UNSOLVED
Need help removing virtumonde trojans and adware advertising problems
hello, when i run spyware doctor i get infections that dont delete with fix button/rebooting. they have the following names adaware.advertising, spyware.Rogue_antispyware_products, trojan-downloader.injecter, and trojan.virtumonde. computer has no problem starting or shutting down. using the internet is on off in that it stutters then is fast then stutters, etc. ive run search and destroy as well and same result. and if a combofix log file helps i have that too upon request. i also have my express service code if u need to see the specs of my computer. thanx for youre time i hope to hear back from you.
my hijackthis.txt file is as follows:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:30:15 AM, on 16/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\AOL\1159063441\ee\aolsoftware.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spyware Doctor\pctsGui.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - Startup: Registration RAYMAN
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA2C5A08-D382-4B42-A5ED-966500DDBF1D}: NameServer = 68.87.72.130,68.87.77.130,68.87.66.196
O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Norton Ghost - Unknown owner - C:\Program Files\Norton Ghost\Agent\VProSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 10380 bytes
1077
0
Posted February 16th, 2009 09:00
no i didnt run it i have the exe incase u need me to obtain the log file for you.
1077
0
Posted February 16th, 2009 11:00
while searching online on how to remove the malware i came across sites citing that it worked then i downloaded it before reading the do not use unless authorized to do so disclaimer. it is sitting on my desktop.
1077
0
Posted February 16th, 2009 11:00
Who advised you to download ComboFix? Where is the exe located on your computer?
1077
0
Posted February 16th, 2009 14:00
Please delete the copy on your desktop. It updates frequently so if we need to use it, I will have you use the most current copy downloaded from a source that has been approved by the developer of the tool.
We'll need to disable Spyware Doctor so it does not interfere with any of our procedures.
To disable Spyware Doctor from running on your system startup:
1. First, disable the OnGuard Tools. This way, when you exit Spyware Doctor, these tools won't stay resident in the background.
2. Click the "Settings" button on the left side.
3. Click the "Startup Settings" link.
4. Uncheck "Run at Windows Startup".
5. Click the "Apply" button. Exit by a right-click on the "Spyware Doctor" icon in the system tray and choose "Exit".
[To enable Spyware Doctor when you are finished, open the program, Settings>Startup Settings> CHECK "Run at Windows Startup">APPLY Exit. Reboot.] To disable PCTools Browser Monitor: If you are running Internet Explorer, click Tools > Manage Add-ons.
If PCTools Browser Monitor is on the list, click it & select Disable. You will need to restart your browser after making the change.
We need to see some additional information about what is happening in your machine.
- Download DDS by sUBs from one of the following links. Save it to your desktop.
- Double click on the DDS icon, allow it to run.
- A small box will open, with an explanation about the tool.
- Click Yes at the prompt for Optional Scan.
- When done, DDS will open two (2) logs
1. DDS.txt
2. Attach.txt- Save both reports to your desktop.
- Copy/paste both logs to your reply on the forum.
- Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.
1077
0
Posted February 16th, 2009 15:00
dds log file:-----------------------------------------------
DDS (Ver_09-02-01.01) - NTFSx86
Run by Daniel Urquizo at 17:41:40.01 on 16/02/2009
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1361 [GMT -6:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\AOL\1159063441\ee\aolsoftware.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Razer\Lachesis\OSD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Razer\Lachesis\razertra.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Daniel Urquizo\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: {054240e0-5631-4b28-9158-e998610b1108} - c:\windows\system32\qoMcaxVm.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\pmnnMcAt.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {81501349-13df-263b-afe4-9e22d8f6cdae}: {eadc6f8d-22e9-4efa-b362-fd3194310518} - c:\windows\system32\qppfth.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
