 ----D---- C:\WINDOWS\system32\USMT
2008-11-16 13:24:36 ----D---- C:\WINDOWS\system32\bits
2008-11-16 13:24:35 ----D---- C:\WINDOWS\peernet
2008-11-16 13:24:35 ----D---- C:\Program Files\Movie Maker
2008-11-16 13:20:27 ----D---- C:\WINDOWS\system32\Restore
2008-11-16 13:20:26 ----D---- C:\WINDOWS\system32\NPP
2008-11-16 13:20:24 ----D---- C:\WINDOWS\MSAGENT
2008-11-16 13:20:22 ----D---- C:\WINDOWS\SRCHASST
2008-11-16 13:20:21 ----D---- C:\Program Files\NetMeeting
2008-11-16 13:20:19 ----D---- C:\WINDOWS\system32\Com
2008-11-16 13:20:14 ----D---- C:\Program Files\Windows NT
2008-11-16 13:20:14 ----D---- C:\Program Files\Outlook Express
2008-11-16 13:20:10 ----D---- C:\Program Files\Common Files\System
2008-11-16 13:19:45 ----D---- C:\WINDOWS\system32\OOBE
2008-11-16 13:19:42 ----D---- C:\WINDOWS\SYSTEM
2008-11-16 13:08:51 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-16 13:01:38 ----D---- C:\WINDOWS\EHome
2008-11-07 16:45:32 ----A---- C:\WINDOWS\system32\WMVCore.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdclasss;kbdclasss; C:\WINDOWS\System32\drivers\kbdclasss.sys [2008-12-03 86272]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 omci;OMCI WDM Device Driver; C:\WINDOWS\System32\DRIVERS\omci.sys [2002-11-08 17217]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2006-08-24 68224]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-01-23 20747]
R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS Compatible Transport Protocol; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;NWLink NetBIOS; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [2002-08-29 63232]
R2 NwlnkSpx;NWLink SPX/SPXII Protocol; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [2002-08-29 55936]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 tmmbd;Trend Micro MBD Driver; C:\WINDOWS\system32\DRIVERS\tm_mbd_c.sys [2006-08-24 101376]
R2 Tmpreflt;Tmpreflt; C:\WINDOWS\system32\drivers\Tmpreflt.sys [2008-07-18 36368]
R2 tmxpflt;tmxpflt; C:\WINDOWS\system32\drivers\TmXPFlt.sys [2008-07-18 205328]
R2 Vsapint;Vsapint; C:\WINDOWS\system32\drivers\VsapiNT.sys [2008-07-18 1195448]
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-04-15 113504]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-04-15 78752]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\System32\DRIVERS\bcm4sbxp.sys [2003-05-23 43136]
R3 BCMModem;BCM V.92 56K Modem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [2003-08-29 1101696]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2003-04-15 90907]
R3 MxlW2k;MxlW2k; C:\WINDOWS\system32\drivers\MxlW2k.sys [2008-03-22 28256]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 21248]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-02-28 545024]
R3 tmcfw;Trend Micro Common Firewall Service; C:\WINDOWS\system32\DRIVERS\TM_CFW.sys [2006-08-02 281600]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-13 42752]
S3 AR5211;TP-LINK Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-12-20 470048]
S3 EL90XBC;3Com EtherLink XL 90XB/C Adapter Driver; C:\WINDOWS\System32\DRIVERS\el90xbc5.sys [2001-08-17 66591]
S3 FVNETusb;Linksys Wireless-B USB Network Adapter v2.8 Driver; C:\WINDOWS\System32\DRIVERS\vnet558x.sys [2003-06-12 98304]
S3 i81x;i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [2004-08-04 161020]
S3 iAimFP0;iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [2004-08-04 12415]
S3 iAimFP1;iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [2004-08-04 12127]
S3 iAimFP2;iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [2004-08-04 11775]
S3 iAimFP3;iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [2004-08-04 12063]
S3 iAimFP4;iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [2004-08-04 19455]
S3 iAimTV0;iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [2004-08-04 29311]
S3 iAimTV1;iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [2004-08-04 19551]
S3 iAimTV2;iAimTV2; C:\WINDOWS\System32\DRIVERS\wATV03nt.sys []
S3 iAimTV3;iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [2004-08-04 33599]
S3 iAimTV4;iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [2004-08-04 23615]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 netr73;TL-WN321G Wireless USB Adapter Driver for Vista; C:\WINDOWS\system32\DRIVERS\netr73.sys [2007-01-04 255488]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 RT73;TL-WN321G USB Wireless Adapter; C:\WINDOWS\system32\DRIVERS\rt73.sys [2006-01-12 252928]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys []
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\System32\DRIVERS\wanatw4.sys []
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\System32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\System32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\System32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2003-06-02 303104]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-20 322120]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
S2 PcCtlCom;Trend Micro Central Control Component; C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe [2007-10-04 1544192]
S2 Tmntsrv;Trend Micro Real-time Service; C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-08-25 503808]
S2 TmPfw;Trend Micro Personal Firewall; C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-08-24 933949]
S2 tmproxy;Trend Micro Proxy Service; C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-08-24 561220]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2003-02-20 32768]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-14 168432]
S3 PcScnSrv;Trend Micro Protection Against Spyware ; C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe [2006-08-25 196608]

