Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

poiskin.ru redirect...and maybe other stuff?


  • This topic is locked This topic is locked
8 replies to this topic

#1 spyderlily

spyderlily

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:11 PM

Posted 24 April 2009 - 08:53 PM

So, other than seeing HijackThis logs in forums when looking to fix things on my own computer and I am in dire need of haaaaalp.

I get redirected when I click on search result links and Internet Explorer kept running in the background even though I never use it. Also running are varying 10-digit .exe files. I'm running the McAfee Security Center on my XP system and the SystemGuard keeps getting disabled. For a while, I kept getting a notice that my Windows automatic update was turned off; I clicked the balloon to turn it back on and was rewarded with pop ups, so I turned them off and updated Windows by going to the Microsoft website. Now, I'm back to only having the occasional pop up from Fling.com (being rid of this would be stellar).

Mah log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:27 PM, on 4/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
D:\Program Files\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\progra~1\Support.com\client\bin\tgcmd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
D:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sony.com/vaiopeople
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {3fb3e484-c88d-4819-9ac9-c97f9a114ad0} - C:\WINDOWS\system32\halukozo.dll (file missing)
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
O4 - HKLM\..\Run: [CleanupProgram] C:\Sonysys\cleanup.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [zagejuzitu] Rundll32.exe "C:\WINDOWS\system32\zugarusu.dll",s
O4 - HKLM\..\Run: [CPMff28e741] Rundll32.exe "c:\windows\system32\japidahu.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [prnet] "C:\WINDOWS\system32\prnet.tmp"
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\1547372720.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMidi] MIDIDEF.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} (CPlayFirstNightshiftControl Object) - http://games.bigfishgames.com/en_nightshif...Web.1.0.0.9.cab
O16 - DPF: {6C7CAD20-85AA-475A-AC0D-303C4A9A69CE} (CPlayFirstGreatChocoControl Object) - http://games.bigfishgames.com/en_great-cho...eb.1.0.0.12.cab
O16 - DPF: {74EF5274-F439-2168-B543-14745B625C72} (CPlayFirstWeddingDasControl Object) - http://www.gamehouse.com/realarcade-webgam...eddingDash2.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.gamehouse.com/realarcade-webgam...mjolauncher.cab
O16 - DPF: {8DB0B6FB-914F-41DE-B89E-35D80F378640} (AtlBoxWordCtlAttrib Class) - http://kraisoft.com/files/online/abcisland.cab
O16 - DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} (Jolly Bear Games Player) - http://www.gamehouse.com/realarcade-webgam...BGamePlayer.cab
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://www.gamehouse.com/realarcade-webgam...GamesPlayer.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://www.gamehouse.com/realarcade-webgam...zylomplayer.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab
O16 - DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} (CPlayFirstSandScriptControl Object) - http://myspace.oberon-media.com/gameshell/...pt.1.0.0.21.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: C:\WINDOWS\system32\fadokase.dll c:\windows\system32\japidahu.dll
O20 - Winlogon Notify: __c006BE9F - C:\WINDOWS\system32\__c006BE9F.dat
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\japidahu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\japidahu.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: VAIO Media Music Server (Application) (VAIOMediaPlatform-MusicServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
O23 - Service: VAIO Media Music Server (HTTP) (VAIOMediaPlatform-MusicServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
O23 - Service: VAIO Media Music Server (UPnP) (VAIOMediaPlatform-MusicServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe
O23 - Service: VAIO Media Photo Server (Application) (VAIOMediaPlatform-PhotoServer-AppServer) - Unknown owner - C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe
O23 - Service: VAIO Media Photo Server (HTTP) (VAIOMediaPlatform-PhotoServer-HTTP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
O23 - Service: VAIO Media Photo Server (UPnP) (VAIOMediaPlatform-PhotoServer-UPnP) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\UPnPFramework.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 11162 bytes


Many thanks, baked goods and, quite possibly, my first child.

BC AdBot (Login to Remove)

 


#2 KoanYorel

KoanYorel

    Bleepin' Conundrum


  • Staff Emeritus
  • 19,461 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:65 miles due East of the "Logic Free Zone", in Md, USA
  • Local time:02:11 PM

Posted 06 May 2009 - 07:48 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

R,
K
The only easy day was yesterday.

...some do, some don't; some will, some won't (WR)

#3 spyderlily

spyderlily
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:11 PM

Posted 06 May 2009 - 08:50 PM

DDS (Ver_09-03-16.01) - NTFSx86
Run by Leah at 21:42:17.21 on Wed 05/06/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1024.260 [GMT -4:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated)
FW: McAfee Personal Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Sony\VAIO Media Music Server\SSSvr.exe
C:\Program Files\Sony\Photo Server 20\appsrv\PicAppSrv.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
C:\Program Files\Common Files\Sony Shared\VAIO Media Platform\SV_Httpd.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\htpatch.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
c:\PROGRA~1\mcafee\msc\mcupdui.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
D:\Program Files\uTorrent\uTorrent.exe
C:\Documents and Settings\Leah\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = www.google.com
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: H - No File
TB: Veoh Web Player Video Finder: {0fbb9689-d3d7-4f7a-a2e2-585b10099bfc} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [autochk] rundll32.exe c:\docume~1\leah\protect.dll,_IWMPEvents@16
mRun: [HTpatch] c:\windows\htpatch.exe
mRun: [SiS KHooker] c:\windows\system32\khooker.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [CTHelper] CTHELPER.EXE
mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
mRun: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs
mRun: [CleanupProgram] c:\sonysys\cleanup.exe
mRun: [mcagent_exe] c:\program files\mcafee.com\agent\mcagent.exe /runkey
mRun: [StorageGuard] "c:\program files\veritas software\update manager\sgtray.exe" /r
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [autochk] rundll32.exe c:\windows\system32\autochk.dll,_IWMPEvents@16
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
dRun: [A00FE6B77.exe] c:\windows\temp\_A00FE6B77.exe
dRunOnce: [SetDefaultMidi] MIDIDEF.EXE
StartupFolder: c:\docume~1\leah\startm~1\programs\startup\chkdisk.lnk - c:\windows\system32\rundll32.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vaioac~1.lnk - c:\program files\sony\vaio action setup\VAServ.exe
dPolicies-explorer: NoFolderOptions = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: E&xport to Microsoft Excel - f:\progra~1\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nightshift-legacy-the-jaguars-eye/online/Nightshift2Web.1.0.0.9.cab
DPF: {6C7CAD20-85AA-475A-AC0D-303C4A9A69CE} - hxxp://games.bigfishgames.com/en_great-chocolate-chase/online/greatchocolatechaseweb.1.0.0.12.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/realarcade-webgames/weddingdash2/WeddingDash2.cab
DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://www.gamehouse.com/realarcade-webgames/luxor2/mjolauncher.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8DB0B6FB-914F-41DE-B89E-35D80F378640} - hxxp://kraisoft.com/files/online/abcisland.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/realarcade-webgames/bcasydney/JBGamePlayer.cab
DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://www.gamehouse.com/realarcade-webgames/burgershop/GoBitGamesPlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/realarcade-webgames/zylom/zylomplayer.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} - hxxp://myspace.oberon-media.com/gameshell/games/channel--110343720/lc--en/room--79bbc769-d6b3-48cf-87c5-2a1592a3d0b1/online/sandscript/en/SandScript.1.0.0.21.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\leah\applic~1\mozilla\firefox\profiles\dw505hfc.default\
FF - prefs.js: browser.search.selectedEngine - qtl
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?rls=ig&hl=en&source=iglk
FF - plugin: c:\documents and settings\leah\application data\mozilla\firefox\profiles\dw505hfc.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\documents and settings\renee\desktop\bible\netscape6\nppl3260.dll
FF - plugin: c:\documents and settings\renee\desktop\bible\netscape6\nprjplug.dll
FF - plugin: c:\documents and settings\renee\desktop\bible\netscape6\nprpjplug.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: f:\divxinstaller converts video\divx\divx web player\npdivx32.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-6-9 201320]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-6-9 359248]
R2 McShield;McAfee Real-time Scanner;c:\program files\mcafee\virusscan\Mcshield.exe [2008-6-9 144704]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-25 24652]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-6-9 695624]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-6-9 79304]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-6-9 35240]
R3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-6-9 33832]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-6-9 40488]
S3 NPF;Netgroup Packet Filter;c:\windows\system32\drivers\npf.sys [2008-8-10 42512]
S4 iWinGamesInstaller;iWinGamesInstaller;c:\downloads\iwin games\iwingamesinstaller.exe --> c:\downloads\iwin games\iWinGamesInstaller.exe [?]

