Jay320 Posted June 30, 2009 ID:94563 Share Posted June 30, 2009 I first thought something was going on when I ran Spyware Terminator and it couldn't connect to update. After I restarted my computer, I started getting the awful SVCHost.exe application error (the instruction at "0x8c27a0eb" referenced memory at "0x8c27a0eb". The memory could not be "read".) If I click OK to terminate the program (OK being the only option), I get another popup that says the system has to shut down and there's a little timer with 60 seconds to close everything before the system shuts down.I had read something about Windows Update causing SVCHost errors - not sure if this is related to that because other things seem to be wrong as well.I also noticed that, upon trying to use System Restore, that System Restore has been turned off and I cannot turn it back on. I also can't seem to get online and even the tried to check the network settings but it just came up a blank window.Here is a HijackThis log from the system. Any help would be great because essentially my PC is unusable. Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:44:28 PM, on 6/30/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16850)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Lavasoft\Ad-Aware\AAWService.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\CDProxyServ.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\Program Files\Spyware Terminator\sp_rsser.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\WINDOWS\system32\hphmon05.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\QTTask.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\COMODO\COMODO Internet Security\cfp.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\HiJackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_printenhancer.dllO2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exeO4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exeO4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exeO4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exeO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeO4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -hO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKUS\S-1-5-21-3388061850-1932007520-1780769229-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')O4 - S-1-5-21-3388061850-1932007520-1780769229-1003 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User '?')O4 - S-1-5-21-3388061850-1932007520-1780769229-1003 Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe (User '?')O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/cfw..._instmodule.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocxO16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exeO23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: OracleDBConsoleorcl - Unknown owner - C:\app\Owner\product\11.1.0\db_1\bin\nmesrvc.exe (file missing)O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exeO23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXEO23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exeO23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSO23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe--End of file - 11156 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 1, 2009 Root Admin ID:94783 Share Posted July 1, 2009 Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofixPlease ensure you read this guide carefully and install the Recovery Console first.NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the programAdditional links to download the tool:ComboFix.exeComboFix.exeComboFix.exeNote: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.Once installed, you should see a blue screen prompt that says:The Recovery Console was successfully installed.Please continue as follows:Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Click Yes to allow ComboFix to continue scanning for malware.When the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
Jay320 Posted July 2, 2009 Author ID:95056 Share Posted July 2, 2009 Okay, here is the new hijackThis log, and I've attached the ComboFix.txt file as well. I see some all too familiar files were found (I've gotten rid of them before but they've come back).Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:25:17 AM, on 7/2/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16850)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\Nero\Nero 7\InCD\NBHGui.exeC:\Program Files\Nero\Nero 7\InCD\InCD.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\COMODO\COMODO Internet Security\cfp.exec:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXEC:\WINDOWS\system32\ctfmon.exeC:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\Program Files\Spyware Terminator\sp_rsser.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\notepad.exeC:\Program Files\Lavasoft\Ad-Aware\AAWService.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\internet explorer\iexplore.exeC:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_clipbook.exeC:\Program Files\HiJackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_printenhancer.dllO2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exeO4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exeO4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exeO4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exeO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeO4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -hO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/cfw..._instmodule.