freeloader13 Posted July 17, 2009 ID:99670 Share Posted July 17, 2009 Malwarebytes' Anti-Malware 1.39Database version: 2438Windows 5.1.2600 Service Pack 37/16/2009 5:35:06 PMmbam-log-2009-07-16 (17-35-06).txtScan type: Quick ScanObjects scanned: 109500Time elapsed: 21 minute(s), 47 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 1Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 4:18:58 AM, on 7/17/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16850)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\ARPWRMSG.EXEC:\Program Files\Hp\HP Software Update\HPWuSchd2.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\Malwarebytes' Anti-Malware\Myscan.exeC:\Program Files\AVG\AVG8\avgui.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://*.trymedia.com (HKLM)O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} (XTSAC Control) - https://secure.mynhs.com/XTSAC.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://secure.mynhs.com/msrdp.cabO16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO22 - SharedTaskScheduler: Apartment - ThreadingModel - (no file)O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 6932 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 17, 2009 Root Admin ID:99678 Share Posted July 17, 2009 Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofixPlease ensure you read this guide carefully and install the Recovery Console first.NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the programAdditional links to download the tool:ComboFix.exeComboFix.exeComboFix.exeNote: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.Once installed, you should see a blue screen prompt that says:The Recovery Console was successfully installed.Please continue as follows:Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Click Yes to allow ComboFix to continue scanning for malware.When the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 18, 2009 Root Admin ID:99958 Share Posted July 18, 2009 Please post a status update on this.Thanks. Link to post Share on other sites More sharing options...
freeloader13 Posted July 18, 2009 Author ID:100019 Share Posted July 18, 2009 Sorry for the delay.ComboFix 09-07-14.08 - Compaq_Administrator 07/18/2009 1:31.1.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.447.115 [GMT -4:00]Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\kb913800.exec:\windows\system32\_000006_.tmp.dllc:\windows\system32\_000007_.tmp.dllc:\windows\system32\_000010_.tmp.dllc:\windows\system32\_000011_.tmp.dllc:\windows\system32\_000012_.tmp.dllc:\windows\system32\drivers\hjgruiowprrirs.sysc:\windows\system32\drivers\UACjbmltxeenkgkvpppo.sysc:\windows\system32\hjgruiqjomqhsl.datc:\windows\system32\hjgruiskllrrgf.dllc:\windows\system32\hjgruitptgknsx.datc:\windows\system32\hjgruiwqaiqjnk.dllc:\windows\system32\UACetiqfpyckiemhuyue.dllc:\windows\system32\uacinit.dllc:\windows\system32\UACmmlwbdvbfpmfjxvit.dllc:\windows\system32\UACoodbqakltfuwbxtot.dllc:\windows\system32\uactmp.dbc:\windows\system32\UACwpmuleovdlyprqxep.dbc:\windows\system32\UACxexyxgqtyqmhsnwjd.dllc:\windows\system32\UACxhowbnymreetalqie.datc:\windows\system32\UACxuflubrrduthjbwdq.dllc:\windows\wiaserviv.logD:\Autorun.infc:\windows\system32\proquota.exe . . . is missing!!.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Service_hjgruidhosnmvr-------\Service_UACd.sys-------\Legacy_6TO4-------\Legacy_PCMSTUB-------\Service_6to4((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 ))))))))))))))))))))))))))))))).2009-07-17 08:41 . 2009-07-17 08:41 0 ----a-w- c:\documents and settings\Compaq_Administrator\settings.dat2009-07-17 08:13 . 2009-07-17 08:13 -------- d-----w- c:\program files\Trend Micro2009-07-17 03:52 . 2009-07-17 06:34 -------- d-----w- c:\documents and settings\Compaq_Administrator\.housecall6.62009-07-14 22:31 . 2009-07-14 22:31 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Malwarebytes2009-07-14 22:17 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2009-07-14 22:17 . 2009-07-14 22:17 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes2009-07-14 22:17 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys2009-07-14 21:41 . 2009-07-14 21:41 -------- d--h--w- c:\windows\system32\GroupPolicy2009-07-14 21:10 . 2009-07-14 22:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2009-07-13 01:34 . 2004-08-09 21:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys2009-07-13 01:34 . 2004-08-09 21:00 4224 ----a-w- c:\windows\system32\dllcache\beep.sys.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-07-18 05:45 . 2008-07-15 23:12 0 ----a-w- c:\documents and settings\Family\Local Settings\Application Data\prvlcl.dat2009-07-18 05:17 . 2006-09-04 21:32 -------- d-----w- c:\program files\DISC2009-07-17 18:01 . 2008-08-16 23:15 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys2009-07-17 07:05 . 