Staff gringo_pr Posted May 1, 2013 Staff ID:675478 Share Posted May 1, 2013 HelloThese logs are looking allot better. But we still have some work to do.Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..uninstall some programsNOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)Programs to remove Java™ 6 Update 37 Please download and install Revo Uninstaller FreeDouble click Revo Uninstaller to run it.From the list of programs double click on The Program to removeWhen prompted if you want to uninstall click Yes.Be sure the Moderate option is selected then click Next.The program will run, If prompted again click Yes when the built-in uninstaller is finished click on Next.Once the program has searched for leftovers click Next.Check/tick the bolded items only on the list then click Deletewhen prompted click on Yes and then on next.put a check on any folders that are found and select deletewhen prompted select yes then on nextOnce done click Finish..Clean Out Temp FilesThis small application you may want to keep and use once a week to keep the computer clean.Download CCleaner from here http://www.ccleaner.com/Run the installer to install the application.When it gives you the option to install Yahoo toolbar uncheck the box next to it.Run CCleaner. default settings are fineClick Run Cleaner.Close CCleaner.: Malwarebytes' Anti-Malware :I see that you have MBAM installed - That is great!! and at this time I would like you to update it and run me a quick scanDouble-click mbam icongo to the update tab at the topclick on check for updatesIf an update is found, it will download and install the latest version.Once the program has loaded, select Perform quick scan, then click Scan.When the scan is complete, click OK, then Show Results to view the results.Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidentally close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtNote: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.Click OK to either and let MBAM proceed with the disinfection process.If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.Download HijackThis Go Here to download HijackThis program Save HijackThis to your desktop. Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run) Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu) copy and paste hijackthis report into the topic"information and logs"In your next post I need the followingLog From MBAMreport from Hijackthislet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
gtdriski Posted May 1, 2013 Author ID:675490 Share Posted May 1, 2013 Ok, here we go.I removed Java 6 Update 37 with Revo Uninstaller. I actually have Revo Uninstaller Pro on my system.Is there a later Java version we can install?Ran CCleaner (already had it on my system).Ran a scan with Malwarebytes. I actually have Pro on the system and it runs all the time. I am actually surprised that it and/or my NOD32 didn't stop the FBI MoneyPak infection.It found nothing. Here is the Log:Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.orgDatabase version: v2013.05.01.02Windows XP Service Pack 3 x86 NTFSInternet Explorer 7.0.5730.11GaryT :: GTD-DESKTOP [administrator]Protection: Disabled5/1/2013 2:24:49 AMmbam-log-2013-05-01 (02-24-49).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 225145Time elapsed: 8 minute(s), 59 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)Ran HijackThis. Here is log:Logfile of Trend Micro HijackThis v2.0.4Scan saved at 2:35:03 AM, on 5/1/2013Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.17128)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Logitech\SolarApp\L4301_Solar.exeC:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exeC:\WINDOWS\system32\brsvc01a.exeC:\WINDOWS\system32\brss01a.exeC:\WINDOWS\system32\spoolsv.exec:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exeC:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\LogMeIn\x86\RaMaint.exeC:\WINDOWS\Explorer.EXEC:\Program Files\LogMeIn\x86\LogMeIn.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Raxco\PerfectDisk10\PDAgent.exeC:\WINDOWS\system32\PSIService.exeC:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exeC:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exeC:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exeC:\Program Files\UPHClean\uphclean.exeC:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exeC:\Program Files\Raxco\PerfectDisk10\PDEngine.exeC:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\ESET\ESET NOD32 Antivirus\egui.