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocxO16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: OracleDBConsoleorcl - Unknown owner - C:\app\Owner\product\11.1.0\db_1\bin\nmesrvc.exe (file missing)O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exeO23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXEO23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exeO23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSO23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe--End of file - 11385 bytesComboFix.txtComboFix.txt Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 2, 2009 Root Admin ID:95083 Share Posted July 2, 2009 I'm sorry but I just had too many other things to do tonight and I'm out of time. I'll pick back up on this tomorrow. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 3, 2009 Root Admin ID:95296 Share Posted July 3, 2009 STEP 01Click on START - RUN and Copy/Paste the following into the run line and click OKcmd /k sc delete $sys$ariesReboot your computerSTEP 02Download but do not yet run ComboFixIf you have a previous version of Combofix.exe, delete it and download a fresh copy.Download it to your DESKTOP - it MUST run from the Desktopdownload.bleepingcomputer.com/sUBs/ComboFix.exesubs.geekstogo.com/ComboFix.exeUsing your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank linesKILLALL::Driver::$sys$cor$sys$craterAkamaipedopdlasujnCD_Proxy$sys$DRMServer File::C:\Windows\system32\$sys$filesystem\aries.sysc:\windows\system32\drivers\$sys$cor.sysc:\windows\system32\$sys$filesystem\crater.sysc:\windows\system32\drivers\hjzbioetmpjc.sysOpen a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.Disconnect from the Internet. Disable your Antivirus software. If it has Script Blocking features, please disable these as well. A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed. When the scan completes Notepad will open with with your results log open. Do a File, Exit.A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.Post back the Combofix log on your next reply.STEP 03Update and Scan with Malwarebytes' Anti-MalwareStart MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.Update Malwarebytes' Anti-Malware Select the Update tabClick Update[*]When the update is complete, select the Scanner tab[*]Select Perform quick scan, then click Scan.[*]When the scan is complete, click OK, then Show Results to view the results.[*]Be sure that everything is checked, and click Remove Selected.[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidently close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtThen post back the MBAM log and a new Hijackthis log. Link to post Share on other sites More sharing options...
Jay320 Posted July 3, 2009 Author ID:95411 Share Posted July 3, 2009 First, here is the Malwarebytes log:Malwarebytes' Anti-Malware 1.38Database version: 2368Windows 5.1.2600 Service Pack 27/3/2009 11:17:11 AMmbam-log-2009-07-03 (11-17-11).txtScan type: Quick ScanObjects scanned: 98600Time elapsed: 6 minute(s), 48 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)---------------------------------------------------------Here is the HijackThis log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:20:54 AM, on 7/3/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16850)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\System32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exec:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXEC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\Program Files\Spyware Terminator\sp_rsser.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\system32\igfxtray.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\Nero\Nero 7\InCD\NBHGui.exeC:\Program Files\Nero\Nero 7\InCD\InCD.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\COMODO\COMODO Internet Security\cfp.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeC:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\notepad.exeC:\Program Files\Lavasoft\Ad-Aware\AAWService.exeC:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\HiJackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_printenhancer.dllO2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_framework.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXEO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exeO4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exeO4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exeO4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exeO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exeO4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -hO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /autoO4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htmO8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dllO9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\Hewlett-Packard\Smart Web Printing\hpswp_extensions.