2007-01-02 04:50 1366 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat2009-07-16 23:59 . 2006-09-04 21:33 47752 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-07-13 16:51 . 2008-08-16 23:03 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Avg82009-06-23 20:44 . 2008-08-16 23:15 11952 ----a-w- c:\windows\system32\avgrsstx.dll2009-06-23 20:44 . 2008-08-16 23:15 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2009-06-16 14:36 . 2004-08-10 04:00 81920 ------w- c:\windows\system32\fontsub.dll2009-06-16 14:36 . 2004-08-10 04:00 119808 ------w- c:\windows\system32\t2embed.dll2009-06-03 19:09 . 2004-08-10 04:00 1291264 ----a-w- c:\windows\system32\quartz.dll2009-05-29 02:06 . 2009-05-29 02:05 -------- d-----w- c:\program files\iTunes2009-05-29 02:06 . 2009-05-29 02:05 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}2009-05-29 02:06 . 2009-05-29 02:06 -------- d-----w- c:\program files\iPod2009-05-29 02:06 . 2007-09-11 04:33 -------- d-----w- c:\program files\Common Files\Apple2009-05-29 02:04 . 2009-05-29 02:04 -------- d-----w- c:\program files\Bonjour2009-05-08 00:59 . 2008-08-16 23:15 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys2009-05-07 15:32 . 2004-08-10 04:00 345600 ------w- c:\windows\system32\localspl.dll2009-04-29 04:56 . 2004-08-10 04:00 827392 ----a-w- c:\windows\system32\wininet.dll2009-04-29 04:55 . 2004-08-10 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll2009-06-14 03:22 . 2009-03-19 06:58 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-23 1948440]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]"DISCover"="c:\program files\DISC\DISCover.exe" [2007-10-31 1095256]"ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496]"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616]"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-03 77312]c:\documents and settings\Default User\Start Menu\Programs\Startup\Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-4 27136]PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-4 27136]c:\documents and settings\Family\Start Menu\Programs\Startup\PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-4 27136][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-06-23 20:44 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnkbackup=c:\windows\pss\Compaq Connections.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\AIM\\aim.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\LimeWire\\LimeWire.exe"="c:\\Program Files\\DISC\\DISCover.exe"="c:\\Program Files\\DISC\\DiscStreamHub.exe"="c:\\Program Files\\AVG\\AVG8\\avgemc.exe"="c:\\Program Files\\AVG\\AVG8\\avgupd.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/16/2008 7:15 PM 335752]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/16/2008 7:15 PM 108552]R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/16/2008 7:14 PM 907032]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/16/2008 7:14 PM 298776]S2 zqzvj;zqzvj;\??\c:\windows\system32\drivers\dtbubgewyjzjzd.sys --> c:\windows\system32\drivers\dtbubgewyjzjzd.sys [?].- - - - ORPHANS REMOVED - - - -SharedTaskScheduler-<NO NAME> - (no file)SharedTaskScheduler-ThreadingModel - (no file)SafeBoot-AVG Anti-Spyware DriverSafeBoot-AVG Anti-Spyware Guard.------- Supplementary Scan -------.uStart Page = hxxp://www.google.comuDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktopmStart Page = hxxp://www.google.commSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktopuInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = *.localTrusted Zone: mynhs.com\secureTrusted Zone: trymedia.comFF - ProfilePath - c:\docume~1\COMPAQ~1\APPLIC~1\Mozilla\Firefox\Profiles\lcymdy9w.default\FF - prefs.js: browser.search.selectedEngine - Yahoo! AnswersFF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-07-18 01:41Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(568)c:\windows\system32\Ati2evxx.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\ati2evxx.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\windows\arservice.exec:\program files\Bonjour\mDNSResponder.exec:\windows\ehome\ehrecvr.exec:\windows\ehome\ehSched.exec:\windows\system32\wdfmgr.exec:\program files\AVG\AVG8\avgrsx.exec:\progra~1\AVG\AVG8\avgnsx.exec:\windows\ehome\mcrdsvc.exec:\program files\AVG\AVG8\avgcsrvx.exec:\windows\system32\dllhost.exec:\windows\system32\ati2evxx.exec:\windows\system32\wscntfy.exec:\windows\ehome\ehmsas.exec:\program files\DISC\DiscStreamHub.exec:\program files\iPod\bin\iPodService.exe.**************************************************************************.Completion time: 2009-07-18 1:48 - machine was rebootedComboFix-quarantined-files.txt 2009-07-18 05:48Pre-Run: 47,369,121,792 bytes freePost-Run: 47,510,953,984 bytes free191 --- E O F --- 2009-07-14 21:59 Link to post Share on other sites More sharing options...