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Skype\Phone\Skype.exeC:\WINDOWS\system32\ctfmon.exeC:\Documents and Settings\GaryT\Local Settings\Application Data\Intuit\SyncManager\Current\IntuitSyncManager.exeC:\PROGRA~1\INTUIT\QUICKB~1\QBDBMgr.exeC:\WINDOWS\system32\wscntfy.exeC:\Documents and Settings\GaryT\Desktop\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cm.my.yahoo.com/?rd=nuxR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 10\SnagitBHO.dllO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dllO2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dllO2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dllO3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dllO3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 10\SnagitIEAddin.dllO3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exeO4 - HKLM\..\Run: [intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startupO4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitserviceO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrunO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.htmlO8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.htmlO8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.htmlO8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.htmlO9 - Extra button: Flash Decompiler SWF Capture tool - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\Program Files\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dllO9 - Extra 'Tools' menuitem: Flash Decompiler SWF Capture tool menu - {86B4FC19-8FA4-4FD3-B243-9AEDB42FA2D5} - C:\Program Files\Eltima Software\Flash Decompiler Trillix\saveflash\iebt.dllO9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)O9 - Extra 'Tools' menuitem: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files\Evernote\Evernote\EvernoteIE.dll/204 (file missing)O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO16 - DPF: NetGUI - http://www.gomeetnow.com/client/window/1,0,1,69/ActiveXInstaller.CABO16 - DPF: Web-Based Email Tools - http://email.secureserver.net/Download.CABO16 - DPF: {02FFCFC3-C28F-4ED9-954B-1BAC9FD77E12} (Intra.Net Component Manager 2.0) - http://webstream.intra.net/media/xflux3.cabO16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/Dcode/ActiveX/MSDcode.cabO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cabO16 - DPF: {16C698C4-4BE0-4CDF-B777-39276A95F58F} (InstallActivexViewer Control) - http://meeting.zoho.com/login/ActivexViewer.jspO16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.8.cabO16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cabO16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-36.cabO16 - DPF: {54D53429-945C-4188-B460-C81356541882} (SaveImageFiles Class) - http://photosmart.hpphoto.com/Download/HPeServicesLocalPrint.CABO16 - DPF: {56426D1F-A2BB-4195-8555-CCE6533F81E8} (ZohoMeetingAgent Control) - http://meeting.zoho.com/login/Agent.jspO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122093200750O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257126710734O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cabO16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cabO16 - DPF: {7BC974EF-A718-4A17-B77E-4C8DBC327AFA} (SCE Control) - https://secure.voloper.net/editor.cabO16 - DPF: {7DD82D6B-3553-470B-8D1E-D5C7086478A7} (QBMASSyncCom2_2005.UserControl1) - https://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2005.cabO16 - DPF: {84B7AC1D-9AD1-474F-B6B0-FE1641DBFDFA} (ScanFile.FileScan) - http://www.contentpurity.com/xp/ScanFilexp.CABO16 - DPF: {87651085-BCBF-4281-B8F7-1F6E56E92515} (ZohoMeetingAgent Control) - http://meeting.zoho.com/login/Agent.jspO16 - DPF: {B7039D87-D648-4431-BA87-C3A04E6111DA} (wodTelnetDLX Class) - https://67.43.9.72:4643/vz/ssh/wodTelnetDLX.cabO16 - DPF: {D5382F3F-32AA-41E1-9FFF-5D1EFAC80D40} (FileClean.Clean) - http://contentpurity.com/members/FileClean.CABO16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocxO16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://office.webstream-innovations.com/hyperoffice/personal/documents/XUpload.ocxO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cabO16 - DPF: {F21AC8A4-4322-11D6-8EBE-0001023D1A2A} (IntuitRecurPayCom.UserControl1) - https://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom.cabO16 - DPF: {F8A9F96F-8375-4596-BD89-EEAE2781D810} (QBMASSyncCom1.UserControl1) - https://merchantaccount.quickbooks.com/sync/QBMASSyncCom1.cabO16 - DPF: {FF1CD9A3-00CD-45C1-8182-4EEC229A182D} (Plaxo Auto-Import Utility) - http://www.plaxo.com/activex/plx_upldr-2k-xp.cabO18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dllO18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dllO18 - Protocol: intu-help-qb5 - {867FCB77-9823-4CD6-8210-D85F968D466F} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dllO18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exeO23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Logitech Solar Keyboard Service (L4301_Solar) - Logitech, Inc. - C:\Program