-----------------EOF-----------------

#7 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 04 February 2009 - 10:28 PM

Please download SDFix by Andy Manchesta and save it to your desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please reboot into Safe Mode
  • In Safe Mode, right click the SDFix.zip folder and choose Extract All,
  • A new folder will be extracted to your %systemdrive%, typically C:\SDFix
  • Open the extracted folder and double click RunThis.bat to start the script.
  • Type Y to begin the script.
  • It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • Your system will take longer that normal to restart as the fixtool will be running and removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
  • Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt along with any other requested logs at the end of these instructions.



NEXT


Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given..

Please download ComboFix by sUBs from HERE or HERE or HERE and save it to your Desktop.

During the download, rename Combofix to Combo-Fix as follows:

Posted Image

Posted Image


It is important you rename Combofix during the download, but not after.

**NOTE: If you are using Firefox, make sure that your download settings are as follows:
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".

After that, double-click and run Combo-Fix. Let it finish its job and post the log here

If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest..

Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job..




Post me these logs in your next reply..

1. SDFix
2. Combo-Fix

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#8 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 05 February 2009 - 10:19 AM

SDFIX would not run but the new combofix did. BTW when ever the system boots I get an error that MWUABXEG.DLL is missing.




ComboFix 09-02-04.04 - Cap'n Rod 2009-02-05 10:07:20.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1150.810 [GMT -5:00]
Running from: c:\documents and settings\Cap'n Rod\Desktop\Combo-Fix.exe
AV: Trend Micro PC-cillin Internet Security 2007 *On-access scanning disabled* (Outdated)
FW: Trend Micro PC-cillin Internet Security (Firewall) *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Protect\svhost.exe
c:\documents and settings\All Users\Application Data\Microsoft\Protect\track.sys
c:\documents and settings\All Users\Application Data\svhost.exe
c:\documents and settings\Cap'n Rod\Application Data\gadcom
c:\documents and settings\Cap'n Rod\Application Data\SpeedRunner
c:\documents and settings\Cap'n Rod\Application Data\SpeedRunner\config.cfg
c:\documents and settings\Cap'n Rod\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Cap'n Rod\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Cap'n Rod\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Cap'n Rod\Start Menu\Programs\Spyware Guard 2008
c:\documents and settings\Cap'n Rod\Start Menu\Programs\Spyware Guard 2008\Spyware Guard 2008.lnk
c:\documents and settings\Cap'n Rod\Start Menu\Programs\Spyware Guard 2008\Uninstall.lnk
c:\program files\Mjcore
c:\program files\Mjcore\Mjcore.dll
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\temp\tn3
c:\windows\reged.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysexplorer.exe
c:\windows\system32\bin
c:\windows\system32\bioruftj.ini
c:\windows\system32\canwdqck.dll
c:\windows\system32\dawmih.dll
c:\windows\system32\ddcAqRkj.dll
c:\windows\system32\drivers\fad.sys
c:\windows\system32\drivers\TDSSpaxt.sys
c:\windows\system32\dvvoxvrr.ini
c:\windows\system32\dwwnw64r.exe
c:\windows\system32\ehqwanszrwgk.dll
c:\windows\system32\eidmbhys.dll
c:\windows\system32\gexbauwm.ini
c:\windows\system32\gside.exe
c:\windows\system32\hczraf.dll
c:\windows\system32\HNUFNqss.ini
c:\windows\system32\HNUFNqss.ini2
c:\windows\system32\ki3
c:\windows\system32\ki3\RI2ES6i.exe
c:\windows\system32\ksqcfwke.ini
c:\windows\system32\msnav32.ax
c:\windows\system32\nomkaeto.dll
c:\windows\system32\nqrpgeux.ini
c:\windows\system32\prunnet.exe
c:\windows\system32\rqwnw64k.exe
c:\windows\system32\sqvmesbr.ini
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSoiqh.log