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - http://activex.camfrogweb.com/advanced/cfw..._instmodule.exeO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dllO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst...ctDetection.cabO16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur...loadManager.ocxO16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: OracleDBConsoleorcl - Unknown owner - C:\app\Owner\product\11.1.0\db_1\bin\nmesrvc.exe (file missing)O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exeO23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXEO23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exeO23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\tnslsnr.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSO23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe--End of file - 11482 bytes----------------------------------------------------------And here is the ComboFix log:ComboFix 09-07-02.02 - Owner 07/03/2009 10:33.2 - NTFSx86Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1263.643 [GMT -4:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Owner\Desktop\CFscript.txtAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}FILE ::"c:\windows\system32\$sys$filesystem\aries.sys""c:\windows\system32\$sys$filesystem\crater.sys""c:\windows\system32\drivers\$sys$cor.sys""c:\windows\system32\drivers\hjzbioetmpjc.sys".((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\Installer\1e5670f.msic:\windows\Installer\8bc54f.mspc:\windows\Installer\8bc557.mspc:\windows\system32\$sys$filesystem\crater.sysc:\windows\system32\drivers\$sys$cor.sys.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_AKAMAI-------\Service_$sys$cor-------\Service_$sys$crater-------\Service_Akamai-------\Service_pedopdlasujn((((((((((((((((((((((((( Files Created from 2009-06-03 to 2009-07-03 ))))))))))))))))))))))))))))))).2009-06-12 01:50 . 2004-08-04 19:00 25600 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-07-03 14:11 . 2009-04-12 05:14 -------- d-----w- c:\program files\Common Files\Akamai2009-07-02 14:54 . 2009-03-25 19:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spyware Terminator2009-07-02 14:54 . 2007-12-18 19:39 -------- d-----w- c:\program files\Spyware Terminator2009-07-02 14:48 . 2009-03-25 19:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Spyware Terminator2009-07-01 12:58 . 2009-03-17 21:24 11952 ----a-w- c:\windows\system32\avgrsstx.dll2009-07-01 12:58 . 2009-03-17 21:23 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys2009-07-01 12:58 . 2009-03-17 21:23 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2009-07-01 00:54 . 2006-08-02 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-06-29 03:25 . 2009-03-23 17:53 -------- d-----w- c:\documents and settings\Owner\Application Data\BitTorrent2009-06-27 18:10 . 2009-05-22 21:56 -------- d-----w- c:\program files\TESTOUT2009-06-27 15:00 . 2009-04-12 05:14 -------- d-----w- c:\documents and settings\Owner\Application Data\Metacafe2009-06-27 15:00 . 2009-04-12 05:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Metacafe2009-06-13 14:47 . 2009-03-20 20:56 168208 ----a-w- c:\windows\system32\guard32.dll2009-06-13 14:47 . 2009-03-20 20:56 82080 ----a-w- c:\windows\system32\drivers\inspect.sys2009-06-13 14:47 . 2009-03-20 20:56 24096 ----a-w- c:\windows\system32\drivers\cmdhlp.sys2009-06-13 14:47 . 2009-03-20 20:56 132640 ----a-w- c:\windows\system32\drivers\cmdguard.sys2009-06-01 13:05 . 2007-11-28 16:51 -------- d-----w- c:\documents and settings\Owner\Application Data\Move Networks2009-06-01 03:40 . 2009-06-01 03:40 127877 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\uninstall.exe2009-06-01 03:40 . 2009-05-01 06:30 4183416 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071500000347.dll2009-06-01 03:40 . 2009-06-01 03:39 1685856 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\MoveMediaPlayerWin_071500000347.exe2009-05-31 17:08 . 2009-05-31 17:08 314200 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe2009-05-31 17:08 . 2009-05-31 17:08 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll2009-05-31 17:08 . 2009-05-31 17:08 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll2009-05-31 17:08 . 2009-05-31 17:08 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe2009-05-31 17:08 . 2009-03-19 18:47 15688 ----a-w- c:\windows\system32\lsdelete.exe2009-05-31 17:08 . 2009-05-31 17:08 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll2009-05-31 17:08 . 2009-05-31 17:08 294240 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll2009-05-31 17:08 . 2009-05-31 17:08 83808 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll2009-05-31 17:07 . 2009-05-31 17:07 1630048 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll2009-05-31 17:07 . 2009-05-31 17:07 640360 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll2009-05-31 17:07 . 2009-05-31 17:07 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll2009-05-31 17:07 . 2009-05-31 17:07 212848 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll2009-05-31 17:07 . 2009-05-31 17:07 540536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe2009-05-31 17:07 . 