============== File Associations ===============

regfile=regedit.exe "%1" %*

=============== Created Last 30 ================

2009-05-06 08:03 <DIR> --d----- c:\program files\common files\DivX Shared
2009-04-30 13:19 <DIR> --d----- c:\program files\iPod
2009-04-30 13:19 <DIR> --d----- c:\program files\iTunes
2009-04-29 20:41 <DIR> --d----- c:\program files\Enigma Software Group
2009-04-27 18:45 <DIR> --d----- c:\program files\ConvertHelper
2009-04-27 17:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Alawar Stargaze
2009-04-27 17:13 <DIR> --d----- c:\windows\Fashion Season
2009-04-27 17:05 29,696 a------- c:\windows\system32\loader49.exe
2009-04-25 10:50 <DIR> --d----- c:\windows\system32\NtmsData
2009-04-24 20:58 50 a------- C:\xcrashdump.dat
2009-04-24 20:39 <DIR> --d----- c:\program files\Trend Micro
2009-04-21 07:35 20 a---h--- c:\windows\akebook.ini
2009-04-21 07:35 4 a---h--- c:\windows\a3kebook.ini
2009-04-21 07:35 72 a------- c:\windows\ANS2000.INI
2009-04-18 21:28 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-04-18 02:19 118 a------- c:\windows\system32\MRT.INI
2009-04-18 02:07 <DIR> --d----- c:\windows\system32\XPSViewer
2009-04-18 02:06 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-04-18 02:06 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-18 02:06 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-18 02:06 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-18 02:06 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-04-18 02:06 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-04-18 02:06 117,760 -------- c:\windows\system32\prntvpt.dll
2009-04-18 01:52 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-04-18 01:52 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
2009-04-18 01:52 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-04-18 01:45 <DIR> --dsh--- c:\documents and settings\leah\PrivacIE
2009-04-18 01:43 <DIR> --dsh--- c:\documents and settings\leah\IETldCache
2009-04-18 01:38 81,920 a------- c:\windows\system32\ieencode.dll
2009-04-18 01:38 78,336 a------- c:\windows\system32\dllcache\ieencode.dll
2009-04-15 22:22 43 a------- c:\windows\system32\ovfsthksjopayflcojndrgrislbquwodyjhknx.dat
2009-04-15 22:21 1,671,975 a------- c:\windows\system32\ovfsthdtmnvhfiahdvwjxmnsapjcxydvsskjmm.dat
2009-04-15 22:21 60,928 a------- c:\windows\system32\ovfsthgwkyrxrvtckdnwpojddtuungewqhodhr.dll
2009-04-15 20:13 <DIR> --d----- c:\docume~1\leah\applic~1\Skunk Studios
2009-04-15 19:44 <DIR> --d----- c:\windows\Flux Family Secrets - The Ripple Effect
2009-04-15 16:24 90,112 a------- c:\windows\system32\dpl100.dll
2009-04-15 16:24 823,296 a------- c:\windows\system32\divx_xx0c.dll
2009-04-15 16:24 823,296 a------- c:\windows\system32\divx_xx07.dll
2009-04-15 16:24 815,104 a------- c:\windows\system32\divx_xx0a.dll
2009-04-15 16:24 802,816 a------- c:\windows\system32\divx_xx11.dll
2009-04-15 16:24 684,032 a------- c:\windows\system32\DivX.dll
2009-04-14 20:13 73,728 a------- c:\windows\system32\javacpl.cpl
2009-04-10 09:54 <DIR> --d----- c:\program files\Veoh Networks
2009-04-10 09:02 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-09 00:00 <DIR> --d----- c:\docume~1\leah\applic~1\blg

==================== Find3M ====================

2009-04-15 16:25 43,528 -------- c:\windows\system32\drivers\pxhelp20.sys
2009-04-06 15:32 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 15:32 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-09 05:19 410,984 a------- c:\windows\system32\deploytk.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-05 23:59 1,900,544 a------- c:\windows\system32\usbaaplrc.dll
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
2009-02-06 07:06 2,145,280 a------- c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
2009-02-06 06:32 2,023,936 a------- c:\windows\system32\ntkrnlpa.exe
2008-06-16 20:22 0 a------- c:\program files\temp01

============= FINISH: 21:43:48.14 ===============


Thank you x 66,314,684,351,654,654.2 :thumbup2:

Edited to insert Attach.txt IN-LINE ~ Maurice
ATTACH.TXT

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-03-16.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 6/9/2008 11:26:51 PM
System Uptime: 5/1/2009 11:53:49 AM (130 hours ago)