freeloader13 Posted July 18, 2009 Author ID:100186 Share Posted July 18, 2009 Oops! missed the part about posting another hijackThis log.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:48:39 PM, on 7/18/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16850)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\ARPWRMSG.EXEC:\Program Files\Hp\HP Software Update\HPWuSchd2.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\DISC\DISCover.exeC:\Program Files\DISC\DiscStreamHub.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exec:\windows\system\hpsysdrv.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://*.trymedia.com (HKLM)O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} (XTSAC Control) - https://secure.mynhs.com/XTSAC.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://secure.mynhs.com/msrdp.cabO16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 6675 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 21, 2009 Root Admin ID:100779 Share Posted July 21, 2009 STEP 01Download but do not yet run ComboFixIf you have a previous version of Combofix.exe, delete it and download a fresh copy.Download it to your DESKTOP - it MUST run from the Desktopdownload.bleepingcomputer.com/sUBs/ComboFix.exesubs.geekstogo.com/ComboFix.exeUsing your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank linesKILLALL::Driver::zqzvjFile::c:\windows\system32\drivers\dtbubgewyjzjzd.sysOpen a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.Disconnect from the Internet. Disable your Antivirus software. If it has Script Blocking features, please disable these as well. A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed. When the scan completes Notepad will open with with your results log open. Do a File, Exit.A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.Post back the Combofix log on your next reply.STEP 02Update and Scan with Malwarebytes' Anti-MalwareStart MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.Update Malwarebytes' Anti-Malware Select the Update tabClick Update[*]When the update is complete, select the Scanner tab[*]Select Perform quick scan, then click Scan.[*]When the scan is complete, click OK, then Show Results to view the results.[*]Be sure that everything is checked, and click Remove Selected.[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidently close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtThen post back the MBAM log and a new Hijackthis log.STEP 03Temporarily disable your current Anti-Virus and run this Online AV scanner.Run Eset NOD32 Online AntiVirusNote: You will need to use Internet Explorer for this scan.Tick the box next to YES, I accept the Terms of Use.Click Start When asked, allow the activex control to installDisable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.Click Start Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checkedClick ScanWait for the scan to finishRe-enable your Anvirisus software.A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post. Link to post Share on other sites More sharing options...
freeloader13 Posted July 22, 2009 Author ID:101382 Share Posted July 22, 2009 ComboFix 09-07-22.01 - Compaq_Administrator 07/22/2009 14:59.2.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.447.120 [GMT -4:00]Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Compaq_Administrator\Desktop\CFscript.txtAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}FILE ::"c:\windows\system32\drivers\dtbubgewyjzjzd.sys".((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\system32\proquota.exe . . . is missing!!.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_ZQZVJ-------\Service_zqzvj((((((((((((((((((((((((( Files Created from 2009-06-22 to 2009-07-22 ))))))))))))))))))))))))))))))).2009-07-17 18:03 . 2009-06-23 20:44 327688 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgldx86.sys2009-07-17 18:03 . 2009-06-23 20:44 2052376 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgcorex.dll2009-07-17 18:02 . 2009-06-23 20:44 906520 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgemc.exe2009-07-17 18:02 . 2009-06-23 20:44 2167576 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgresf.dll2009-07-17 18:02 . 2009-06-23 20:44 2301208 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avguiadv.dll2009-07-17 18:02 . 2009-06-23 20:44 3402008 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgui.exe2009-07-17 18:02 . 2009-06-23 20:44 1204504 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgabout.dll2009-07-17 18:02 . 2009-06-23 20:44 337176 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avglogx.dll2009-07-17 18:02 . 2009-06-23 20:44 829208 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgcfgx.dll2009-07-17 18:02 . 2009-06-23 20:44 3298072 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\setup.exe2009-07-17 18:00 . 2009-06-23 20:43 1454360 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgupd.dll2009-07-17 18:00 . 2009-06-23 20:43 1085208 ----a-w- c:\documents and settings\All Users\Application Data\Avg8\update\backup\avgupd.exe2009-07-17 08:41 . 2009-07-18 21:46 14 ----a-w- c:\documents and settings\Compaq_Administrator\settings.dat2009-07-17 08:13 . 2009-07-17 08:13 -------- d-----w- c:\program files\Trend Micro2009-07-17 03:52 . 2009-07-17 06:34 -------- d-----w- c:\documents and settings\Compaq_Administrator\.housecall6.62009-07-14 22:31 . 2009-07-14 22:31 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Malwarebytes2009-07-14 22:17 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2009-07-14 22:17 . 2009-07-14 22:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2009-07-14 22:17 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys2009-07-14 21:41 . 2009-07-14 21:41 -------- d--h--w- c:\windows\system32\GroupPolicy2009-07-14 21:10 . 2009-07-14 22:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2009-07-13 01:34 . 2004-08-09 21:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys2009-07-13 01:34 . 2004-08-09 21:00 4224 ----a-w- c:\windows\system32\dllcache\beep.sys.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-07-21 19:46 . 2008-07-15 23:12 0 ----a-w- c:\documents and settings\Family\Local Settings\Application Data\prvlcl.dat2009-07-21 18:08 . 2007-01-19 06:27 -------- d-----w- c:\program files\AIM2009-07-21 18:08 . 2007-01-19 06:28 -------- d-----w- c:\documents and settings\Compaq_Administrator\Application Data\Aim2009-07-18 05:17 . 2006-09-04 21:32 -------- d-----w- c:\program files\DISC2009-07-17 18:01 . 2008-08-16 23:15 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys2009-07-17 07:05 . 2007-01-02 04:50 1366 ----a-w- c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat2009-07-16 23:59 . 2006-09-04 21:33 47752 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-07-13 16:51 . 2008-08-16 23:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg82009-06-23 20:44 . 2008-08-16 23:15 11952 ----a-w- c:\windows\system32\avgrsstx.dll2009-06-23 20:44 . 2008-08-16 23:15 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2009-06-16 14:36 . 2004-08-10 04:00 81920 ------w- c:\windows\system32\fontsub.dll2009-06-16 14:36 . 2004-08-10 04:00 119808 ------w- c:\windows\system32\t2embed.dll2009-06-03 19:09 . 2004-08-10 04:00 1291264 ----a-w- c:\windows\system32\quartz.dll2009-05-29 02:06 . 2009-05-29 02:05 -------- d-----w- c:\program files\iTunes2009-05-29 02:06 . 2009-05-29 02:05 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}2009-05-29 02:06 . 2009-05-29 02:06 -------- d-----w- c:\program files\iPod2009-05-29 02:06 . 2007-09-11 04:33 -------- d-----w- c:\program files\Common Files\Apple2009-05-29 02:04 . 2009-05-29 02:04 -------- d-----w- c:\program files\Bonjour2009-05-29 02:00 . 2009-05-29 02:00 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe2009-05-08 00:59 . 2008-08-16 23:15 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys2009-05-07 15:32 . 2004-08-10 04:00 345600 ------w- c:\windows\system32\localspl.dll2009-04-29 04:56 . 2004-08-10 04:00 827392 ----a-w- c:\windows\system32\wininet.dll2009-04-29 04:55 . 2004-08-10 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll2009-06-14 03:22 . 2009-03-19 06:58 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-23 1948440]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]"DISCover"="c:\program files\DISC\DISCover.exe" [2007-10-31 1095256]"ftutil2"="ftutil2.dll" - c:\windows\system32\ftutil2.dll [2004-06-07 106496]"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2006-06-14 16239616]"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-03 77312]c:\documents and settings\Default User\Start Menu\Programs\Startup\Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-4 27136]PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-4 27136]c:\documents and settings\Family\Start Menu\Programs\Startup\PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-4 27136][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2009-06-23 20:44 11952 ----a-w- c:\windows\system32\avgrsstx.dll[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnkbackup=c:\windows\pss\Compaq Connections.lnkCommon Startup[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Compaq Connections\\5577497\\Program\\Compaq Connections.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\LimeWire\\LimeWire.exe"="c:\\Program Files\\DISC\\DISCover.exe"="c:\\Program Files\\DISC\\DiscStreamHub.exe"="c:\\Program Files\\AVG\\AVG8\\avgemc.exe"="c:\\Program Files\\AVG\\AVG8\\avgupd.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/16/2008 7:15 PM 335752]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/16/2008 7:15 PM 108552]R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/16/2008 7:14 PM 907032]R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/16/2008 7:14 PM 298776].Contents of the 'Scheduled Tasks' folder2009-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34].- - - - ORPHANS REMOVED - - - -SharedTaskScheduler-<NO NAME> - (no file).------- Supplementary Scan -------.uStart Page = hxxp://www.google.comuDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktopmStart Page = hxxp://www.google.commSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESARIO&pf=desktopuInternet Connection Wizard,ShellNext = iexploreuInternet Settings,ProxyOverride = *.localTrusted Zone: mynhs.com\secureTrusted Zone: trymedia.comFF - ProfilePath - c:\documents and settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\lcymdy9w.default\FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://*.trymedia.com (HKLM)O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cabO16 - DPF: {44C1E3A2-B594-401C-B27A-D1B4476E4797} (XTSAC Control) - https://secure.mynhs.com/XTSAC.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cabO16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cabO16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://secure.mynhs.com/msrdp.cabO16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 6753 bytesESETSmartInstaller@High as CAB hook log:OnlineScanner.ocx - registred OK# version=6# iexplore.exe=7.00.6000.16850 (vista_gdr.090423-0018)# OnlineScanner.ocx=1.0.0.5886# api_version=3.0.2# EOSSerial=3037ca7240addb4e8fc922a68a092836# end=finished# remove_checked=false# archives_checked=false# unwanted_checked=true# unsafe_checked=false# antistealth_checked=true# utc_time=2009-07-22 07:53:14# local_time=2009-07-22 03:53:14 (-0500, Eastern Daylight Time)# country="United States"# lang=9# osver=5.1.2600 NT Service Pack 3# compatibility_mode=1026 37 83 97 4387156818318# scanned=11309# found=0# cleaned=0# scan_time=299 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 23, 2009 Root Admin ID:101556 Share Posted July 23, 2009 The system looks clean now but you need to get a copy of this file from an XP CD or another clean XP computer.c:\windows\system32\proquota.exe . . . is missing!!STEP AUninstall ComboFix.exeClick START then RUNNow type Combofix /u (if you renamed Combofix.exe use that name instead) in the runbox and click OK. Note the space between the X and the /U, it needs to be there.When shown the disclaimer, Select "2"Remove this folder C:\QooBox if the uninstall instructions don't work and delete Combofix.exe AND check your system time and reset if needed Link to post Share on other sites More sharing options...
freeloader13 Posted July 24, 2009 Author ID:101876 Share Posted July 24, 2009 Thanks for all ur help!! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 24, 2009 Root Admin ID:101897 Share Posted July 24, 2009 Okay you're quite welcome. Don't forget to get that file replaced.Great, all looks good now.I'll close your post soon so that other don't post into it and leave you with this information and suggestions.So how did I get infected in the first place?At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:Remove all but the most recent Restore Point on Windows XPYou should Create a New Restore Point to prevent possible reinfection from an old one.Some of the malware you picked up could have been saved in System Restore.Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.The easiest and safest way to do this is:Go to Start > Programs > Accessories > System Tools and click "System Restore".If the shortcut is missing you can also click on START > RUN > and type in %SystemRoot%\system32\restore\rstrui.exe and click OKChoose the radio button marked "Create a Restore Point" on the first screen then click "Next".Give the new Restore Point a name, then click "Create".The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.Then use the Disk Cleanup to remove all but the most recently created Restore Point.Go to Start > Run and type: Cleanmgr.exeSelect the drive where Windows is installed and click "Ok". Disk Cleanup will scan your files for several minutes, then open.Click the "More Options" tab, then click the "Clean up" button under System Restore.Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"Click Yes, then click Ok.Click Yes again when prompted with "Are you sure you want to perform these actions?"Disk Cleanup will remove the files and close automatically.On the Disk Cleanup tab, if the System Restore: Obsolete Data Stores entry is available remove them also.These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.Additional informationMicrosoft KB article: How to turn off and turn on System Restore in Windows XPBert Kinney's site: All about Windows System RestoreHere are some free programs I recommend that could help you improve your computer's security.Install SpyWare BlasterDownload it from hereFind here the tutorial on how to use Spyware Blaster here Install WinPatrolDownload it from hereHere you can find information about how WinPatrol works hereInstall FireTrust SiteHoundYou can find information and download it from hereInstall hpHosts Download it from herehpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad, tracking and malicious websites. This prevents your computer from connecting to these untrusted sites by redirecting them to 127.0.0.1 which is your own local computer.hpHosts Support ForumUpdate your Antivirus programs and other security products regularly to avoid new threats that could infect your system.You can use one of these sites to check if any updates are needed for your pc.Secunia Software InspectorF-secure Health CheckVisit Microsoft often to get the latest updates for your computer.http://www.update.microsoft.comNote 1: If you are running Windows XP SP2, you should upgrade to SP3.Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.The security suite can then be reinstalled afterwards.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. I recommend Online Armor FreeA little outdated but good reading on how to prevent MalwareKeep safe online and happy surfing.Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post InstructionsAlso don't forget that we offer FREE assistance with General PC questions and repair here PC Help If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org Link to post Share on other sites More sharing options...
Recommended Posts