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSpqxt.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\uv9
c:\windows\system32\uv9\peco85IV.exe
c:\windows\system32\VC
c:\windows\system32\winpfz33.sys
c:\windows\system32\winscenter.exe
c:\windows\system32\zxdnt3d.cfg
c:\windows\Temp\tmp3.tmp
c:\windows\vmreg.dll
c:\windows\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS
-------\Service_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-05 10:11 . 2009-02-05 10:11 <DIR> d-------- c:\temp\tn3
2009-02-05 09:16 . 2009-02-05 09:17 <DIR> d-------- C:\sUBs
2009-02-04 09:27 . 2009-02-04 09:27 <DIR> d-------- C:\rsit
2009-02-01 08:57 . 2009-02-01 08:57 477,257 --a------ c:\windows\SYSTEM32\gside2.exe
2009-02-01 08:57 . 2009-02-01 08:57 57,238 --a------ c:\windows\SYSTEM32\ehqwanszrwgk.dll-uninst.exe
2009-02-01 08:57 . 2009-02-01 08:57 118 --a------ c:\windows\SYSTEM32\MRT.INI
2009-01-25 15:27 . 2009-01-18 16:35 15,688 --a------ c:\windows\SYSTEM32\lsdelete.exe
2009-01-25 14:58 . 2009-01-25 14:58 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 14:58 . 2009-01-18 16:30 64,160 --a------ c:\windows\SYSTEM32\DRIVERS\Lbd.sys
2009-01-25 14:57 . 2009-01-25 14:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-25 14:47 . 2009-01-25 14:47 <DIR> d-------- C:\VundoFix Backups
2009-01-25 12:37 . 2006-08-30 13:07 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-01-25 12:37 . 2009-01-25 12:37 <DIR> d-------- c:\documents and settings\Administrator
2009-01-24 01:13 . 2009-01-24 01:13 198,997 --a------ c:\windows\SYSTEM32\gsnd.exe
2009-01-23 21:00 . 2005-05-17 16:24 311,296 --a------ c:\windows\SYSTEM32\AegisI5.exe
2009-01-23 21:00 . 2006-01-18 13:55 290,918 --a------ c:\windows\SYSTEM32\Install7x.dll
2009-01-23 21:00 . 2006-01-12 19:46 252,928 --a------ c:\windows\SYSTEM32\DRIVERS\rt73.sys
2009-01-23 21:00 . 2005-10-17 19:50 245,376 --a------ c:\windows\SYSTEM32\DRIVERS\rt2500usb.SYS
2009-01-23 21:00 . 2005-11-30 11:33 2,048 --a------ c:\windows\SYSTEM32\DRIVERS\rt73.bin
2009-01-23 21:00 . 2005-08-19 15:51 138 --a------ c:\windows\filespec7x
2009-01-23 20:59 . 2009-01-23 20:59 20,747 --a------ c:\windows\SYSTEM32\DRIVERS\AegisP.sys
2009-01-23 20:25 . 2009-01-23 20:27 138 --a------ c:\windows\_delis32.ini
2009-01-14 13:46 . 2007-01-04 03:41 255,488 -ra------ c:\windows\SYSTEM32\DRIVERS\netr73.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 15:10 932 ------w c:\windows\system32\drivers\core.cache.dsk
2009-01-26 00:30 --------- d-----w c:\documents and settings\Cap'n Rod\Application Data\MSN6
2009-01-25 21:47 --------- d-----w c:\program files\Google
2009-01-25 20:27 --------- d-----w c:\documents and settings\Cap'n Rod\Application Data\Twain
2009-01-25 19:57 --------- d-----w c:\program files\Lavasoft
2009-01-24 06:04 --------- d-----w c:\program files\Trend Micro
2009-01-24 01:59 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-24 01:59 --------- d-----w c:\program files\TP-LINK
2009-01-24 01:31 --------- d-----w c:\program files\Yahoo!
2009-01-24 01:24 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"OE"="c:\program files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe" [2006-08-18 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 2007\pccguide.exe" [2006-08-25 3112960]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:\windows\BCMSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe [2009-01-23 622592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=etrtbp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [2009-01-25 64160]
R1 kbdclasss;kbdclasss;c:\windows\SYSTEM32\DRIVERS\kbdclasss.sys [2008-12-03 86272]
R2 Tmpreflt;Tmpreflt;c:\windows\SYSTEM32\DRIVERS\tmpreflt.sys [2006-08-16 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\SYSTEM32\DRIVERS\TM_CFW.sys [2006-08-24 281600]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
S2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-08-25 503808]
S2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-08-24 933949]
S2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-08-24 561220]
S3 netr73;TL-WN321G Wireless USB Adapter Driver for Vista;c:\windows\SYSTEM32\DRIVERS\netr73.sys [2009-01-14 255488]
.
Contents of the 'Scheduled Tasks' folder