2009-05-31 17:07 559464 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe2009-05-31 17:07 . 2009-05-31 17:07 2352456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe2009-05-31 17:07 . 2009-05-31 17:07 627536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe2009-05-31 17:07 . 2009-05-31 17:07 518488 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe2009-05-31 17:07 . 2009-05-31 17:07 1005904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe2009-05-30 19:02 . 2005-09-16 22:07 -------- d-----w- c:\program files\Winamp2009-05-24 15:40 . 2009-01-28 17:59 -------- d-----w- c:\program files\WS_FTP2009-05-14 20:23 . 2009-05-14 20:23 -------- d-----w- c:\program files\PuTTY2009-05-13 02:09 . 2008-05-10 02:29 139811 ----a-w- c:\windows\hpoins15.dat2009-05-07 15:44 . 2005-03-23 16:52 344064 ----a-w- c:\windows\system32\localspl.dll2009-05-04 12:04 . 2009-03-17 21:24 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys2009-05-01 14:01 . 2009-05-01 14:01 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys2009-05-01 14:01 . 2009-03-19 18:23 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys2009-05-01 06:30 . 2009-05-01 06:30 97144 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe2009-04-29 04:56 . 2005-03-23 16:53 827392 ----a-w- c:\windows\system32\wininet.dll2009-04-29 04:55 . 2005-03-23 16:52 78336 ----a-w- c:\windows\system32\ieencode.dll2009-04-17 09:58 . 2005-03-23 16:53 1846656 ----a-w- c:\windows\system32\win32k.sys2009-04-15 15:26 . 2005-03-23 16:52 583168 ----a-w- c:\windows\system32\rpcrt4.dll2009-02-23 00:00 . 2009-02-23 00:00 336 ----a-w- c:\program files\temp995.bat2009-03-18 01:54 . 2009-03-18 01:54 2 --shatr- c:\windows\winstart.bat.((((((((((((((((((((((((((((( SnapShot@2009-07-02_06.13.25 ))))))))))))))))))))))))))))))))))))))))).+ 2005-12-24 17:50 . 2005-12-24 17:50 84992 c:\windows\Installer\261e34d9.msi+ 2008-05-10 02:31 . 2008-05-10 02:31 68096 c:\windows\Installer\1ec854d.msi+ 2005-03-23 16:51 . 2004-08-04 19:00 66048 c:\windows\I386\WINNT32.MSI+ 2005-03-23 10:02 . 2009-07-03 14:58 303624 c:\windows\system32\FNTCACHE.DAT+ 2008-05-10 02:44 . 2008-05-10 02:44 252416 c:\windows\Installer\e662.msi+ 2008-05-10 02:44 . 2008-05-10 02:44 239616 c:\windows\Installer\e65b.msi+ 2008-05-10 02:43 . 2008-05-10 02:43 325120 c:\windows\Installer\e655.msi+ 2008-05-10 02:41 . 2008-05-10 02:41 551936 c:\windows\Installer\e64e.msi+ 2007-10-12 21:01 . 2007-10-12 21:01 339456 c:\windows\Installer\d46e870.msi+ 2006-02-17 03:17 . 2006-02-17 03:17 274432 c:\windows\Installer\c7557bc.msi+ 2006-02-17 03:17 . 2006-02-17 03:17 542208 c:\windows\Installer\c7557b4.msi+ 2006-02-17 03:17 . 2006-02-17 03:17 376832 c:\windows\Installer\c7557ac.msi+ 2006-11-15 08:01 . 2006-11-15 08:01 428544 c:\windows\Installer\c6ee33d.msi+ 2006-10-19 02:10 . 2006-10-19 02:10 589312 c:\windows\Installer\c0e5a34.msi+ 2009-02-26 15:12 . 2009-02-26 15:12 945152 c:\windows\Installer\6a76e8c.msi+ 2007-08-15 07:01 . 2007-08-15 07:01 431104 c:\windows\Installer\6329e77.msi+ 2008-07-19 16:19 . 2008-07-19 16:19 472064 c:\windows\Installer\42695ff.msi+ 2008-11-13 08:01 . 2008-11-13 08:01 432640 c:\windows\Installer\386bfd8.msi+ 2008-04-01 22:51 . 2008-04-01 22:51 289792 c:\windows\Installer\2d3c15aa.msi+ 2009-03-17 18:52 . 2009-03-17 18:52 337408 c:\windows\Installer\288a70.msi+ 2005-09-16 08:42 . 2005-09-16 08:42 578048 c:\windows\Installer\268e4.msi+ 2009-03-19 18:23 . 2009-03-19 18:23 236032 c:\windows\Installer\219f90.msi+ 2008-05-10 02:36 . 2008-05-10 02:36 312320 c:\windows\Installer\1ec8663.msi+ 2008-05-10 02:36 . 2008-05-10 02:36 491008 c:\windows\Installer\1ec865d.msi+ 2008-05-10 02:36 . 2008-05-10 02:36 898560 c:\windows\Installer\1ec8657.msi+ 2008-05-10 02:35 . 2008-05-10 02:35 189440 c:\windows\Installer\1ec8642.msi+ 2008-05-10 02:35 . 2008-05-10 02:35 472576 c:\windows\Installer\1ec8634.msi+ 2008-05-10 02:35 . 2008-05-10 02:35 913920 c:\windows\Installer\1ec862c.msi+ 2008-05-10 02:35 . 2008-05-10 02:35 343040 c:\windows\Installer\1ec8625.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 121344 c:\windows\Installer\1ec861b.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 586240 c:\windows\Installer\1ec8615.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 121344 c:\windows\Installer\1ec860b.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 426496 c:\windows\Installer\1ec8605.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 452608 c:\windows\Installer\1ec85fd.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 600576 c:\windows\Installer\1ec85f3.msi+ 2008-05-10 02:34 . 2008-05-10 02:34 532480 c:\windows\Installer\1ec85ed.msi+ 2008-05-10 02:33 . 2008-05-10 02:33 646656 c:\windows\Installer\1ec85e6.msi+ 2008-05-10 02:33 . 2008-05-10 02:33 121344 c:\windows\Installer\1ec85b5.msi+ 2008-05-10 02:33 . 2008-05-10 02:33 628736 c:\windows\Installer\1ec85af.msi+ 2008-05-10 02:33 . 2008-05-10 02:33 526336 c:\windows\Installer\1ec85a1.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 121344 c:\windows\Installer\1ec8596.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 514560 c:\windows\Installer\1ec8590.