Motherboard: ASUSTeK Computer INC. | | P4S533VL
Processor: Intel® Pentium® 4 CPU 3.06GHz | PGA 478 | 3059/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 38 GiB total, 3.479 GiB free.
D: is FIXED (NTFS) - 75 GiB total, 19.885 GiB free.
E: is FIXED (NTFS) - 98 GiB total, 39.537 GiB free.
F: is FIXED (NTFS) - 98 GiB total, 76.783 GiB free.
G: is Removable
H: is CDROM ()
I: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID:
Description: Multimedia Audio Controller
Device ID: PCI\VEN_1102&DEV_0004&SUBSYS_10021102&REV_04\3&61AAA01&0&78
Manufacturer:
Name: Multimedia Audio Controller
PNP Device ID: PCI\VEN_1102&DEV_0004&SUBSYS_10021102&REV_04\3&61AAA01&0&78
Service:

Class GUID:
Description: PCI Input Device
Device ID: PCI\VEN_1102&DEV_7003&SUBSYS_00601102&REV_04\3&61AAA01&0&79
Manufacturer:
Name: PCI Input Device
PNP Device ID: PCI\VEN_1102&DEV_7003&SUBSYS_00601102&REV_04\3&61AAA01&0&79
Service:

==== System Restore Points ===================

RP341: 3/15/2009 2:36:08 AM - System Checkpoint
RP342: 3/16/2009 8:47:43 AM - System Checkpoint
RP343: 3/17/2009 12:12:45 PM - System Checkpoint
RP344: 3/18/2009 12:26:54 PM - System Checkpoint
RP345: 3/18/2009 7:46:26 PM - Software Distribution Service 3.0
RP346: 3/20/2009 12:48:20 AM - System Checkpoint
RP347: 3/21/2009 2:44:39 AM - System Checkpoint
RP348: 3/22/2009 6:52:53 AM - System Checkpoint
RP349: 3/24/2009 12:38:33 AM - System Checkpoint
RP350: 3/25/2009 1:51:19 AM - System Checkpoint
RP351: 3/26/2009 2:38:07 AM - System Checkpoint
RP352: 3/27/2009 8:24:22 AM - System Checkpoint
RP353: 3/28/2009 9:10:44 AM - System Checkpoint
RP354: 3/29/2009 2:35:42 PM - System Checkpoint
RP355: 3/29/2009 5:01:09 PM - Installed Windows NLSDownlevelMapping.
RP356: 3/29/2009 5:01:42 PM - Installed Windows IDNMitigationAPIs.
RP357: 3/29/2009 5:03:08 PM - Installed Windows Internet Explorer 7.
RP358: 3/29/2009 5:04:11 PM - Software Distribution Service 3.0
RP359: 3/30/2009 5:55:51 PM - System Checkpoint
RP360: 3/30/2009 10:27:11 PM - Software Distribution Service 3.0
RP361: 4/1/2009 1:38:27 AM - System Checkpoint
RP362: 4/1/2009 10:59:31 PM - Software Distribution Service 3.0
RP363: 4/3/2009 12:47:14 AM - System Checkpoint
RP364: 4/4/2009 1:37:43 AM - System Checkpoint
RP365: 4/5/2009 8:41:40 AM - System Checkpoint
RP366: 4/6/2009 10:10:39 AM - System Checkpoint
RP367: 4/7/2009 10:33:18 AM - System Checkpoint
RP368: 4/8/2009 1:11:22 PM - System Checkpoint
RP369: 4/10/2009 10:34:23 PM - System Checkpoint
RP370: 4/11/2009 11:54:48 PM - System Checkpoint
RP371: 4/13/2009 2:38:19 AM - System Checkpoint
RP372: 4/13/2009 10:46:32 AM - Installed Adobe Reader 7.0.9
RP373: 4/14/2009 8:12:26 PM - Installed Java™ 6 Update 13
RP374: 4/14/2009 8:14:21 PM - Installed Java Runtime Environment
RP375: 4/18/2009 1:52:25 AM - Software Distribution Service 3.0
RP376: 4/18/2009 2:01:03 AM - Software Distribution Service 3.0
RP377: 4/18/2009 7:18:55 PM - Installed Uninstall Internet Explorer 8
RP378: 4/20/2009 12:05:36 AM - System Checkpoint
RP379: 4/30/2009 2:42:34 AM - System Checkpoint
RP380: 4/30/2009 9:30:57 AM - Installed Windows XP KB938464-v2.
RP381: 4/30/2009 1:03:27 PM - Removed QuickTime
RP382: 4/30/2009 1:08:51 PM - Removed iTunes
RP383: 4/30/2009 1:19:33 PM - Installed iTunes
RP384: 5/2/2009 2:39:51 PM - System Checkpoint
RP385: 5/4/2009 11:59:05 AM - System Checkpoint
RP386: 5/5/2009 2:14:32 PM - System Checkpoint
RP387: 5/6/2009 9:32:45 PM - System Checkpoint