mRun: [DLCFCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCFtime.dll,_RunDLLEntry@16
mRun: [IPHSend] c:\program files\common files\aol\iphsend\IPHSend.exe
mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall
mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE
mRun: [Network Associates Error Reporting Service] "c:\program files\common files\network associates\talkback\TBMon.exe"
mRun: [Lachesis] c:\program files\razer\lachesis\razerhid.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [187cf23f] rundll32.exe "c:\windows\system32\mnvcikgm.dll",b
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
TCP: {DA2C5A08-D382-4B42-A5ED-966500DDBF1D} = 68.87.72.130,68.87.77.130,68.87.66.196
Notify: igfxcui - igfxdev.dll
Notify: pmnnMcAt - pmnnMcAt.dll
AppInit_DLLs: qppfth.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\pmnnMcAt.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\qoMcaxVm
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\daniel~1\applic~1\mozilla\firefox\profiles\zvomyh0l.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.uiuc.edu/
FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
FF - plugin: c:\documents and settings\daniel urquizo\application data\mozilla\firefox\profiles\zvomyh0l.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
============= SERVICES / DRIVERS ===============
R0 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-2-16 40840]
R1 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-2-16 66952]
R1 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-2-16 81288]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2006-12-29 59904]
R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-1-15 204800]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2006-12-29 98304]
R2 McShield;Network Associates McShield;c:\program files\network associates\virusscan\Mcshield.exe [2007-11-26 221191]
R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\VsTskMgr.exe [2007-11-26 29184]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-2-16 356920]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-11-13 24652]
R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-10-11 12032]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2006-12-29 117024]
S3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2006-8-23 91841]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-2-16 1079176]
S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\Usbicp.sys [2008-10-11 14592]
=============== Created Last 30 ================
2009-02-16 17:35 120 ---sh--- c:\windows\system32\mgkicvnm.ini
2009-02-16 11:11 72,704 a------- c:\windows\system32\mnvcikgm.dll
2009-02-16 11:08 129,024 a------- c:\windows\system32\qppfth.dll
2009-02-16 11:08 129,024 a------- c:\windows\system32\ovqkiwma.dll
2009-02-16 11:08 45,363 a--sh--- c:\windows\system32\mVxacMoq.ini2
2009-02-16 11:08 45,363 a--sh--- c:\windows\system32\mVxacMoq.ini
2009-02-16 11:08 302,592 a------- c:\windows\system32\qoMcaxVm.dll
2009-02-16 11:03 40,614 a------- c:\windows\system32\pmnlMEVp.dll
2009-02-16 06:18 30,630 a--sh--- c:\windows\system32\AdNnmnmp.ini
2009-02-16 06:18 30,593 a--sh--- c:\windows\system32\AdNnmnmp.ini2
2009-02-16 04:56 129,024 a------- c:\windows\system32\dwrsfodn.dll
2009-02-16 04:56 32,025 a--sh--- c:\windows\system32\loVCffii.ini2
2009-02-16 04:56 32,025 a--sh--- c:\windows\system32\loVCffii.ini
2009-02-16 04:29--d----- c:\program files\Trend Micro
2009-02-16 03:57 2,160 a--sh--- c:\windows\system32\bJlnqtwa.ini2
2009-02-16 03:57 2,160 a--sh--- c:\windows\system32\bJlnqtwa.ini
2009-02-16 03:49a-dshr-- C:\cmdcons
2009-02-16 03:48 161,792 a------- c:\windows\SWREG.exe
2009-02-16 03:48 98,816 a------- c:\windows\sed.exe
2009-02-16 01:28 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2009-02-16 01:28 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2009-02-16 01:28 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys
2009-02-16 01:28 29,576 a------- c:\windows\system32\drivers\kcom.sys
2009-02-16 01:28--d----- c:\program files\Spyware Doctor
2009-02-16 01:28--d----- c:\docume~1\daniel~1\applic~1\PC Tools
2009-02-15 15:09 36,352 -------- c:\windows\system32\pmnnMcAt.dll
2009-02-11 22:57--d----- c:\program files\SystemRequirementsLab