Files\Logitech\SolarApp\L4301_Solar.exeO23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exeO23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exeO23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exeO23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exeO23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exeO23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeO23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exeO23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exeO23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exeO23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exeO23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exeO23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exeO23 - Service: QBIDPService (QBVSS) - Intuit Inc. - C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exeO23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exeO23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exeO23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exeO23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeO23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exeO23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exeO23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exeO23 - Service: User Profile Hive Cleanup (UPHClean) - Windows ® Codename Longhorn DDK provider - C:\Program Files\UPHClean\uphclean.exeO23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe--End of file - 18285 bytesEverthing seems good. Next?Thanks, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 1, 2013 Staff ID:675492 Share Posted May 1, 2013 GreetingsI will get into Java later.These logs are looking very good, we are almost done!!! Just one more scan to go.:Remove unneeded start-up entries:This part of the fix is purely optionalThese are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster. Run HijackThis (rightclick and run as admin) Click on the Scan button Put a check beside all of the items listed below (if present):O4 - HKLM\..\Run: [intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startupO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"[*] Close all open windows and browsers/email, etc...[*] Click on the "Fix Checked" button[*] When completed, close the application.NOTE**You can research each of those lines >here< and see if you want to keep them or notjust copy the name between the brackets and paste into the search spaceO4 - HKLM\..\Run: [IntelliPoint]Eset Online Scanner**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as adminGo Eset web page to run an online scanner from ESET. Turn off the real time scanner of any existing antivirus program while performing the online scanclick on the Run ESET Online Scanner buttonTick the box next to YES, I accept the Terms of Use.Click Start[*]When asked, allow the add/on to be installedClick Start[*]Make sure that the option Remove found threats is unticked[*]Click on Advanced Settings, ensure the optionsScan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.[*]Click Scan[*]wait for the virus definitions to be downloaded[*]Wait for the scan to finishWhen the scan is completeIf no threats were foundput a checkmark in "Uninstall application on close"close programreport to me that nothing was foundIf threats were foundclick on "list of threats found"click on "export to text file" and save it as ESET SCAN and save to the desktopClick on backput a checkmark in "Uninstall application on close"click on finishclose programcopy and paste the report hereGringo Link to post Share on other sites More sharing options...
gtdriski Posted May 1, 2013 Author ID:675641 Share Posted May 1, 2013 Gringo,A couple of questions before I do this:I use Quickbooks & Intuit Merchant Service in my business. Isn't Intuit SyncManager necessary to keep all this synced? If not, I will gladly remove it.I already have the paid version of Eset NOD32 installed and running on my system. It is the latest version with the latest data file. Wouldn't it be better to run the scan with it rather than the Eset online scanner? If not, I will proceed as instructed.Thanks, GaryThanks, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 2, 2013 Staff ID:675651 Share Posted May 2, 2013 Hello GaryThe startups are optional so if you think you want to keep it go aheadsometimes I miss that Eset is on boardF-Secure Online ScanYou can use either Internet Explorer or Mozilla FireFox for this scan.Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.Please go HERE to run an online scan from F-SecureClick on Start scanningThis will open a new windowIn Interner ExplorerIt will require an activex control, please install itClick AcceptIn FirefoxIt will require an Add-on to be installed, please install itOrder to install the Add-on Firefox needs to be restarted, please do so[*]Click Full System Scan[*]It will now download the scanner this may take a while please be patient[*]It will then start scanning wait for the scan to finish[*]Click Automatic cleaning (recommended)[*]Wait for it finish the cleaning process[*]Click show report[*]This will open up a window with the results of the scan copy and paste those results as a reply to this topicGringo Link to post Share on other sites More sharing options...