==== Installed Programs ======================


Acrobat.com
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop 7.0
Adobe Reader 7.0.9
Adobe Shockwave Player 11
Adobe SVG Viewer
Agere Systems AC'97 Modem
AIM 6
ALZip
Ancient Quest of Saqqarah
Apple Mobile Device Support
Apple Software Update
Atlantis Sky Patrol
Audio Bible Ambassador 1.0
AutoUpdate
AviSynth 2.5
Bejeweled 2 Deluxe 1.0
Bejeweled Twist 1.0.3
Big Fish Games Client
Bonjour
Can You See What I See
Cassandras Journey The Legacy of Nostradamus
Coffee House Chaos
ConvertHelper 2.2
Creative Driver
Critical Update for Windows Media Player 11 (KB959772)
DivX Codec
DivX Version Checker
DivX Web Player
DVD Creation
DVgate
Fashion Season
Flux Family Secrets - The Ripple Effect
Google Gmail Notifier
Help and Support
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
ISScript
iTunes
iWin Games (remove only)
Java™ 6 Update 13
Java™ 6 Update 6
Java™ 6 Update 7
Jewel Quest (remove only)
Jewels of Cleopatra
Lost in the City 1.00
Lost Realms - Legacy of the Sun Princess (remove only)
Luxor (remove only)
Luxor 2 (remove only)
Malwarebytes' Anti-Malware
McAfee SecurityCenter
McAfee.com SecurityCenter
Megaplex Madness Now Playing
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Office XP Web Components
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ Run Time Lib Setup
MobileMe Control Panel
MoodLogic
Mozilla Firefox (3.0.10)
Music Visualizer Library 1.4.00
MySpaceIM
Netflix Movie Viewer
Network Smart Capture
Nick Chase A Detective Story
Nick Chase: A Detective Story ™
NightShift Legacy: The Jaguar`s Eye
Nocturnal Boston Nightfall
NVIDIA Windows 2000/XP Display Drivers
OpenAL
OpenMG Limited Patch 3.1-02-10-22-01
OpenMG Limited Patch 3.1-02-10-23-01
OpenMG Secure Module 3.1
PicoPlayer
PicoPlayer Demo
PicoPlayerSplashScreen
PowerDVD
Q-Xpress Installer 1.1.9
QuickTime
RealArcade
Satisfashion
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Setup Wizard
Shockwave
Sims 2 Categorizer
Sims 2 Wardrobe Wrangler v1.1
Sims2Pack Clean Installer
SiS Compatible VGA V2.09s
SonicStage 1.5.05
Sony Certificate PCH
Sony DV Shared Library
Sony on Yahoo! Essentials
Steve The Sheriff
Support Actions WinXP
SupportComPatch
The Sims 2
The Sims 2 Nightlife
The Sims 2 University
Treasure Seekers - Visions of Gold FINAL 1.00
TuneUp Utilities 2008
Unicorn Castle
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VAIO Action Setup
VAIO Media 2.0
VAIO Media Installer 2.0
VAIO Media Music Server 2.0
VAIO Media Photo Server 2.0
VAIO Media Platform 2.0
VAIO Registration
VAIO Serenus Wallpaper
VAIO Support
VAIO Survey Standalone
VAIO System Information
VC80CRTRedist - 8.0.50727.762
VERITAS RecordNow
VERITAS RecordNow Update Manager
VideoLAN VLC media player 0.8.6h
Viewpoint Media Player
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WordPerfect Office 2002
Yahoo! Install Manager
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

5/6/2009 9:42:28 PM, error: Service Control Manager [7016] - The VAIO Media Photo Server (Application) service has reported an invalid current state 272.
5/6/2009 8:05:18 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference error message: The referenced assembly is not installed on your system. .
5/6/2009 8:05:18 AM, error: SideBySide [59] - Generate Activation Context failed for F:\DivxInstaller CONVERTS VIDEO\DivX\DivX Converter\Microsoft.VC80.MFC\MFC80U.DLL. Reference error message: The operation completed successfully. .
5/6/2009 8:05:18 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last Error was The referenced assembly is not installed on your system.
5/5/2009 12:59:49 AM, error: Dhcp [1002] - The IP address lease 76.29.179.233 for the Network Card with network address 00E018F9E0B8 has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
4/30/2009 6:59:31 AM, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%2" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
4/30/2009 5:45:14 AM, error: DCOM [10001] - Unable to start a DCOM Server: {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} as /. The error: "%233" Happened while starting this command: c:\PROGRA~1\mcafee.com\agent\mcagent.exe -Embedding
4/30/2009 1:04:40 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
4/30/2009 1:00:53 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
4/29/2009 8:46:09 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
4/29/2009 8:46:09 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
4/29/2009 8:46:09 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
4/29/2009 8:15:41 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
4/29/2009 12:48:59 PM, error: PlugPlayManager [11] - The device Root\LEGACY_WINIO\0000 disappeared from the system without first being prepared for removal.
4/29/2009 11:47:48 PM, error: Service Control Manager [7031] - The McAfee Real-time Scanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

==== End Of File ===========================

Edited by Maurice Naggar, 07 May 2009 - 08:52 PM.


#4 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:01:11 PM

Posted 07 May 2009 - 09:10 PM

Hello spiderlily,

I will be helping you to remove malware, going forward. This system has a rootkit infection and most likely residual Vundo. That is what I see so far. I'm going to have you start by running some special tools.
While under my guidance, please do not make changes on your own without checking with me first.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for member spiderlily only. If you are a lurker, do NOT try this on your system!
If you are not spiderlily and have a similar problem, do NOT post here; start your own topic


Do not run or start any other programs while these utilities and tools are in use!
Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=
Close any of your open programs while you run these tools.

Set Windows to show all files and all folders.
On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.
Next, un-check Hide extensions for known file types.
Next un-check Hide protected operating system files.

Take out the trash (temporary files & temporary internet files)
Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.
Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:
Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
ATF-Cleaner should be run per the above in every user-login account {User Profile}
=

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from
>>> here <<<
  • Double-click FixPolicies.exe.
  • Click the "Install" button on the bottom toolbar of the box that will open.
  • The program will create a new Folder called FixPolicies.
  • Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  • A black box will briefly appear and then close.
  • This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.
Next, Download The Avenger by Swandog46 from here.
  • Unzip/extract it to a folder on your desktop.
  • Double click on avenger.exe to run The Avenger.
  • Click OK.
  • Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  • Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.
    Files to delete:
    c:\windows\system32\ovfsthksjopayflcojndrgrislbquwodyjhknx.dat
    c:\windows\system32\ovfsthdtmnvhfiahdvwjxmnsapjcxydvsskjmm.dat
    c:\windows\system32\ovfsthgwkyrxrvtckdnwpojddtuungewqhodhr.dll
    C:\WINDOWS\system32\zugarusu.dll
    c:\windows\system32\japidahu.dll
    c:\windows\system32\autochk.dll
    c:\windows\temp\_A00FE6B77.exe
    C:\WINDOWS\system32\prnet.tmp
    C:\WINDOWS\system32\__c006BE9F.dat
    c:\windows\system32\drivers\msqpdxserv.sys 
    c:\windows\sysguard.exe
    c:\windows\system32\sdra64.exe
    
    Drivers to delete:
    ovfsthx
    ovfsthgwkyrxrvtckdnwpojddtuungewqhodhr
    A00FE6B77.exe
    _A00FE6B77.exe
    _A00FE6B77
    UACd.sys
    UACd
    gaopdxserv.sys
    gaopdxserv
    gaopdxl
    tdss
    tdssserv
    TDSSserv.SYS
    Service_TDSSSERV.SYS
    Legacy_TDSSSERV.SYS
    msqpdxserv.sys
    msqpdxserv
    
    Folders to delete:
    C:\recycler
    D:\recycler
    e:\recycler
    f:\recycler
    g:\recycler
    h:\recycler
  • In the avenger window, click the Paste Script from Clipboard icon, Posted Image button.
  • :!: Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
  • Click the Execute button.
  • You will be asked Are you sure you want to execute the current script?.
  • Click Yes.
  • You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  • Click Yes.
  • Your PC will now be rebooted.
  • Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
  • If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
  • After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.
Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.
If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.
and then reboot the system again.

This is just the beginning. There will be more to do.
Reply with copy { all IN-Line within body of textbox} of C:\Avenger.txt

Edited by Maurice Naggar, 07 May 2009 - 10:05 PM.