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 305664 c:\windows\Installer\1ec858a.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 425472 c:\windows\Installer\1ec8584.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 811520 c:\windows\Installer\1ec8573.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 326144 c:\windows\Installer\1ec8568.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 500736 c:\windows\Installer\1ec8562.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 391168 c:\windows\Installer\1ec855a.msi+ 2008-05-10 02:32 . 2008-05-10 02:32 592384 c:\windows\Installer\1ec8554.msi+ 2007-08-09 13:30 . 2007-08-09 13:30 474624 c:\windows\Installer\1e56714.msi+ 2008-04-14 20:28 . 2008-04-14 20:28 537600 c:\windows\Installer\1c9739cc.msi+ 2006-03-04 04:34 . 2006-03-04 04:34 171008 c:\windows\Installer\1586d11c.msi+ 2005-09-16 08:35 . 2005-09-16 08:35 557056 c:\windows\Installer\1558e8.msi+ 2005-03-23 18:18 . 2005-03-23 18:18 264704 c:\windows\Installer\10d4f.msi+ 2009-02-22 23:42 . 2009-02-22 23:42 100352 c:\windows\Installer\10a47374.msi+ 2005-09-16 07:11 . 2004-07-22 22:02 156672 c:\windows\I386\DRV\MOD\modem assistant.msi+ 2008-07-19 16:19 . 2008-07-19 16:19 751104 c:\windows\Downloaded Installations\{54EDFAB9-E74A-41E4-A133-D509387F10CC}\HP Product Detection.msi+ 2006-03-27 05:33 . 2005-04-04 06:07 982016 c:\windows\Downloaded Installations\{1E8CF57A-24E8-4A97-9564-A8F1956C447B}\ISScript11.Msi+ 2005-03-23 16:52 . 2004-08-04 19:00 1326080 c:\windows\system32\webfldrs.msi+ 2007-05-25 16:08 . 2007-05-25 16:08 9609728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp+ 2005-03-23 18:33 . 2005-03-23 18:33 3443712 c:\windows\Installer\e4d2c.msi+ 2006-02-17 03:16 . 2006-02-17 03:16 2117632 c:\windows\Installer\c7557a4.msi+ 2008-11-09 23:21 . 2008-11-09 23:21 8990208 c:\windows\Installer\b6e61.msi+ 2008-11-09 23:19 . 2008-11-09 23:19 1549312 c:\windows\Installer\b6c31.msi+ 2007-10-04 15:02 . 2007-10-04 15:02 2012160 c:\windows\Installer\8bc556.msp+ 2009-02-14 16:17 . 2009-02-14 16:17 2109440 c:\windows\Installer\87c35a.msi+ 2006-10-27 14:30 . 2006-10-27 14:30 3037184 c:\windows\Installer\7f65bdd.msi+ 2009-02-26 15:11 . 2009-02-26 15:11 4245504 c:\windows\Installer\6a76e86.msi+ 2005-11-01 04:21 . 2005-11-01 04:21 1884160 c:\windows\Installer\66d0f52.msi+ 2005-09-18 07:01 . 2005-09-18 07:01 5864960 c:\windows\Installer\520bce1.msp+ 2005-09-17 01:12 . 2005-09-17 01:12 3485184 c:\windows\Installer\41f26c2.msi+ 2008-04-20 20:50 . 2008-04-20 20:50 8687616 c:\windows\Installer\3b924142.msi+ 2009-06-21 15:42 . 2009-06-21 15:42 2130432 c:\windows\Installer\29589e21.msi+ 2005-12-24 17:50 . 2005-12-24 17:50 4006400 c:\windows\Installer\261e34d2.msi+ 2009-03-19 18:23 . 2009-03-19 18:23 1802240 c:\windows\Installer\219f96.msi+ 2008-05-10 02:36 . 2008-05-10 02:36 1351680 c:\windows\Installer\1ec864b.msi+ 2008-04-14 20:33 . 2008-04-14 20:33 1453568 c:\windows\Installer\1c9739d8.msi+ 2008-04-14 20:31 . 2008-04-14 20:31 1868800 c:\windows\Installer\1c9739d2.msi+ 2008-04-14 20:25 . 2008-04-14 20:25 5091840 c:\windows\Installer\1c9739c0.msi+ 2005-09-16 08:29 . 2004-08-11 16:00 4806656 c:\windows\Installer\19f210.msi+ 2006-05-17 03:24 . 2006-05-17 03:24 9299456 c:\windows\Installer\1934e.msp+ 2008-11-09 23:03 . 2008-11-09 23:03 3771904 c:\windows\Installer\183d2d.msi+ 2009-02-22 23:43 . 2009-02-22 23:43 1825792 c:\windows\Installer\10a4737a.msi+ 2009-02-22 23:39 . 2009-02-22 23:39 6568448 c:\windows\Installer\10a4736e.msi+ 2006-10-19 02:10 . 2006-10-19 02:10 2220544 c:\windows\Hewlett-Packard\Setup Files\HP Software Update\{BB4EE741-CA46-4345-A3B7-1AECBFAB0AFE}\HP Software Update.msi+ 2006-03-27 05:33 . 2006-02-08 19:49 9934848 c:\windows\Downloaded Installations\{1E8CF57A-24E8-4A97-9564-A8F1956C447B}\iTunes.msi+ 2005-09-23 12:48 . 2005-09-23 12:48 24863744 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\netfx.msi+ 2006-01-30 18:10 . 2006-01-30 18:10 13048832 c:\windows\Installer\7f65cc4.msp+ 2007-07-12 07:01 . 2007-07-12 07:01 15256576 c:\windows\Installer\3419e791.msp+ 2005-03-23 18:45 . 2005-03-23 18:45 19210240 c:\windows\Installer\19a1ab.msp.-- Snapshot reset to current date --.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]@="{E4000AC4-5E5F-4956-807A-C5854405D64F}"[HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}]2007-11-26 04:29 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-09-23 180269]"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-12-04 176128]"HPHUPD05"="c:\program files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe" [2003-11-12 49152]"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]"HPHmon05"="c:\windows\system32\hphmon05.exe" [2004-02-02 495616]"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]"SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-25 1629480]"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-06-25 1057064]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-01 1948440]"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-31 518488]"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-06-13 1794320]"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-04 158208]c:\documents and settings\Owner\Start Menu\Programs\Startup\Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]VirtualExpander.lnk - c:\windows\system32\VirtualExpander\VirtualExpander.exe [2007-11-26 474808]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2005-9-16 83360][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-07-01 12:58 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]@="Service"[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnkbackup=c:\windows\pss\BigFix.