2009-02-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 16:34]

2003-12-31 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2008-04-13 19:12]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{605B3D3F-4F33-41D0-BA27-98238E1E839F} - (no file)
BHO-{6ABC5436-9C5B-4F51-816B-07907DA3CA60} - c:\windows\system32\ssqNFUNH.dll
HKLM-Run-2c4c9aba - c:\windows\system32\mwuabxeg.dll
Notify-rqRKDsqO - rqRKDsqO.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://jonasbrothersfan.com/default.aspx
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Trusted Zone: yahoo.com\www
TCP: {52FDB74A-52E4-4A12-A7A1-3440E8DA1BE7} = 4.2.2.2,4.2.2.1
DPF: {413D6754-BFD4-47FE-9346-319559290BFA} - hxxps://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-05 10:13:06
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
.
**************************************************************************
.
Completion time: 2009-02-05 10:15:38 - machine was rebooted [Cap'n Rod]
ComboFix-quarantined-files.txt 2009-02-05 15:15:36

Pre-Run: 55,880,925,184 bytes free
Post-Run: 55,954,214,912 bytes free

215 --- E O F --- 2009-02-01 14:00:04

#9 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 05 February 2009 - 10:37 AM

1. Please open Notepad
  • Click Start, then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

Rootkit::
c:\windows\system32\drivers\core.cache.dsk

File::
c:\windows\system32\drivers\core.cache.dsk
c:\windows\SYSTEM32\ehqwanszrwgk.dll-uninst.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#10 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 05 February 2009 - 06:30 PM

combofix log. BTW I can now use the internet for atleast bleepingcomputer now..I think I can run any diags you want now

ComboFix 09-02-04.04 - Cap'n Rod 2009-02-05 18:15:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1150.787 [GMT -5:00]
Running from: c:\documents and settings\Cap'n Rod\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Cap'n Rod\Desktop\cfscript.txt
AV: Trend Micro PC-cillin Internet Security 2007 *On-access scanning disabled* (Outdated)
FW: Trend Micro PC-cillin Internet Security (Firewall) *disabled*

FILE ::
c:\windows\system32\drivers\core.cache.dsk
c:\windows\SYSTEM32\ehqwanszrwgk.dll-uninst.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\temp\tn3
c:\windows\system32\drivers\core.cache.dsk
c:\windows\SYSTEM32\ehqwanszrwgk.dll-uninst.exe