~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#5 spyderlily

spyderlily
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:11 PM

Posted 08 May 2009 - 09:04 PM

Here you go:

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\ovfsthksjopayflcojndrgrislbquwodyjhknx.dat" deleted successfully.
File "c:\windows\system32\ovfsthdtmnvhfiahdvwjxmnsapjcxydvsskjmm.dat" deleted successfully.
File "c:\windows\system32\ovfsthgwkyrxrvtckdnwpojddtuungewqhodhr.dll" deleted successfully.

Edited for readability and to trim out items not found. ~ Maurice



Driver "tdssserv" deleted successfully.

Folder "C:\recycler" deleted successfully.
Folder "D:\recycler" deleted successfully.
Folder "e:\recycler" deleted successfully.
Folder "f:\recycler" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Edited by Maurice Naggar, 09 May 2009 - 09:09 PM.


#6 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:01:11 PM

Posted 09 May 2009 - 09:34 PM

The Avenger run did better than I had hoped. That is good. But, we have more to do, to look for remaining malwares.
There was a rootkit infection and indications of Autorun infection too.

You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference!
These steps are for member spyderlily only. If you are a lurker, do NOT try this on your system!
If you are not spyderlily and have a similar problem, do NOT post here; start your own topic


Do not run or start any other programs while these utilities and tools are in use!
:arrow: Do NOT run any other tools on your own or do any fixes other than what is listed here.
If you have questions, please ask before you do something on your own.
But it is important that you get going on these following steps.
=
Close any of your open programs while you run these tools.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1
Link 2
Link 3

Posted Image


Posted Image


* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop
If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on Combo-Fix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

IF you should see a message like this:
Posted Image
then, be sure to write down fully and also copy that into your next reply here and then await for my response.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
-------------------------------------------------------

A caution - Do not run Combofix more than once.
Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.
If this occurs, please reboot to restore the desktop.
Even when ComboFix appears to be doing nothing, look at your Drive light.
If it is flashing, Combofix is still at work.
=

Please download & save Malwarebytes Anti-Malware from
http://www.download.com/Malwarebytes-Anti-..._4-10804572.htm or
http://www.besttechie.net/tools/mbam-setup.exe or
http://malwarebytes.gt500.org/mbam.jsp

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Quick Scan, then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy & Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


=
You will want to print out or copy these instructions to Notepad for Safe Mode/offline reference! Perhaps also save the file on your pc.

Close all browsers and all open windows & programs.

1. Please download SmitfraudFix (by S!Ri) and SAVE it to your Desktop.
Posted ImageIt's very important that you be using the most recent version (v2.416 as of this post).

2. Reboot into Safe Mode (Restart your computer, then continually tap F8 until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter. More at http://service1.symantec.com/SUPPORT/tsgen...001052409420406.)

3. Once in Safe Mode:
Double click the SmitFruadfix.exe file. It will create a folder named SmitfraudFix) on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Have plenty of patience as a Command prompt window opens. You'll eventually see a message and a "press any key to continue".
Press the space bar or any other key on the keyboard.

4. Select option #2 - Clean by typing 2 and pressing Enter to delete infected files.

5. You will be prompted: "Registry cleaning - Do you want to clean the registry ?" Answer "Yes" by typing Y and pressing Enter in order to remove the desktop background and clean registry keys associated with the infection.

6. The tool will then check if wininet.dll is infected. If prompted to replace the infected file (if found), answer "Yes" by typing Y and pressing Enter.

7. The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.

8. A text file will appear onscreen with results from the cleaning process. Please copy/paste the content of that report into your next reply.

The report also may be found at the root of the system drive, usually at C:\rapport.txt

Notes:
  • process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. More on this at http://www.beyondlogic.org/consulting/proc...processutil.htm
  • Running option #2 on a non-infected computer will remove your Desktop background. No need to worry, you were infected
=
Place your USB flash drives in-place so that some of these programs will be able to find them.

I'm going to have you get and run two utilities.
The first stops automatic use of the AutoRun feature of XP. The second will write to any connected devices a Read-only, System protected Autorun.inf file on all of your hard drives, and all connected removable storage devices.

Download and Install Microsoft's TweakUI:
http://www.microsoft.com/windowsxp/downloa...ppowertoys.mspx
Obtain and install TweakUI (part of the PowerToys for Windows XP package), and then start TweakUI.
Expand the My Computer branch, then the AutoPlay branch, and then select Drives.
Turn off the checkbox next to every drive letter to disable AutoPlay -- except your CD/DVD drive letters.

Download and run "Flash Drive Disinfector" by sUBs. It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
http://download.bleepingcomputer.com/sUBs/...Disinfector.exe
There is no GUI interface or log file produced.
=

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
  • Double-click on cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
  • Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan tab" and UNcheck "Heuristic analysis"
  • Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
  • Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
  • When done, a message will be displayed at the bottom advising if any viruses were found.
  • Click "Yes to all" if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable". (This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
  • Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
RE-Enable your AntiVirus and AntiSpyware applications.

Reply back with copy of
  • C:\Combofix.txt,
  • the MBAM report,
  • C:\rapport.txt from SmitFraudFix run,
  • the DrWeb.csv report
  • and, Tell me, How is your system now ?
Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You'll likely have to do more than 1 reply.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)

#7 spyderlily

spyderlily
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:11 PM

Posted 13 May 2009 - 06:11 PM

ComboFix 09-05-12.04 - Leah 05/12/2009 19:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1024.640 [GMT -4:00]
Running from: c:\documents and settings\Leah\Desktop\Combo-Fix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Leah\Application Data\.#
c:\documents and settings\Leah\Application Data\.#\MBX@978@384150.###
c:\documents and settings\Leah\Application Data\.#\MBX@978@384180.###
c:\documents and settings\Leah\Application Data\.#\MBX@978@3841B0.###
c:\documents and settings\Leah\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Leah\Start Menu\Programs\Startup\ChkDisk.lnk
c:\documents and settings\Renee\Application Data\.#
c:\documents and settings\Renee\Start Menu\Programs\Startup\ChkDisk.lnk
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\wpcap.dll
c:\windows\system32\wrftykwk.ini
c:\windows\system32\ycxdilxv.ini
C:\xcrashdump.dat
F:\Shortcut to PRAYBK.pif

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IWINGAMESINSTALLER
-------\Legacy_TDSSSERV
-------\Service_iWinGamesInstaller
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2009-04-12 to 2009-05-12 )))))))))))))))))))))))))))))))
.