2009-02-11 20:43--d----- c:\program files\GameSpy Arcade
2009-02-11 20:16--d----- C:\NVIDIA
2009-02-11 19:56--d----- c:\program files\EA GAMES
2009-02-11 18:31--d----- c:\windows\pss
2009-02-09 13:09 172,032 a------- c:\windows\system32\igfxres.dll
2009-02-08 21:01--d----- c:\docume~1\alluse~1\applic~1\Electronic Arts
2009-02-08 20:56--d----- C:\ProgramData
2009-02-08 18:59--d----- c:\program files\common files\EasyInfo
2009-02-05 01:22--d----- c:\program files\AIM6
2009-01-17 22:10--d----- c:\docume~1\daniel~1\applic~1\Research In Motion
2009-01-17 22:09 256 a------- c:\windows\system32\pool.bin
2009-01-17 21:54--d----- c:\program files\Roxio
2009-01-17 21:49 26,496 a----r-- c:\windows\system32\drivers\RimSerial.sys
2009-01-17 21:48--d----- c:\docume~1\daniel~1\applic~1\Blackberry Desktop
2009-01-17 21:47--d----- c:\program files\common files\Research In Motion
2009-01-17 21:47--d----- c:\program files\Research In Motion
==================== Find3M ====================
2009-02-14 20:14 138,376 a------- c:\windows\system32\drivers\PnkBstrK.sys
2009-02-14 20:14 202,448 a------- c:\windows\system32\PnkBstrB.exe
2008-12-14 15:27 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-11 04:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-11-25 06:20 737,280 a------- c:\windows\iun6002.exe
2008-08-30 00:12 1,740 a------- c:\program files\Adobe Reader 7.0.lnk
2007-03-04 23:50 56 ---shr-- c:\windows\system32\308BCB10B7.sys
2008-06-04 07:09 88 ---shr-- c:\windows\system32\B710CB8B30.sys
2008-06-04 07:09 4,652 a--sh--- c:\windows\system32\KGyGaAvL.sys
============= FINISH: 17:42:30.70 ===============attach log file:--------------------------------------------------------------
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-02-01.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 15/08/2006 6:27:14 PM
System Uptime: 16/02/2009 5:33:19 PM (0 hours ago)
Motherboard: Dell Inc. | | 0KD882
Processor: Genuine Intel(R) CPU T1350 @ 1.86GHz | Microprocessor | 1862/133mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 53 GiB total, 24.673 GiB free.
D: is FIXED (NTFS) - 17 GiB total, 12.387 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: WAN Miniport (ATW)
Device ID: ROOT\NET\0000
Manufacturer: America Online, Inc.
Name: WAN Miniport (ATW)
PNP Device ID: ROOT\NET\0000
Service: wanatw
==== System Restore Points ===================
RP165: 16/02/2009 4:56:32 AM - System Checkpoint
RP166: 16/02/2009 4:56:32 AM - System Checkpoint
RP167: 16/02/2009 4:56:32 AM - System Checkpoint
RP168: 16/02/2009 4:56:32 AM - System Checkpoint
RP169: 16/02/2009 4:56:32 AM - System Checkpoint
RP170: 16/02/2009 4:56:32 AM - Software Distribution Service 3.0
RP171: 16/02/2009 4:56:32 AM - System Checkpoint
RP172: 16/02/2009 4:56:32 AM - System Checkpoint
RP173: 16/02/2009 4:56:32 AM - System Checkpoint
RP174: 16/02/2009 4:56:32 AM - Installed Java(TM) 6 Update 11
RP175: 16/02/2009 4:56:32 AM - System Checkpoint
RP176: 16/02/2009 4:56:32 AM - Installed Black & White 2
RP177: 16/02/2009 4:56:32 AM - Software Distribution Service 3.0
RP178: 16/02/2009 4:56:32 AM - System Checkpoint
RP179: 16/02/2009 4:56:32 AM - System Checkpoint
RP180: 16/02/2009 4:56:32 AM - System Checkpoint
RP181: 16/02/2009 4:56:32 AM - System Checkpoint
RP182: 16/02/2009 4:56:32 AM - System Checkpoint
RP183: 16/02/2009 4:56:32 AM - System Checkpoint
RP184: 16/02/2009 4:56:32 AM - System Checkpoint
RP185: 16/02/2009 4:56:32 AM - System Checkpoint
RP186: 16/02/2009 4:56:32 AM - System Checkpoint
RP187: 16/02/2009 4:56:32 AM - System Checkpoint
RP188: 16/02/2009 4:56:32 AM - System Checkpoint
RP189: 16/02/2009 4:56:32 AM - System Checkpoint
RP190: 16/02/2009 4:56:32 AM - System Checkpoint
RP191: 16/02/2009 4:56:32 AM - System Checkpoint
RP192: 16/02/2009 4:56:35 AM - System Checkpoint
RP193: 16/02/2009 4:56:35 AM - System Checkpoint
RP194: 16/02/2009 4:56:35 AM - System Checkpoint
RP195: 16/02/2009 4:56:35 AM - System Checkpoint
RP196: 16/02/2009 4:56:35 AM - System Checkpoint
RP197: 16/02/2009 4:56:35 AM - System Checkpoint
RP198: 16/02/2009 4:56:35 AM - System Checkpoint
RP199: 16/02/2009 4:56:35 AM - Software Distribution Service 3.0
RP200: 16/02/2009 4:56:35 AM - System Checkpoint
RP201: 16/02/2009 4:56:35 AM - System Checkpoint
RP202: 16/02/2009 4:56:35 AM - System Checkpoint
RP203: 16/02/2009 4:56:35 AM - Installed BlackBerry Desktop Software 4.2.2.