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Metacafe.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Metacafe.lnkbackup=c:\windows\pss\Metacafe.lnkCommon Startup[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Metacafe.lnk]path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Metacafe.lnkbackup=c:\windows\pss\Metacafe.lnkStartup[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Real\\RealPlayer\\realplay.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\AIM6\\aim6.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\AVG\\AVG8\\avgui.exe"="c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWService.exe"="c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe"="c:\\Program Files\\BitTorrent\\bittorrent.exe"="c:\\Program Files\\TESTOUT\\Cmi\\Navigator.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"2499:TCP"= 2499:TCP:Akamai NetSession Interface"5000:UDP"= 5000:UDP:Akamai NetSession Interface"4985:TCP"= 4985:TCP:Akamai NetSession Interface"4444:TCP"= 4444:TCP:Akamai NetSession Interface"1810:TCP"= 1810:TCP:Akamai NetSession Interface"1839:TCP"= 1839:TCP:Akamai NetSession Interface"1863:TCP"= 1863:TCP:Akamai NetSession Interface"3872:TCP"= 3872:TCP:Akamai NetSession Interface"4453:TCP"= 4453:TCP:Akamai NetSession Interface"4745:TCP"= 4745:TCP:Akamai NetSession Interface"1980:TCP"= 1980:TCP:Akamai NetSession Interface"2181:TCP"= 2181:TCP:Akamai NetSession Interface"2341:TCP"= 2341:TCP:Akamai NetSession Interface"2356:TCP"= 2356:TCP:Akamai NetSession Interface"2365:TCP"= 2365:TCP:Akamai NetSession Interface"2879:TCP"= 2879:TCP:Akamai NetSession Interface"1978:TCP"= 1978:TCP:Akamai NetSession Interface"4469:TCP"= 4469:TCP:Akamai NetSession Interface"3678:TCP"= 3678:TCP:Akamai NetSession Interface"3701:TCP"= 3701:TCP:Akamai NetSession Interface"1817:TCP"= 1817:TCP:Akamai NetSession Interface"4926:TCP"= 4926:TCP:Akamai NetSession Interface"1722:TCP"= 1722:TCP:Akamai NetSession Interface"2024:TCP"= 2024:TCP:Akamai NetSession Interface"2061:TCP"= 2061:TCP:Akamai NetSession Interface"1264:TCP"= 1264:TCP:Akamai NetSession Interface"1283:TCP"= 1283:TCP:Akamai NetSession Interface"1602:TCP"= 1602:TCP:Akamai NetSession Interface"1155:TCP"= 1155:TCP:Akamai NetSession Interface"1173:TCP"= 1173:TCP:Akamai NetSession Interface"1212:TCP"= 1212:TCP:Akamai NetSession Interface"1707:TCP"= 1707:TCP:Akamai NetSession Interface"1733:TCP"= 1733:TCP:Akamai NetSession Interface"2268:TCP"= 2268:TCP:Akamai NetSession Interface"4230:TCP"= 4230:TCP:Akamai NetSession Interface"3657:TCP"= 3657:TCP:Akamai NetSession Interface"1369:TCP"= 1369:TCP:Akamai NetSession Interface"1831:TCP"= 1831:TCP:Akamai NetSession Interface"2325:TCP"= 2325:TCP:Akamai NetSession Interface"1181:TCP"= 1181:TCP:Akamai NetSession Interface"1193:TCP"= 1193:TCP:Akamai NetSession Interface"4589:TCP"= 4589:TCP:Akamai NetSession Interface"4935:TCP"= 4935:TCP:Akamai NetSession Interface"1186:TCP"= 1186:TCP:Akamai NetSession Interface"1199:TCP"= 1199:TCP:Akamai NetSession Interface"1897:TCP"= 1897:TCP:Akamai NetSession Interface"1936:TCP"= 1936:TCP:Akamai NetSession Interface"3727:TCP"= 3727:TCP:Akamai NetSession Interface"3756:TCP"= 3756:TCP:Akamai NetSession Interface"3765:TCP"= 3765:TCP:Akamai NetSession Interface"3776:TCP"= 3776:TCP:Akamai NetSession Interface"3853:TCP"= 3853:TCP:Akamai NetSession Interface"4040:TCP"= 4040:TCP:Akamai NetSession Interface"4170:TCP"= 4170:TCP:Akamai NetSession Interface"1121:TCP"= 1121:TCP:Akamai NetSession Interface"2437:TCP"= 2437:TCP:Akamai NetSession Interface"3846:TCP"= 3846:TCP:Akamai NetSession Interface"4777:TCP"= 4777:TCP:Akamai NetSession Interface"2545:TCP"= 2545:TCP:Akamai NetSession Interface"1236:TCP"= 1236:TCP:Akamai NetSession Interface"1339:TCP"= 1339:TCP:Akamai NetSession Interface"2522:TCP"= 2522:TCP:Akamai NetSession Interface"2820:TCP"= 2820:TCP:Akamai NetSession Interface"3754:TCP"= 3754:TCP:Akamai NetSession Interface"3590:TCP"= 3590:TCP:Akamai NetSession Interface"4718:TCP"= 4718:TCP:Akamai NetSession Interface"1117:TCP"= 1117:TCP:Akamai NetSession Interface"3290:TCP"= 3290:TCP:Akamai NetSession Interface"2043:TCP"= 2043:TCP:Akamai NetSession Interface"2220:TCP"= 2220:TCP:Akamai NetSession Interface"2271:TCP"= 2271:TCP:Akamai NetSession Interface"2645:TCP"= 2645:TCP:Akamai NetSession Interface"3608:TCP"= 3608:TCP:Akamai NetSession Interface"3882:TCP"= 3882:TCP:Akamai NetSession Interface"3890:TCP"= 3890:TCP:Akamai NetSession Interface"2719:TCP"= 2719:TCP:Akamai NetSession InterfaceR0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/19/2009 2:23 PM 64160]R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/17/2009 5:23 PM 327688]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/17/2009 5:24 PM 