2009-05-12 00:46 . 2009-05-12 00:46 -------- d-----w c:\program files\Ice Cream Craze Tycoon Takeover
2009-05-10 20:00 . 2009-05-10 20:00 102848 ----a-w c:\documents and settings\Leah\Application Data\GDIPFONTCACHEV1.DAT
2009-05-10 00:37 . 2009-05-10 00:37 -------- d-----w c:\documents and settings\All Users\Application Data\QuickClick
2009-05-07 11:51 . 2009-05-07 11:51 -------- d-----w c:\documents and settings\Renee\Application Data\AdobeUM
2009-04-30 17:19 . 2009-04-30 17:19 -------- d-----w c:\program files\iPod
2009-04-30 17:19 . 2009-04-30 17:20 -------- d-----w c:\program files\iTunes
2009-04-30 00:41 . 2009-04-30 00:41 -------- d-----w c:\program files\Enigma Software Group
2009-04-27 22:45 . 2009-04-27 22:45 -------- d-----w c:\program files\ConvertHelper
2009-04-27 21:19 . 2009-04-27 21:19 -------- d-----w c:\documents and settings\All Users\Application Data\Alawar Stargaze
2009-04-27 21:13 . 2009-04-27 21:13 -------- d-----w c:\windows\Fashion Season
2009-04-25 14:50 . 2009-04-25 14:56 -------- d-----w c:\windows\system32\NtmsData
2009-04-25 01:05 . 2009-04-25 01:05 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-25 00:39 . 2009-04-25 00:39 -------- d-----w c:\program files\Trend Micro
2009-04-19 02:37 . 2009-04-19 02:37 -------- d-----w c:\documents and settings\Leah\Application Data\AdobeUM
2009-04-18 13:13 . 2009-04-18 13:13 -------- d-sh--w c:\documents and settings\Renee\PrivacIE
2009-04-18 13:11 . 2009-04-18 13:11 -------- d-sh--w c:\documents and settings\Renee\IETldCache
2009-04-18 06:07 . 2009-04-18 06:07 -------- d-----w c:\windows\system32\XPSViewer
2009-04-18 06:06 . 2009-04-18 06:06 -------- d-----w c:\program files\MSBuild
2009-04-18 06:06 . 2009-04-18 06:06 -------- d-----w c:\program files\Reference Assemblies
2009-04-18 06:06 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-04-18 06:06 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-18 06:06 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-18 06:06 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-18 06:06 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-04-18 06:06 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-04-18 06:06 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-04-18 05:53 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-18 05:53 . 2009-02-06 10:39 35328 -c----w c:\windows\system32\dllcache\sc.exe
2009-04-18 05:53 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-18 05:53 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-18 05:53 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-18 05:53 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-18 05:53 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-18 05:53 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-04-18 05:53 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-18 05:53 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-18 05:52 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-18 05:52 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-18 05:45 . 2009-04-18 05:45 -------- d-sh--w c:\documents and settings\Leah\PrivacIE
2009-04-18 05:44 . 2009-04-18 05:44 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache
2009-04-18 05:43 . 2009-04-18 05:43 -------- d-sh--w c:\documents and settings\Leah\IETldCache
2009-04-18 05:38 . 2008-04-14 00:11 81920 ----a-w c:\windows\system32\ieencode.dll
2009-04-18 05:38 . 2007-08-13 22:45 78336 ----a-w c:\windows\system32\dllcache\ieencode.dll
2009-04-16 00:13 . 2009-04-16 00:13 -------- d-----w c:\documents and settings\Leah\Application Data\Skunk Studios
2009-04-15 23:44 . 2009-04-15 23:44 -------- d-----w c:\windows\Flux Family Secrets - The Ripple Effect
2009-04-14 22:38 . 2009-04-14 23:56 -------- d-----w c:\documents and settings\Renee\Application Data\Lost in the City
2009-04-14 17:21 . 2009-04-14 17:21 -------- d-----w c:\documents and settings\Renee\Application Data\Skunk Studios

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-30 17:19 . 2008-06-30 00:52 -------- d-----w c:\program files\Common Files\Apple
2009-04-30 17:19 . 2002-12-05 22:46 -------- d-----w c:\program files\QuickTime
2009-04-23 03:21 . 2008-06-15 23:26 102848 ----a-w c:\documents and settings\Renee\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 11:42 . 2009-02-14 11:34 102848 ----a-w c:\documents and settings\Renee\Application Data\GDIPFONTCACHEV1.DAT
2009-04-20 23:17 . 2008-06-15 19:48 102848 ----a-w c:\documents and settings\Leah\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 01:47 . 2008-06-10 03:43 -------- d-----w c:\program files\McAfee
2009-04-16 03:35 . 2008-07-19 02:23 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-15 20:25 . 2002-10-21 06:02 43528 ------w c:\windows\system32\drivers\pxhelp20.sys
2009-04-15 00:13 . 2008-06-19 02:01 -------- d-----w c:\program files\Java
2009-04-14 12:32 . 2009-04-05 20:27 -------- d-----w c:\program files\Yahoo! Games
2009-04-10 13:54 . 2009-04-10 13:54 -------- d-----w c:\program files\Veoh Networks
2009-04-09 03:57 . 2002-12-17 23:18 -------- d-----w c:\program files\Common Files\Adobe
2009-04-06 19:32 . 2008-07-19 02:23 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 19:32 . 2008-07-19 02:23 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-05 23:48 . 2008-08-10 13:18 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-15 00:18 . 2008-06-19 02:24 -------- d-----w c:\program files\iWin.com
2009-03-15 00:15 . 2002-12-05 18:46 -------- d-----w c:\program files\Sony
2009-03-15 00:15 . 2002-12-05 18:44 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-09 09:19 . 2008-12-11 00:06 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2002-12-05 01:15 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-06 03:59 . 2009-03-17 02:46 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-06 03:59 . 2008-12-20 18:51 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2008-06-17 00:22 . 2008-06-17 00:22 0 ----a-w c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-31 28672]
"ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
"ZTgServerSwitch"="c:\program files\support.com\client\lserver\server.vbs" [2002-07-14 11406]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-11 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2002-10-18 87751]
"CTHelper"="CTHELPER.EXE" - c:\windows\system32\cthelper.exe [2002-11-08 24576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SetDefaultMidi"="MIDIDEF.EXE" - c:\windows\mididef.exe [2002-03-01 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-26 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
VAIO Action Setup (Server).lnk - c:\program files\Sony\VAIO Action Setup\VAServ.exe [2002-12-5 40960]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StyleXPService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\support.com\\client\\bin\\tgcmd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\EA Games\\American McGee's Alice Demo\\alice.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcsysmon.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\My Documents\\My Music\\iTunes\\iTunes Music\\ABA3.exe"=
"f:\\My Documents\\My Music\\iTunes\\iTunes Music\\webupdater.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/25/2008 12:50 AM 24652]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2009-05-12 c:\windows\Tasks\1-Click Maintenance.job
- e:\program files\OneClickStarter.exe [2008-02-29 19:24]