RP204: 16/02/2009 4:56:35 AM - Installed Roxio Media Manager
RP205: 16/02/2009 4:56:35 AM - System Checkpoint
RP206: 16/02/2009 4:56:35 AM - System Checkpoint
RP207: 16/02/2009 4:56:35 AM - System Checkpoint
RP208: 16/02/2009 4:56:35 AM - System Checkpoint
RP209: 16/02/2009 4:56:35 AM - System Checkpoint
RP210: 16/02/2009 4:56:35 AM - System Checkpoint
RP211: 16/02/2009 4:56:35 AM - System Checkpoint
RP212: 16/02/2009 4:56:35 AM - System Checkpoint
RP213: 16/02/2009 4:56:35 AM - System Checkpoint
RP214: 16/02/2009 4:56:35 AM - System Checkpoint
RP215: 16/02/2009 4:56:35 AM - System Checkpoint
RP216: 16/02/2009 4:56:35 AM - System Checkpoint
RP217: 16/02/2009 4:56:35 AM - System Checkpoint
RP218: 16/02/2009 4:56:35 AM - System Checkpoint
RP219: 16/02/2009 4:56:37 AM - System Checkpoint
RP220: 16/02/2009 4:56:37 AM - System Checkpoint
RP221: 16/02/2009 4:56:37 AM - System Checkpoint
RP222: 16/02/2009 4:56:37 AM - System Checkpoint
RP223: 16/02/2009 4:56:37 AM - System Checkpoint
RP224: 16/02/2009 4:56:37 AM - Installed Rayman Raving Rabbids
RP225: 16/02/2009 4:56:37 AM - Installed Battlefield 2142
RP226: 16/02/2009 4:56:37 AM - Installed DirectX
RP227: 16/02/2009 4:56:37 AM - Installed Battlefield 2142 Update v1.40
RP228: 16/02/2009 4:56:37 AM - Removed Battlefield 2142
RP229: 16/02/2009 4:56:38 AM - Installed Battlefield 2142
RP230: 16/02/2009 4:56:38 AM - Installed DirectX
RP231: 16/02/2009 4:56:38 AM - Installed EA Download Manager
RP232: 16/02/2009 4:56:38 AM - Installed Battlefield 2142 Update v1.50
RP233: 16/02/2009 4:56:38 AM - System Checkpoint
RP234: 16/02/2009 4:56:38 AM - System Checkpoint
RP235: 16/02/2009 4:56:38 AM - Removed Battlefield 2142
RP236: 16/02/2009 4:56:38 AM - Removed Black & White 2
RP237: 16/02/2009 4:56:38 AM - Removed Rayman Raving Rabbids
RP238: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP239: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP240: 16/02/2009 4:56:38 AM - Software Distribution Service 3.0
RP241: 16/02/2009 4:56:38 AM - Removed Battlefield 2(TM)
RP242: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP243: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP244: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP245: 16/02/2009 4:56:38 AM - Installed Battlefield 2(TM)
RP246: 16/02/2009 4:56:40 AM - Installed Battlefield 2(TM)
RP247: 16/02/2009 4:56:40 AM - Installed Battlefield 2(TM)
RP248: 16/02/2009 4:56:40 AM - System Checkpoint
RP249: 16/02/2009 4:56:40 AM - System Checkpoint
RP250: 16/02/2009 4:56:40 AM - Last known good configuration
RP251: 16/02/2009 4:56:40 AM - Restore Operation
RP252: 16/02/2009 4:56:40 AM - ComboFix created restore point
RP253: 16/02/2009 4:56:40 AM - Last known good configuration
RP254: 16/02/2009 4:56:45 AM - Last known good configuration
RP255: 16/02/2009 11:00:18 AM - Removed Windows Live Messenger
==== Installed Programs ======================
725plc32
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 7.1.0
Advanced Video FX Utility
AIM 6
AOL Uninstaller (Choose which Products to Remove)
AOLIcon
Apple Mobile Device Support
Apple Software Update
Battlefield 2(TM)
BlackBerry Desktop Software 4.2.2
Borland C++BuilderX
Brain Games 3 1
Broadcom 440x 10/100 Integrated Controller
Broadcom Management Programs
Call of Duty(TM) Game of the Year Edition
CCleaner (remove only)
CoD Server CFG Creator 1.1
Command & Conquer Red Alert 2
Conexant HDA D110 MDC V.92 Modem
Creative Photo Manager
Creative WebCam Center
Creative WebCam Live! Driver (1.02.03.0606)
Creative WebCam Live! User's Guide (English)
Dell Color Printer 725
Dell Digital Jukebox Driver
Dell Media Experience
Dell Support Center
Dell System Restore
Dell Wireless WLAN Card
DellSupport
Digital Content Portal
Digital Line Detect
DivX Content Uploader
DivX Web Player
DNA
Documentation & Support Launcher
EducateU
ELIcon