108552]R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [3/20/2009 4:56 PM 132640]R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3/20/2009 4:56 PM 24096]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/17/2009 5:23 PM 298776]R2 OracleServiceXE;OracleServiceXE;c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE --> c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE [?]R2 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\TNSLSNR.EXE [2/2/2006 1:49 AM 204800]S0 Partizan;Partizan;c:\windows\system32\drivers\Partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/16/2009 4:00 AM 101936]S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1005904]S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [3/17/2009 9:54 PM 29584]S4 OracleJobSchedulerXE;OracleJobSchedulerXE;c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE --> c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE [?][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvcAkamai REG_MULTI_SZ Akamai[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]"c:\program files\Common Files\LightScribe\LSRunOnce.exe".Contents of the 'Scheduled Tasks' folder2009-07-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 17:07]2009-06-28 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]2009-07-03 c:\windows\Tasks\HP Usg Daily.job- c:\program files\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\pexpress\hphped05.exe [2004-01-06 18:05].- - - - ORPHANS REMOVED - - - -ShellExecuteHooks-{F552DDE6-2090-4bf4-B924-6141E87789A5} - (no file).------- Supplementary Scan -------.uStart Page = hxxp://www.yahoo.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Connection Wizard,ShellNext = hxxp://www.yahoo.com/uSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htmIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htmIE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htmIE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htmDPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exeFF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\kizt2imz.default\FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.comFF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dllFF - plugin: c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071500000347.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dllFF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dllFF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-07-03 10:59Windows 5.1.2600 Service Pack 2 NTFSdetected NTDLL code modification:ZwClose, ZwOpenFilescanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'lsass.exe'(1012)c:\windows\system32\guard32.dll- - - - - - - > 'explorer.exe'(1484)c:\windows\system32\guard32.dllc:\windows\system32\VirtualExpander\VEShellExt.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\program files\COMODO\COMODO Internet Security\cmdagent.exec:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exec:\program files\Nero\Nero 7\InCD\InCDsrv.exec:\program files\Common Files\LightScribe\LSSrvc.exec:\program files\AVG\AVG8\avgrsx.exec:\oraclexe\app\oracle\product\10.2.0\server\BIN\oracle.exec:\progra~1\AVG\AVG8\avgnsx.exec:\program files\AVG\AVG8\avgcsrvx.exec:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYSc:\program files\Spyware Terminator\sp_rsser.exec:\program files\Common Files\Symantec Shared\Security Center\symwsc.exec:\windows\system32\wscntfy.exec:\program files\iPod\bin\iPodService.exec:\program files\Common Files\Symantec Shared\Security Center\SymSCUI.exec:\program files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe.**************************************************************************.Completion time: 2009-07-03 11:06 - machine was rebootedComboFix-quarantined-files.txt 2009-07-03 15:06ComboFix2.txt 2009-07-02 06:18Pre-Run: 39,030,665,216 bytes freePost-Run: 39,012,704,256 bytes free427 --- E O F --- 2009-06-11 07:05 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 4, 2009 Root Admin ID:95603 Share Posted July 4, 2009 Please run the following and I'll have to finish up later on. It's late and I may be away for most of the weekend.Click on START - RUN and copy / paste the entry below into the run line and click OKCMD /C NETSH FIREWALL RESETClick on START - RUN and copy / paste the entry below into the run line and click OKCMD /C NETSH int ip reset c:\resetlog.txtUpdate and Scan with Malwarebytes' Anti-MalwareStart MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.Update Malwarebytes' Anti-Malware Select the Update tabClick Update[*]When the update is complete, select the Scanner tab[*]Select Perform quick scan, then click Scan.[*]When the scan is complete, click OK, then Show Results to view the results.[*]Be sure that everything is checked, and click Remove Selected.[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidently close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtThen post back the MBAM log and a new Hijackthis log. Link to post Share on other sites More sharing options...