2009-05-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-10 17:32]

2009-05-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-06-10 17:32]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-SiS KHooker - c:\windows\System32\khooker.exe
HKLM-Run-CleanupProgram - c:\sonysys\cleanup.exe
HKU-Default-Run-A00FE6B77.exe - c:\windows\TEMP\_A00FE6B77.exe


.
------- Supplementary Scan -------
.
uStart Page = www.google.com
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - f:\progra~1\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {4DCA1E08-4147-4A3D-8CA6-E095DF189FAB} - hxxp://games.bigfishgames.com/en_nightshift-legacy-the-jaguars-eye/online/Nightshift2Web.1.0.0.9.cab
DPF: {6C7CAD20-85AA-475A-AC0D-303C4A9A69CE} - hxxp://games.bigfishgames.com/en_great-chocolate-chase/online/greatchocolatechaseweb.1.0.0.12.cab
DPF: {74EF5274-F439-2168-B543-14745B625C72} - hxxp://www.gamehouse.com/realarcade-webgames/weddingdash2/WeddingDash2.cab
DPF: {8DB0B6FB-914F-41DE-B89E-35D80F378640} - hxxp://kraisoft.com/files/online/abcisland.cab
DPF: {935F9B04-0C7B-4454-A391-348C54AD7ADD} - hxxp://www.gamehouse.com/realarcade-webgames/bcasydney/JBGamePlayer.cab
DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} - hxxp://www.gamehouse.com/realarcade-webgames/burgershop/GoBitGamesPlayer.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://www.gamehouse.com/realarcade-webgames/zylom/zylomplayer.cab
DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} - hxxp://myspace.oberon-media.com/gameshell/games/channel--110343720/lc--en/room--79bbc769-d6b3-48cf-87c5-2a1592a3d0b1/online/sandscript/en/SandScript.1.0.0.21.cab
FF - ProfilePath - c:\documents and settings\Leah\Application Data\Mozilla\Firefox\Profiles\dw505hfc.default\
FF - prefs.js: browser.search.selectedEngine - qtl
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?rls=ig&hl=en&source=iglk
FF - plugin: c:\documents and settings\Leah\Application Data\Mozilla\Firefox\Profiles\dw505hfc.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07061050.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-12 19:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\??????Z????`??Z???Z`??Z???????????????Z???Z???Z???Z$??????Z???????????????Z???????????Z???w????(????3?w???w?????3?w ??w???Z:???????d???r??Z1??Z???Zd??????Z?-?Z????z??w8h?Z\2?Z?1?Zhtinst.INI?Z?u?Z????d???????0G?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2452)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files\McAfee\VirusScan\Mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Sony\VAIO Media Music Server\SSSvr.exe
c:\program files\Sony\Photo Server 20\appsrv\PicAppSrv.exe
c:\program files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
c:\program files\Common Files\Sony Shared\VAIO Media Platform\sv_httpd.exe
c:\windows\system32\wscript.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\support.com\client\bin\tgcmd.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2009-05-12 19:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-12 23:52

Pre-Run: 2,769,596,416 bytes free
Post-Run: 4,856,147,968 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /TUTag=N7K0QU /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition (TuneUp Backup)" /fastdetect /NoExecute=OptIn /TUTag=N7K0QU-BAK

269 --- E O F --- 2009-04-19 01:30

---------------------------------------------------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.36
Database version: 2118
Windows 5.1.2600 Service Pack 3

5/12/2009 8:02:47 PM
mbam-log-2009-05-12 (20-02-47).txt

Scan type: Quick Scan
Objects scanned: 93155
Time elapsed: 4 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

--------------------------------------------------------------------------------------------------------------------------------------

SmitFraudFix v2.416

Scan done at 20:16:08.10, Tue 05/12/2009
Run from C:\Documents and Settings\Leah\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{161084DA-FDF4-4B3E-A37A-765F5045EF7C}: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196
HKLM\SYSTEM\CS1\Services\Tcpip\..\{161084DA-FDF4-4B3E-A37A-765F5045EF7C}: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196
HKLM\SYSTEM\CS2\Services\Tcpip\..\{161084DA-FDF4-4B3E-A37A-765F5045EF7C}: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=68.87.68.162 68.87.74.162 68.87.64.196


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK.2



»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

---------------------------------------------------------------------------------------------------------------------------------------

Dr. Web:

-SmitfraudFix.exe\SmitfraudFix\Process.exe;C:\Documents and Settings\Leah\Desktop\SmitfraudFix.exe;Tool.Prockill;;
-SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Documents and Settings\Leah\Desktop\SmitfraudFix.exe;Tool.ShutDown.14;;
-SmitfraudFix.exe;C:\Documents and Settings\Leah\Desktop;Archive contains infected objects;;
-Process.exe;C:\Documents and Settings\Leah\Desktop\SmitfraudFix;Tool.Prockill;;
-restart.exe;C:\Documents and Settings\Leah\Desktop\SmitfraudFix;Tool.ShutDown.14;;
-0C5F4A29d01\SmitfraudFix\Process.exe;C:\Documents and Settings\Leah\Local Settings\Application Data\Mozilla\Firefox\Profiles\dw505hfc.default\Cache\0C5F4A29d01;Tool.Prockill;;
-0C5F4A29d01\SmitfraudFix\restart.exe;C:\Documents and Settings\Leah\Local Settings\Application Data\Mozilla\Firefox\Profiles\dw505hfc.default\Cache\0C5F4A29d01;Tool.ShutDown.14;;
-0C5F4A29d01;C:\Documents and Settings\Leah\Local Settings\Application Data\Mozilla\Firefox\Profiles\dw505hfc.default\Cache;Archive contains infected objects;;
-03 - Possess The Land.mp3;C:\Documents and Settings\Renee\My Documents\Marvin Sapp - -Thirsty;Trojan.WMALoader;Cured.;
-nppopcaploader.dll;C:\Program Files\Mozilla Firefox\plugins;Program.PopcapLoader.origin;;
-A0043925.exe\MSetup.exe;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP372\A0043925.exe;Trojan.Inject.3839;;
-A0043925.exe;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP372;Archive contains infected objects;;
-A0045486.EXE;C:\System Volume Information\_restore{39B55467-8C7E-46C6-B32A-C58455643C25}\RP392;Program.PsExec.170;;
-Amazing Adventures The Lost Tomb.exe;D:\Cracked Games\Amazing Adventures-The Lost Tomb [Popcap] -akashneo;Adware.Rabio;;
-pv.exe;D:\Documents and Settings\Administrator\Desktop\smitRem;Program.PrcView.3741;;
-frostymindV2free.exe\data049;D:\Documents and Settings\Carolyn\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Adware.SaveNow;;
-frostymindV2free.exe\data050;D:\Documents and Settings\Carolyn\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Adware.NewDotNet;;
-frostymindV2free.exe\data052;D:\Documents and Settings\Carolyn\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Trojan.AVKill.230;;
-frostymindV2free.exe\data053;D:\Documents and Settings\Carolyn\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Trojan.AVKill.229;;
-frostymindV2free.exe;D:\Documents and Settings\Carolyn\Desktop\Unused Desktop Shortcuts;Archive contains infected objects;;
-SlgClientServicesRedists.exe\data002;D:\Program Files\eGames\Cake Mania Deluxe\Base Game\SlgClientServicesRedists.exe;Adware.SpywareStorm;;
-SlgClientServicesRedists.exe;D:\Program Files\eGames\Cake Mania Deluxe\Base Game;Archive contains infected objects;;
-SlgClientServicesRedists.exe\data002;D:\Program Files\eGames\Cake Mania Deluxe\Expansion Pack\SlgClientServicesRedists.exe;Adware.SpywareStorm;;
-SlgClientServicesRedists.exe;D:\Program Files\eGames\Cake Mania Deluxe\Expansion Pack;Archive contains infected objects;;
-Uninstall.exe;D:\Program Files\PopCap Games\PopCap Browser Plugin;Program.PopcapLoader.origin;;
-A0116506.reg;D:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP618;Trojan.StartPage.1505;Deleted.;
-server1.exe;D:\WINDOWS;Trojan.Packed.650;Deleted.;
-favset.exe;D:\WINDOWS\system32;Trojan.Favadd;Deleted.;
-svchhost.exe;D:\WINDOWS\system32;Trojan.Packed.650;Deleted.;
-03 - Possess The Land.mp3;E:\0 Audio\Marvin Sapp - Thirsty;Trojan.WMALoader;Cured.;
-Amazing Adventures The Lost Tomb.exe;E:\0 Cracked Games\Amazing Adventures-The Lost Tomb [Popcap] -akashneo;Adware.Rabio;;
-smitRem.exe\smitRem/Process.exe;E:\0 STUFF\smitRem.exe;Tool.Prockill;;
-smitRem.exe\smitRem/pv.exe;E:\0 STUFF\smitRem.exe;Program.PrcView.3741;;
-smitRem.exe;E:\0 STUFF;Archive contains infected objects;;
-smitRem.exe\smitRem/Process.exe;E:\Desktop\stuff\smitRem.exe;Tool.Prockill;;
-smitRem.exe\smitRem/pv.exe;E:\Desktop\stuff\smitRem.exe;Program.PrcView.3741;;
-smitRem.exe;E:\Desktop\stuff;Archive contains infected objects;;
-dap53.exe/data022\dapbho.dll;E:\My Documents\download\dap53.exe/data022;Adware.Speedbit;;
-data022;E:\My Documents\download;Archive contains infected objects;;
-dap53.exe;E:\My Documents\download;Archive contains infected objects;;
-frostymindV2free.exe\data049;F:\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Adware.SaveNow;;
-frostymindV2free.exe\data050;F:\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Adware.NewDotNet;;
-frostymindV2free.exe\data052;F:\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Trojan.AVKill.230;;
-frostymindV2free.exe\data053;F:\Desktop\Unused Desktop Shortcuts\frostymindV2free.exe;Trojan.AVKill.229;;
-frostymindV2free.exe;F:\Desktop\Unused Desktop Shortcuts;Archive contains infected objects;;

Yeesh, that was a lot of stuff to do!

#8 spyderlily

spyderlily
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:02:11 PM

Posted 13 May 2009 - 08:09 PM

Yay! My searches aren't getting redirected anymore! :thumbup2:

#9 Maurice Naggar

Maurice Naggar

    Eradicator de malware


  • Malware Response Team
  • 1,088 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:01:11 PM

Posted 14 May 2009 - 08:00 PM

This system had some Vundo as well as rootkit infection & autorun infection as well.

What I am really amazed at is the amount of HD space freed up after the Combofix run. You gained a very large amount of space. :thumbup2:

Pre-Run: 2,769,596,416 bytes free


Post-Run: 4,856,147,968 bytes free



Unless you have purchased Malwarebytes' Anti Malware {MBAM}, you need to un-install it. Go to Control Panel and Add-or-Remove programs.
Look for it and click the line for it. Select Change/Remove to de-install it.
De-install your Adobe Reader.
OK & Exit out of Control Panel

Get the Adobe Reader latest version from http://www.adobe.com/products/acrobat/readstep2.html
=
Get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm

Steps to follow for the MVP Hosts file:
1) Download and SAVE the zip file to a temporary folder
2) Unzip (extract the contents) in the same folder
3) After extract is complete, run mvps.bat batch file. This copies your pre-existing Hosts file to Hosts.mvp in the folder where Windows' Hosts resides
typically, C:\WINDOWS\system32\drivers\etc

and after that copy is saved, it replaces the old Hosts with the new one.

And you should see (in the blue background command window) the following:

_________________________________________________
¦ +---+¦
¦ THE MVPS HOSTS FILE IS NOW UPDATED ¦ v ¦¦
¦ +---+¦
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Previous version saved and renamed to HOSTS.MVP
Press any key to continue . . .


Find the folder where you saved the original download. Delete hosts.zip and a file folder there named hosts
The latter is the same folder that had mvps.bat
=

I see that you are clear of your original issues.
If you have a problem with these steps, or something does not quite work here, do let me know.

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders. By whichever name you named it, ( you had named it combo-fix ), put that name in the RUN box stated just below. The "/u" in the Run line below is to start Combofix for it's cleanup & removal function.
The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.
  • Click Start, then click Run.

    In the command box that opens, type or copy/paste combo-fix /u and then click OK.
  • Download OTListIt by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTListIt2.exe
  • Please double-click OTListIt2.exe to run it.
  • Click on the CleanUp! button. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTListIt2 attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
  • This step removes the files, folders, and shortcuts created by the tools I had you download and run.
I do highly encourage you to start McAfee, be sure it updates, and then do a full scan of the system ! Do that right away.
We are finished here. Best regards.
~Maurice Naggar
MS-MVP (Oct 2002 - Sept 2010)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users