Games, Music, & Photos Launcher
GameSpy Arcade
Google Desktop
GuitarVision
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Instant Play Electric Guitar
Intel(R) Graphics Media Accelerator Driver
iPod for Windows 2006-03-23
iTunes
Java(TM) 6 Update 11
Java(TM) 6 Update 7
LG USB Modem driver
Linksys Updater
Logitech Gaming Software
McAfee VirusScan Enterprise
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Modem Helper
Mozilla Firefox (3.0.6)
Mozilla Thunderbird (2.0.0.19)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Music Coach Player
Musicmatch for Windows Media Player
NetBeans IDE 5.5.1
NetWaiting
PowerDVD 5.7
PuTTY version 0.59
QuickTime
Razer Lachesis
Rhapsody Player Engine
Roxio Media Manager
Search Assist
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
SigmaTel Audio
Sonic DLA
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Spybot - Search & Destroy
Spyware Doctor 6.0
Sun Download Manager 2.0 (web)
Synaptics Pointing Device Driver
System Requirements Lab
Unreal Anthology
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
URL Assistant
V CAST Music Manager
Viewpoint Media Player
WebCyberCoach 3.2 Dell
WebFldrs XP
Westwood Shared Internet Components
Windows Driver Package - MOTOROLA (uisp) USB (09/08/2006 1.2.0.0)
Windows Driver Package - Razer (HidUsb) HIDClass (05/10/2007 1.00)
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Xfire (remove only)
Yahoo! Messenger
==== Event Viewer Messages From Past Week ========
11/02/2009 8:46:03 PM, error: Service Control Manager [7000] - The MCSTRM service failed to start due to the following error: The system cannot find the file specified.
11/02/2009 8:46:03 PM, error: Service Control Manager [7000] - The AOL Connectivity Service service failed to start due to the following error: The system cannot find the path specified.
11/02/2009 8:44:41 PM, error: Service Control Manager [7000] - The dlcf_device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
11/02/2009 8:44:41 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the dlcf_device service to connect.
11/02/2009 8:44:41 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service dlcf_device with arguments "" in order to run the server: {323CE21C-A448-40AA-BA74-7FCF1E441060}
11/02/2009 8:20:52 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer ERIC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DA2C5A08-D382-4B42-A5ED. The master browser is stopping or an election is being forced.
11/02/2009 6:29:55 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000047, parameter2 804fb54a, parameter3 ba4cfa5c, parameter4 00000000.
11/02/2009 2:26:09 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000047, parameter2 804fb54a, parameter3 f89dba5c, parameter4 00000000.
11/02/2009 2:22:40 AM, error: System Error [1003] - Error code 1000008e, parameter1 c0000047, parameter2 804fb54a, parameter3 80549738, parameter4 00000000.
09/02/2009 1:14:29 PM, error: Service Control Manager [7034] - The Network Associates McShield service terminated unexpectedly. It has done this 1 time(s).
09/02/2009 6:02:09 AM, error: SideBySide [36] - The assembly x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a has missing or invalid files; recovery of this assembly failed.
14/02/2009 9:38:24 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Netman service.
15/02/2009 11:31:31 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
16/02/2009 1:36:30 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'pmnnMcAt.dll' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
16/02/2009 2:21:20 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000043' while processing the file 'fccaYpMd.dll' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
16/02/2009 2:22:42 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PC Tools Security Service service to connect.
16/02/2009 2:22:42 AM, error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The Linksys Updater service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The McAfee Framework Service service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:10 AM, error: Service Control Manager [7034] - The Network Associates Task Manager service terminated unexpectedly. It has done this 1 time(s).
16/02/2009 5:34:20 AM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
16/02/2009 5:35:40 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Apple Mobile Device service to connect.
16/02/2009 5:35:40 AM, error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16/02/2009 5:36:10 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Print Spooler service to connect.
16/02/2009 5:36:10 AM, error: Service Control Manager [7000] - The Print Spooler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16/02/2009 10:57:49 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
16/02/2009 11:00:44 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
==== End Of File ===========================1077
0
Posted February 16th, 2009 16:00
I think the best scenerio to me is to boot to a PE type disc like UBCD or BartPE or any other flavor you like and to use it to search through the
Systemdrive (i.e. C:\), Systemroot (i.e. C:\windows or C:\winnt), and Systemroot\system32 directory. When searching you will need to search based on "Last Modified Date" and scroll all the way to the bottom until you see items created in the past 2-3 days. You will notice random-named .dll's and .exe's and such and these will need to be deleted! But to be safe than sorry you can create an infected folder and move the files in there for later scanning. :emotion-5:
While still in the PE bootdisk you should run AutoRuns and check what is currently enabled to start up - also you could run HiJackThis, but I think A-squared's HiJackFree program is better suited for PE use. You will want to look for any entries that may look simliar to the ones in the System and System32 directory (i.e. fxxyddz.dll and so on) and remove these as well as any unusal looking start up items loading out of the Documents and Settings profile user (i.e. C:\Documents and Settings\ \Local Settings\suspicious.exe).
You can run any Antivirus and Antispyware software that comes with the PE discs if you have any - as this is a perfect enviroment for removing infections. After this you need to reboot back into windows and try these things --
------------Disable Spyware Doctor--------------------------
1. Run VundoFix , observe any messages and logs and reboot!
2. Run Windows Update and get the most recent MRT.exe (Malicious Software Removal tool) and run it by opening up a command prompt (start -> run ->CMD.exe) and typing MRT.exe , now do a Full System Scan. Observe any message or log files and reboot.
3. Install SuperAntiSpyware or Malware Bytes AntiMalware, Update, and Run Full system Scan and observe.
4. Reboot and now re-enable Spyware Doctor, Update, and Full System Scan.
You can also download individual removal tools for popular threats from vendors websites - I will post them below. They are good for removing variants of like Vundo and such, they are good for double checking. Also Last buy not Least do Online Virus scans!!!
5. Links to those here
http://www.kaspersky.com/virusscanner
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://security.symantec.com/sscv6/WelcomePage.asp
http://housecall.trendmicro.com/
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://www.eset.com/onlinescan/
http://www.webroot.com/En_US/index.html
http://www.ca.com/US/securityadvisor/virusinfo/scan.aspx
http://home.mcafee.com/Downloads/FreeScan.aspx
So you have a huge list there to choose from.
--------------------------------------------------------------------------------------------
http://vundofix.atribune.org/ <- VundoFix
http://www.emsisoft.com/en/software/ <- You can find HiJackFree and the USB scanner and Command Line Scanner here
http://www.ultimatebootcd.com/ <- PE bootdisk - Ultimate Boot CD comes with an easy to customize interface with many tools already.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx <- AutoRuns
http://www.superantispyware.com/ <- Super AntiSpyware
http://www.malwarebytes.org/ <- Malware Bytes Anti-Malware
1077
0
Posted February 16th, 2009 19:00
There seem to be two helpers in this thread.
Although we appreciate his trying to help, please be aware that mtx8000spl is not listed as a graduate of the malware removal schools that we contacted. It is understood by the trained analysts that once a helper replies to a log, he continues working with you until the issue is resolved.
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2- Make sure you are connected to the Internet.
- Double-click on mbam-setup.exe to install the application.
- When the installation begins, follow the prompts and do not make any changes to default settings.
- When installation has finished, make sure you leave both of these checked:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
- Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
- If an update is found, the program will automatically update itself.
- Press the OK button to close that box and continue.
- If you encounter any problems while downloading the updates,
- manually download them from here
and just double-click on mbam-rules.exe to install.
Alternatively, you can update through MBAM's interface from a clean computer,
copy the definitions (rules.ref) located in
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes'
Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
- Make sure the "Perform Quick Scan" option is selected.
- Then click on the Scan button.
- If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
- The scan will begin and "Scan in progress" will show at the top.
- It may take some time to complete so please be patient.
- When the scan is finished, a message box will say "The scan completed successfully.
- Click 'Show Results' to display all objects found".
- Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
- Click on the Show Results button to see a list of any malware that was found.
- Make sure that everything is checked, and click Remove Selected.
- When removal is completed, a log report will open in Notepad.
- The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
- Copy and paste the contents of that report along with a fresh hijackThis log into your next reply and exit MBAM.
Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
-- MBAM may make changes to your registry as part of its disinfection routine.
If you're using other security programs that detect registry changes (like Spybot's Teatimer),
they may interfere with the fix or alert you after scanning with MBAM.
Please disable such programs until disinfection is complete or permit them to allow the changes.1077
0
Posted February 16th, 2009 20:00
fresh hijack this file after reboot from mbam:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:45:02 PM, on 16/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\WINDOWS\system32\java.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Common Files\AOL\1159063441\ee\aolsoftware.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Razer\Lachesis\razerhid.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Razer\Lachesis\razerofa.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA2C5A08-D382-4B42-A5ED-966500DDBF1D}: NameServer = 68.87.72.130,68.87.77.130,68.87.66.196
O20 - AppInit_DLLs: qppfth.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Norton Ghost - Unknown owner - C:\Program Files\Norton Ghost\Agent\VProSvc.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 10789 bytesmbam log file:
Malwarebytes' Anti-Malware 1.34
Database version: 1768
Windows 5.1.2600 Service Pack 3
16/02/2009 10:38:04 PM
mbam-log-2009-02-16 (22-38-04).txt
Scan type: Quick Scan
Objects scanned: 70598
Time elapsed: 2 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 16
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 10
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\mnvcikgm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qoMcaxVm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qppfth.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\pmnnMcAt.dll (Trojan.Vundo.H) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnmcat (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc629718-b9aa-4d78-916b-c4d7441eeee6} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bc629718-b9aa-4d78-916b-c4d7441eeee6} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eadc6f8d-22e9-4efa-b362-fd3194310518} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{eadc6f8d-22e9-4efa-b362-fd3194310518} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{eadc6f8d-22e9-4efa-b362-fd3194310518} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\187cf23f (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\qomcaxvm -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\qomcaxvm -> Quarantined and deleted successfully.
Folders Infected:
C:\Program Files\RelevantKnowledge (Spyware.Marketscore) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\pmnnMcAt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\qoMcaxVm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mVxacMoq.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mVxacMoq.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qppfth.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mnvcikgm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mgkicvnm.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovqkiwma.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnlMEVp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\RelevantKnowledge\rlservice.exe (Spyware.Marketscore) -> Quarantined and deleted successfully.451
0
Posted February 16th, 2009 21:00
Please launch HijackThis and place a checkmark next to the following:
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O20 - AppInit_DLLs: qppfth.dll
Close all other windows and click "Fix Checked". Close HijackThis.Run Disk Cleanup in each user's profile: Click "Start > Programs > Accessories > System Tools > Disk Cleanup" Please make sure only the following are checked:
-- Downloaded Program Files
-- Temporary Internet Files
-- Recycle Bin
-- Temporary Files
Click "OK" and Disk Cleanup will delete those files for you.
REBOOT
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run.
Please follow these steps to remove older version Java components and update.
- Download the latest version of Java Runtime Environment (JRE) 6.
- Scroll down to where it says Java SE Runtime Environment (JRE) 6 Update 12 .
- Click the "Download" button to the right.
- Check the box that says: "Accept License Agreement".
- NOTE: As always during installations, beware of any pre-checked option to install a toolbar. If you do not want it, UNcheck it.
- The page will refresh.
- Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each of the Java versions.
Close Add/Remove.
* In Windows Explorer, navigate to C:\Program Files\Java =this folder. Delete any subfolders.
* Do NOT delete C:\Program Files\ JavaVM =this folder, if found!
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u12-windows-i586-p.exe to install the newest version.
Finally please post a fresh HijackThis loga and let me know how things are running. Are you getting any alerts, adware popups, or error messages?
Bugbatter
4 Apprentice
•
20487 Posts
1077
0
Posted February 16th, 2009 04:00
Did you run ComboFix? If so, ask the person who was working with you to analyze the log.