Jay320 Posted July 4, 2009 Author ID:95658 Share Posted July 4, 2009 I followed these latest instructions, updated and ran malwarebytes again. I got the same results as before - nothing was found, nothing removed. I'm not on my computer right now (meaning I'll have to post the logs at a later time) but I wanted to add this while it was all fresh in my memory. I realize what that aries.sys stuff is - it's from the Sony rootkit that comes with those copyright protected CDs. Well after using ComboFix to remove that junk, my CD/DVD drive no longer works. I get the wonderful Code 19 registry error when I look in device manager. I tried that whole thing about removing the Upper and Lower Filters but that didn't work. I followed Windows' advice of simply uninstalling the device and reinstalling it, but that did nothing either. This problem is almost as annoying as the ones I started out with! Anyway, if there is a simple fix for this, I would really appreciate learning what it is because I don't want to mess with the registry and cause more problems. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 4, 2009 Root Admin ID:95690 Share Posted July 4, 2009 I'll research and see if I can find a fix for it or not and get back to you. Link to post Share on other sites More sharing options...
Jay320 Posted July 5, 2009 Author ID:95850 Share Posted July 5, 2009 Okay, I managed to fix the CD-ROM drive problem. There was a program from Sony/XCM that you can run to remove any lingering registry entries from the crater.sys, aries.sys, etc. files. There were several other Upper/lower filters that referenced these (which couldn't be found because they were removed by ComboFix, thus causing the problem). Anyway, everything seems to be in order with that. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 5, 2009 Root Admin ID:95895 Share Posted July 5, 2009 Great, glad to hear all is working well again.I'll close your post soon so that other don't post into it and leave you with this information and suggestions.So how did I get infected in the first place?At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:Remove all but the most recent Restore Point on Windows XPYou should Create a New Restore Point to prevent possible reinfection from an old one.Some of the malware you picked up could have been saved in System Restore.Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.The easiest and safest way to do this is:Go to Start > Programs > Accessories > System Tools and click "System Restore".If the shortcut is missing you can also click on START > RUN > and type in %SystemRoot%\system32\restore\rstrui.exe and click OKChoose the radio button marked "Create a Restore Point" on the first screen then click "Next".Give the new Restore Point a name, then click "Create".The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.Then use the Disk Cleanup to remove all but the most recently created Restore Point.Go to Start > Run and type: Cleanmgr.exeSelect the drive where Windows is installed and click "Ok". Disk Cleanup will scan your files for several minutes, then open.Click the "More Options" tab, then click the "Clean up" button under System Restore.Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"Click Yes, then click Ok.Click Yes again when prompted with "Are you sure you want to perform these actions?"Disk Cleanup will remove the files and close automatically.On the Disk Cleanup tab, if the System Restore: Obsolete Data Stores entry is available remove them also.These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.Additional informationMicrosoft KB article: How to turn off and turn on System Restore in Windows XPBert Kinney's site: All about Windows System RestoreHere are some free programs I recommend that could help you improve your computer's security.Install SpyWare BlasterDownload it from hereFind here the tutorial on how to use Spyware Blaster here Install WinPatrolDownload it from hereHere you can find information about how WinPatrol works hereInstall FireTrust SiteHoundYou can find information and download it from hereInstall hpHosts Download it from herehpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad, tracking and malicious websites. This prevents your computer from connecting to these untrusted sites by redirecting them to 127.0.0.1 which is your own local computer.hpHosts Support ForumUpdate your Antivirus programs and other security products regularly to avoid new threats that could infect your system.You can use one of these sites to check if any updates are needed for your pc.Secunia Software InspectorF-secure Health CheckVisit Microsoft often to get the latest updates for your computer.http://www.update.microsoft.comNote 1: If you are running Windows XP SP2, you should upgrade to SP3.Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.The security suite can then be reinstalled afterwards.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. I recommend Online Armor FreeA little outdated but good reading on how to prevent MalwareKeep safe online and happy surfing.Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post InstructionsAlso don't forget that we offer FREE assistance with General PC questions and repair here PC Help If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org Link to post Share on other sites More sharing options...
Recommended Posts