gtdriski Posted May 2, 2013 Author ID:675676 Share Posted May 2, 2013 Hello again,I removed GoogleToolbarNotifier and left IntuitSyncManager.I ran F-Secure Online Scanner:It found no problemsThis newer version didn't provide a reportI am also running a Smart Scan with my NOD32. This may take a while. I will post another reply with th results.Since you are helping me so much, I wanted to give a little back. Here is some updated information I found:The latest version of CCleaner doesn't try to install Yahoo ToolbarThe latest F-Secure Online Scanner is a standalone EXE. It doesn't run inside your browser.The latest F-Secure Online Scanner download is at: http://www.f-secure.com/en/web/home_us/online-scannerThanks, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 3, 2013 Staff ID:675844 Share Posted May 3, 2013 Hello1. thans for that - it is about time2. did you use IE or firefox?3. thanks for the linkgringo Link to post Share on other sites More sharing options...
gtdriski Posted May 10, 2013 Author ID:677971 Share Posted May 10, 2013 Hello Gringo,Sorry I took so long. I had trouble getting NOD32 to complete its scan and had to talk to ESET Support.To answer your #2 question above, I believe I was using Firefox, when I downloaded the F-Secure Online Scanner standalone EXE. However, I closed all my browsers before I actually ran it.Ok, to give you an updated report on my PC situation:Earlier, I had mentioned that the MalwareBytes daily scan had been running when I got the FBI MoneyPak infection and that the only way I got my PC unlocked was that it finally completed and then cleaned the infection. Here is the log from than scan, which I thought you might find useful:Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.orgDatabase version: v2013.04.29.09Windows XP Service Pack 3 x86 NTFSInternet Explorer 7.0.5730.11GaryT :: GTD-DESKTOP [administrator]Protection: Disabled4/30/2013 5:14:18 AMmbam-log-2013-04-30 (05-14-18).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 227410Time elapsed: 27 minute(s), 53 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 1HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Agent.RNS) -> Data: explorer.exe,C:\Documents and Settings\GaryT\Application Data\skype.dat -> Quarantined and deleted successfully.Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 3C:\Documents and Settings\GaryT\rundll32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.C:\Documents and Settings\GaryT\spoolsv.exe (Trojan.Agent) -> Quarantined and deleted successfully.C:\Documents and Settings\GaryT\Application Data\skype.dat (Trojan.Agent) -> Quarantined and deleted successfully.(end)While I was having trouble running my NOD32 scan, I ran the ESET Online Scanner. Here is what it found:C:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurner.exe Win32/Toolbar.Widgi applicationC:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurnerV2.exe Win32/Toolbar.Widgi applicationC:\Documents and Settings\GaryT\My Documents\Download\WinZip15\winzip155.exe Win32/OpenCandy applicationC:\System Volume Information\_restore{81204647-6BB4-4E2A-B834-E51237745CC7}\RP1153\A0175618.exe a variant of Win32/Kryptik.AZXZ trojanC:\TDSSKiller_Quarantine\30.04.2013_08.26.35\tdlfs0000\tsk0004.dta a variant of Win32/Olmarik.ADZ trojanLastly, with ESET's help I finally got my NOD32 to complete a system scan. Here are the threats it found:C:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurner.exe » INNO » {tmp}\dealio.exe - Win32/Toolbar.Widgi potentially unwanted applicationC:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurnerV2.exe » INNO » {tmp}\dealio.exe - Win32/Toolbar.Widgi potentially unwanted applicationC:\System Volume Information\_restore{81204647-6BB4-4E2A-B834-E51237745CC7}\RP1153\A0175618.exe - a variant of Win32/Kryptik.AZXZ trojan - cleaned by deleting - quarantined [1]C:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurner.exe » INNO » {tmp}\dealio.exe - Win32/Toolbar.Widgi potentially unwanted applicationC:\Documents and Settings\GaryT\My Documents\Download\Setup_FreeBurnerV2.exe » INNO » {tmp}\dealio.exe - Win32/Toolbar.Widgi potentially unwanted applicationLet me know what you think.Thanks, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 10, 2013 Staff ID:677973 Share Posted May 10, 2013 Hello Gary Go ahead and let Eset clean those items - they are the setup files you downloaded, when you use a download portal like C-net or similar they will add what is called a wrapper and it will give you the option of downloading something you don't want like a toolbar or something elseVery well done!! This is my general post for when your logs show no more signs of malware - Please let me know if you still are having problems with your computer and what these problems are.:Why we need to remove some of our tools: Some of the tools we have used to clean your computer were made by fellow malware fighters and are very powerful and if used incorrectly or at the wronge time can make the computer an expensive paper weight.They are updated all the time and some of them more than once a day so by the time you are ready to use them again they will already be outdated.The following procedures will implement some cleanup procedures to remove these tools. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.:DeFogger:Note** Defogger only needs to be run if it was run when we first started. If you have not already run it then skip this.To re-enable your Emulation drivers, double click DeFogger to run the tool. The application window will appear Click the Re-enable button to re-enable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OK.Your Emulation drivers are now re-enabled.:Uninstall ComboFix:turn off all active protection softwarepush the "windows key" + "R" (between the "Ctrl" button and "Alt" Button) please copy and past the following into the box ComboFix /Uninstall and click OK. Note the space between the X and the /Uninstall, it needs to be there.:Remove the rest of our tools:Please download OTCleanIt and save it to desktop. This tool will remove all the tools we used to clean your pc.Double-click OTCleanIt.exe.Click the CleanUp! button.Select Yes when the "Begin cleanup Process?" prompt appears.If you are prompted to Reboot during the cleanup, select Yes.The tool will delete itself once it finishes, if not delete it by yourself. If asked to restart the computer, please do soNote: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.About JavaDuring the cleaning process if I found that Java was installed I asked for it to be uninstalled, Many home users will not miss it. If you use OpenOffice, play online games or use business applications which require Java, Then you need to install the latest version and make sure to disable it in your web browsers.If an application or website requires it, you should receive a notification indicating that when you attempt to launch that application or access that website. Link to download latest version. - install JavaHow to disable java in your web browsers - Disable Java:The programs you can keep:Some of the programs that we have used would be a good idea to keep and used often in helping to keep the computer clean. I use these programs on my computer.Revo Uninstaller Free - this is the uninstaller that I had you download and works allot better than add/remove in windows and has saved me more than once from corrupted installs and uninstallsCCleaner - This is a good program to clean out temp files, I would use this once a week or before any malware scan to remove unwanted temp files - It has a built in registry cleaner but I would leave that alone and not use any registry cleanerMalwarebytes' Anti-Malware The Gold standerd today in antimalware scanners:Security programs:One of the questions I am asked all the time is "What programs do you use" I have at this time 4 computers in my home and I have this setup on all 4 of them.Microsoft Security Essentials - provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.Malwarebytes' Anti-Malware Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It istotally free but for real-time protection you will have to pay a small one-time fee. We used this to help clean your computer and recomend keeping it and using often. (I have upgraded to the paid version of MBAM and I am glad I did)Note** If you decide to install MSE you will need to uninstall your present Antivirus:Security awareness:It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.The other question I am asked all the time is "How can I prevent this from happening again." and the short answer to that is to be aware of what is out there and how to start spotting dangers.Here are some articles that are must reads and should be read by everybody in your household that uses the internetinternetsafetyInternet Safety for KidsHere is some more reading for you from some of my collegesPC Safety and Security - What Do I Need? from my friends at Tech Support ForumCOMPUTER SECURITY - a short guide to staying safer online from my friends at Malware Removalquoted from Tech Support ForumConclusionThere is no such thing as ‘perfect security’. This applies to many things, not just computer systems. Using the above guide you should be able to take all the reasonable steps you can to prevent infection. However, the most important part of all this is you, the user. Surf sensibly and think before you download a file or click on a link. Take a few moments to assess the possible risks and you should be able to enjoy all the internet has to offer.I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.I Will Keep This Open For About Three Days, If Anything Comes Up - Just Come Back And Let Me Know, after that time you will have to send me a PMMy help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here --><-- Don't worry every little bit helps.Gringo Link to post Share on other sites More sharing options...