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-05 18:18 . 2009-02-05 18:18 <DIR> d-------- c:\temp\tn3
2009-02-05 10:23 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix
2009-02-05 09:16 . 2009-02-05 09:17 <DIR> d-------- C:\sUBs
2009-02-04 09:27 . 2009-02-04 09:27 <DIR> d-------- C:\rsit
2009-02-01 08:57 . 2009-02-01 08:57 477,257 --a------ c:\windows\SYSTEM32\gside2.exe
2009-02-01 08:57 . 2009-02-01 08:57 118 --a------ c:\windows\SYSTEM32\MRT.INI
2009-01-25 15:27 . 2009-01-18 16:35 15,688 --a------ c:\windows\SYSTEM32\lsdelete.exe
2009-01-25 14:58 . 2009-01-25 14:58 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 14:58 . 2009-01-18 16:30 64,160 --a------ c:\windows\SYSTEM32\DRIVERS\Lbd.sys
2009-01-25 14:57 . 2009-01-25 14:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-25 14:47 . 2009-01-25 14:47 <DIR> d-------- C:\VundoFix Backups
2009-01-25 12:37 . 2006-08-30 13:07 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-01-25 12:37 . 2009-01-25 12:37 <DIR> d-------- c:\documents and settings\Administrator
2009-01-24 01:13 . 2009-01-24 01:13 198,997 --a------ c:\windows\SYSTEM32\gsnd.exe
2009-01-23 21:00 . 2005-05-17 16:24 311,296 --a------ c:\windows\SYSTEM32\AegisI5.exe
2009-01-23 21:00 . 2006-01-18 13:55 290,918 --a------ c:\windows\SYSTEM32\Install7x.dll
2009-01-23 21:00 . 2006-01-12 19:46 252,928 --a------ c:\windows\SYSTEM32\DRIVERS\rt73.sys
2009-01-23 21:00 . 2005-10-17 19:50 245,376 --a------ c:\windows\SYSTEM32\DRIVERS\rt2500usb.SYS
2009-01-23 21:00 . 2005-11-30 11:33 2,048 --a------ c:\windows\SYSTEM32\DRIVERS\rt73.bin
2009-01-23 21:00 . 2005-08-19 15:51 138 --a------ c:\windows\filespec7x
2009-01-23 20:59 . 2009-01-23 20:59 20,747 --a------ c:\windows\SYSTEM32\DRIVERS\AegisP.sys
2009-01-23 20:25 . 2009-01-23 20:27 138 --a------ c:\windows\_delis32.ini
2009-01-14 13:46 . 2007-01-04 03:41 255,488 -ra------ c:\windows\SYSTEM32\DRIVERS\netr73.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 23:18 167,976 ------w c:\windows\system32\drivers\core.cache.dsk
2009-01-26 00:30 --------- d-----w c:\documents and settings\Cap'n Rod\Application Data\MSN6
2009-01-25 21:47 --------- d-----w c:\program files\Google
2009-01-25 20:27 --------- d-----w c:\documents and settings\Cap'n Rod\Application Data\Twain
2009-01-25 19:57 --------- d-----w c:\program files\Lavasoft
2009-01-24 06:04 --------- d-----w c:\program files\Trend Micro
2009-01-24 01:59 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-24 01:59 --------- d-----w c:\program files\TP-LINK
2009-01-24 01:31 --------- d-----w c:\program files\Yahoo!
2009-01-24 01:24 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"OE"="c:\program files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe" [2006-08-18 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-01 98304]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 2007\pccguide.exe" [2006-08-25 3112960]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-18 506712]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:\windows\BCMSMMSG.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
TL-WN321G Wireless Utility.lnk - c:\program files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe [2009-01-23 622592]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [2009-01-25 64160]
R1 kbdclasss;kbdclasss;c:\windows\SYSTEM32\DRIVERS\kbdclasss.sys [2008-12-03 86272]
R2 Tmpreflt;Tmpreflt;c:\windows\SYSTEM32\DRIVERS\tmpreflt.sys [2006-08-16 36368]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\SYSTEM32\DRIVERS\TM_CFW.sys [2006-08-24 281600]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
S2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-08-25 503808]
S2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-08-24 933949]
S2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-08-24 561220]
S3 netr73;TL-WN321G Wireless USB Adapter Driver for Vista;c:\windows\SYSTEM32\DRIVERS\netr73.sys [2009-01-14 255488]
.
Contents of the 'Scheduled Tasks' folder

2009-02-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 16:34]

2003-12-31 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2008-04-13 19:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://jonasbrothersfan.com/default.aspx
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Trusted Zone: yahoo.com\www
TCP: {52FDB74A-52E4-4A12-A7A1-3440E8DA1BE7} = 4.2.2.2,4.2.2.1
DPF: {413D6754-BFD4-47FE-9346-319559290BFA} - hxxps://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-05 18:19:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
.
**************************************************************************
.
Completion time: 2009-02-05 18:22:23 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-05 23:22:21
ComboFix2.txt 2009-02-05 15:15:39

Pre-Run: 58,638,319,616 bytes free
Post-Run: 58,679,894,016 bytes free

144 --- E O F --- 2009-02-01 14:00:04




hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:29:50 PM, on 2/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jonasbrothersfan.com/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (WficaCtl Object) - https://www.webpcfos.com/webpcfos/Citrix/wfica.cab
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) - https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1156968741906
O17 - HKLM\System\CCS\Services\Tcpip\..\{52FDB74A-52E4-4A12-A7A1-3440E8DA1BE7}: NameServer = 4.2.2.2,4.2.2.1
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--
End of file - 4861 bytes

#11 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 06 February 2009 - 01:52 AM

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan
    Wait for the scan to finish
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

How's the computer now? :thumbup2:

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#12 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 06 February 2009 - 03:23 PM

still getting a few popups


# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3832 (20090206)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=f3408db719017246a326c6780a618612
# end=finished
# remove_checked=true
# unwanted_checked=true
# utc_time=2009-02-06 01:50:58
# local_time=2009-02-06 08:50:58 (-0500, Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 3
# scanned=195951
# found=30
# scan_time=1299
C:\Program Files\Webtools\webtools.dll Win32/Adware.BHO.NEZ application (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\svhost.exe.vir Win32/TrojanDownloader.FakeAlert.SM trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost.exe.vir Win32/Adware.SpywareGuard application (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\Program Files\Mjcore\Mjcore.dll.vir Win32/Adware.MaxSearch application (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\ddcAqRkj.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\dwwnw64r.exe.vir Win32/TrojanDownloader.Agent.AFZG trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\gside.exe.vir Win32/Adware.MySideSearch application (deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\gside.exe.vir »NSIS »ý¤€ Win32/Adware.MySideSearch application (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\prunnet.exe.vir probably unknown NewHeur_PE virus (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\rqwnw64k.exe.vir Win32/TrojanDownloader.Agent.AFZG trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\TDSScfum.dll.vir Win32/Olmarik.AW trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\TDSSnrsr.dll.vir Win32/Agent.OIK trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\TDSSofxh.dll.vir Win32/Agent.ODG trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\TDSSriqp.dll.vir Win32/Agent.OIK trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\winscenter.exe.vir Win32/Adware.SpywareGuard application (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\__.zip Win32/Agent.ODG trojan (deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\__.zip »ZIP »TDSSpaxt.sys Win32/Agent.ODG trojan (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\ki3\RI2ES6i.exe.vir Win32/Agent.ASJZ trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\uv9\peco85IV.exe.vir Win32/TrojanDownloader.Agent.AFZG trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\adnzpe.dll Win32/Adware.SuperJuan application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\dbnlripn.dll Win32/Adware.SuperJuan application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\g86.exe Win32/Adware.GooochiBiz application (deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\g86.exe »NSIS »ý§€ Win32/Adware.GooochiBiz application (error while cleaning - operation unavailable for this type of object - error while deleting - operation unavailable for this type of object - was a part of the deleted object) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\kawqdapk.dll Win32/Adware.SuperJuan application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\kifdpfnt.exe Win32/TrojanDropper.Delf.NKN trojan (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\mtblnlaj.dll Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\rbsemvqs.dll Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\tlmqrw.dll Win32/Adware.SuperJuan application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\xzabqd.dll Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000
C:\WINDOWS\SYSTEM32\_pmxnhmtuee.dll probably a variant of Win32/Adware.GooochiBiz application (unable to clean - deleted) 00000000000000000000000000000000

#13 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 07 February 2009 - 12:24 AM

Lets do another scan.. :thumbup2:


Please do this step before you sleep or when you don't use the computer as it will take quite a while..

Please run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

  • Click on SCAN NOW
  • Click Accept.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  • The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop.
  • In the File name area use KScan, or something similar.
  • In Save as type: click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
Posted Image

Copy and paste the Kaspersky Online Scanner Report in your next reply.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive


#14 jpd9930

jpd9930
  • Topic Starter

  • Members
  • 221 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:57 AM

Posted 11 February 2009 - 07:38 PM

hey, sorry been busy...I'll get those scans done soon...this isnt completly fixed so dont close this thread just yet.

I've started to get a warning from PC_cillin internet security about connecting to a dangerous web site:

http://www.i-nt-e-r-n-e-t.com

Edited by jpd9930, 11 February 2009 - 08:08 PM.


#15 fenzodahl512

fenzodahl512

  • Members
  • 6,738 posts
  • OFFLINE
  •  
  • Local time:04:57 PM

Posted 11 February 2009 - 10:33 PM

Ok.. and as soon as you finish the Kaspersky step, please do below.. and post the log here...


Please download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

Keep calm, make it simple, use your brain, don't freak out, and you'll be just fine..
Awesomeness: When I get sad, I stop being sad and be awesome instead.. True story - Barney Stinson
Posted Image Posted Image
Its gonna be legen.. wait for it.. dary! Cherish the pain, it means you're still alive





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users