gtdriski Posted May 13, 2013 Author ID:678892 Share Posted May 13, 2013 Hello Gringo,Thanks for all your help and all the information. I sent you a little donation. It is not enough, but all I can afford right now.A couple of last questions, if you don't mind:What software firewall product do you recommend, if any?This is not a security question, but with your expertise, I thought you might have some advice. For several months now, Windows on this system has been hanging on Shutdown or Restart. It gets to the message "Windows is Shutting Down" and just stays there. I have done some research and there doesn't seem to be an easy solution or even an easy way to troubleshoot. Do you have any recommendations?Thanks again, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 13, 2013 Staff ID:678893 Share Posted May 13, 2013 Hello1. I use windows firewall as I am behind a router2. I have a couple of things we can tryI want you to reset the DMA you can do this by this script here - Reset DMAIf you have problems when you click on the link try to right click on the link and select "Save Target As" and then save to your desktop.Once it is on your desktop right click on the file and select "Run"If you still can't run it then you can go here "Reset DMA" to see what I want to doGringo Link to post Share on other sites More sharing options...
gtdriski Posted May 14, 2013 Author ID:679268 Share Posted May 14, 2013 Hello again,Thanks for offering to help.I ran the script, but no luck. It gave me the following response:"No Resettable ATA Channels with Windows drivers found. Nothing changed."I went ahead and rebooted a couple of times, but it still hangs.Also, I read the article you pointed to, so I went into my device manager and looks at the IDE ATA/ATAPI controllers. First off, my system is somewhat different than what is in the article. I have two (2) Serial ATA RAID controllers and one (1) Parallel ATA controller. See the attached file. IDE ATA Controller Settings.docMy Hard Drive (RAID Array) is on the Serial ATA and there don't seem to be any DMA settings for these controllersThe only thing on the Parallel ATA controller is a single DVD drive, and as shown in the attached document, it seems to be set correctly DMA wise:Thanks, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 14, 2013 Staff ID:679279 Share Posted May 14, 2013 Hello I want you to run things in selective startup, this will help pinpoint the type of problem it is1. push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)2. In the Open box, type msconfig and then click OK. The System Configuration Utility appears.3. Click the "services" tab.4. Put a checkmark in "hide all Microsofts services".5. Uncheck anything that is left.6. click on the "startup" tab7. uncheck all under this tab8. click on the apply buttonRestat the computer and see how things are doing, If things are doing better then repeat the process but this time start with the services and start by adding the first half back and apply the changesIf things go bad again then you know the problem is in the services that you restarted and you can keep searching untill you find the one it isif you restart all the services and things are still ok then go back and do the same thing for the startup programsGringo Link to post Share on other sites More sharing options...
gtdriski Posted May 16, 2013 Author ID:680192 Share Posted May 16, 2013 Gringo,Still no luck.I turned off all the non-Microsoft services and all the startup items (except it wouldn't let me turn off the NOD32 startup item). However, it still hung during restart. I tried it several times with no change.It must be a Microsoft service or a driver.Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 16, 2013 Staff ID:680202 Share Posted May 16, 2013 Hello Garywell those are the easy things to check for and anything else is going to take some major investigatingYou can ask for help here in this room - http://forums.malwarebytes.org/index.php?showforum=6 and they may be able to help you but we are mostly set up as a malware forum I do help at a few other forums that may be able to help deeper if you want to go that routegringo Link to post Share on other sites More sharing options...
gtdriski Posted May 16, 2013 Author ID:680205 Share Posted May 16, 2013 Gringo,.Thanks for the effort. Yes, I figured much more work would be involved. That's why I hoped someone had a secret trick If you would, go ahead and give me the links to the other forums and I will pursue when I have time. While the hanging up is a nuisance, fixing it is not critical right now.You can close this thread, if you wish.Thanks again, Gary Link to post Share on other sites More sharing options...
Staff gringo_pr Posted May 16, 2013 Staff ID:680206 Share Posted May 16, 2013 I sent you a PMgringo Link to post Share on other sites More sharing options...
LDTate Posted May 19, 2013 ID:681545 Share Posted May 19, 2013 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts