The bug bit the 'bytes

[KPP]

Hi Y'all,

While trying to locate a good copy of State of Play to watch, I picked up the nasty, persistent & pesky redirect bug that sends you to thefeedbag.com site. I added that site, along with all the other redirects, to my "restricted sites." However, no go. The bug is stronger than Microsoft.

So I downloaded Malwarebytes and ran it. It showed me a list of infected files. I selected "removal" & got an error message that "Malwarebytes had to close because an error was detected." In other words, the bug bit the 'bytes.[/i]

I have attached 2 screen captures: 1) From Malwarebytes listing the infected files, and 2) The Error #14 message from my AT&T email.

Last time this happened, I did download Combo-Fix, so I have it. But I know enough to know not to do anything on my own. So, I followed your astute directions to first disable certain programs. However, that merely led me to Bleeping Computer Forums, but not to the list of programs. I even registered at Bleeping, to see if I could find the list, but no go.

So please tell me what programs to disable ... and walk me thru getting rid of this bug. Thanking you from the bottom of my heart ... in advance ...

[KPP]

Hi Y'all,

While trying to locate a good copy of State of Play to watch, I picked up the nasty, persistent & pesky redirect bug that sends you to thefeedbag.com site. I added that site, along with all the other redirects, to my "restricted sites." However, no go. The bug is stronger than Microsoft.

So I downloaded Malwarebytes and ran it. It showed me a list of infected files. I selected "removal" & got an error message that "Malwarebytes had to close because an error was detected." In other words, the bug bit the 'bytes.[/i]

I have attached 2 screen captures: 1) From Malwarebytes listing the infected files, and 2) The Error #14 message from my AT&T email.

Last time this happened, I did download Combo-Fix, so I have it. But I know enough to know not to do anything on my own. So, I followed your astute directions to first disable certain programs. However, that merely led me to Bleeping Computer Forums, but not to the list of programs. I even registered at Bleeping, to see if I could find the list, but no go.

So please tell me what programs to disable ... and walk me thru getting rid of this bug. Thanking you from the bottom of my heart ... in advance ...

Oh ... forgot to mention ... my dog is a little ill, so if I don't respond promptly, that's why. He also got bit ... but, alas, not just in cyberspace. He got a bad bite that abscessed & I am concurrently dealing with that. Like the cyber bug, he can easily circumvent any of my efforts to keep him from licking the abscess. It keeps me on my toes, to say the least.

[KPP]

I just ran Advanced SystemCare and got this log file. I figured I better post it while I can.

Logfile of Advanced SystemCare 3 Security Analyzer

Scan saved at 4:33:56 AM, on 10/11/2009

Platform: Windows XP (WinNT 5.1)

MSIE: Internet Explorer v7.0 (7.0.5730.13)

Boot mode: Normal

Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKCU\..\Run: [calc] rundll32.exe

C:\DOCUME~1\Kate\ntuser.dll,_IWMPEvents@0

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [calc] rundll32.exe

C:\WINDOWS\system32\calc.dll,_IWMPEvents@0

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program

Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo

Uploader 5 Control) -

http://upload.facebook.com/controls/2009.0...bookPhotoUpload

er55.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in

1.6.0_01) - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in

1.6.0_01) - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in

1.6.0_01) - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common

Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program

Files\Common Files\Motive\McciCMService.exe

[KPP]

Here's the Hijack This Log file.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:31:41 AM, on 10/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Documents and Settings\Kate\Application Data\seres.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\Kate\Application Data\svcst.exe

C:\WINDOWS\system32\drwtsn32.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dallas.craigslist.org/wrg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\Kate\ntuser.dll,_IWMPEvents@0

O4 - HKCU\..\Run: [mserv] C:\Documents and Settings\Kate\Application Data\seres.exe

O4 - HKCU\..\Run: [svchost] C:\Documents and Settings\Kate\Application Data\svcst.exe

O15 - Trusted Zone: ll.media.abc.com

O15 - Trusted Zone: http://*.abc.com

O15 - Trusted Zone: gksrv.fox.com

O15 - Trusted Zone: http://www.fox.com

O15 - Trusted Zone: http://abc.go.com

O15 - Trusted Zone: fep.abc.go.com

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--

End of file - 4235 bytes

[AdvancedSetup]

The MBAM logs show you did not tell MBAM to fix it. You need to tell MBAM to fix anything found.

STEP 01

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then post back the MBAM log

STEP 02

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Tools->Options->Main tab
     
   • Set to "Always ask me where to Save the files".
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

If this doesn't work either, try the same method (above method), but name Combofix.exe to iexplore.exe instead, or winlogon.exe..

This because It also happens in some cases that malware blocks EVERY process except for what is in its own whitelist, so this whitelist also includes system important processes such as iexplore.exe, explorer.exe, winlogon.exe...

[KPP]

In my original post, I said "I downloaded Malwarebytes and ran it. It showed me a list of infected files. I selected "removal" & got an error message that "Malwarebytes had to close because an error was detected." After that, every time I tried to run Malwarebytes, I got a message that "Malwarebytes is already running." I attached a screen shot to that 1st post of the list of infected files.

[AdvancedSetup]

Then please proceed and run CF.

[KPP]

Also, with regard to your direction:

"Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask."

AND I had mentioned in my 1st post:

I followed your astute directions to first disable certain programs. However, that merely led me to Bleeping Computer Forums, but not to the list of programs. I even registered at Bleeping, to see if I could find the list, but no go.

So please tell me what programs to disable as I don't have a clue what script blocking is.

[AdvancedSetup]

The link is there in the post and is here to show you again, and lists most all common security products: http://www.bleepingcomputer.com/forums/topic114351.html

[KPP]

for some reason, can't copy and past the Combo-Fix Log. Keep getting message that i t is too long. SO I'M ATTACHING:

1) Combo-Fix Log 2) Combo-Fix quarantined-files.txt and 3) New Hijack This Log

Also was not allowed to upload the Hijack This Log, so I renamed it "Renamed hijack log" and it is attached.

[KPP]

The sun is about to rise (we hope - actually it's been raining for a month). Anyway, I'm off to catch a few winks. Will be back on at 3 pm CST.

[AdvancedSetup]

Are you able to run and update MBAM and do a Quick Scan now.

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

Then post back the MBAM log and a new Hijackthis log.

[KPP]

HIJACK THIS LOG:[

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:03:51 PM, on 10/13/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dallas.craigslist.org/wrg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O15 - Trusted Zone: ll.media.abc.com

O15 - Trusted Zone: http://*.abc.com

O15 - Trusted Zone: gksrv.fox.com

O15 - Trusted Zone: http://www.fox.com

O15 - Trusted Zone: http://abc.go.com

O15 - Trusted Zone: fep.abc.go.com

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--

End of file - 3105 bytes

MBAM LOG FILE

Malwarebytes' Anti-Malware 1.41

Database version: 2955

Windows 5.1.2600 Service Pack 3

10/13/2009 5:47:26 PM

mbam-log-2009-10-13 (17-47-26).txt

Scan type: Quick Scan

Objects scanned: 98762

Time elapsed: 21 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[AdvancedSetup]

The HJT log does not look right.

Please run the following.

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

1. DDS.txt
   
   
2. Attach.txt
   
   

• Save both reports to your desktop
  
  
• Please include the following logs in your next reply:
  DDS.txt
  and
  Attach.txt
  
  

Please temporarily disable your current Anti-Virus in order to run this Online AV scanner.

Run Eset NOD32 Online AntiVirus

Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activex control to install
  
• Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
  
• Click Start
  
• Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
  
• Click Scan
  
• Wait for the scan to finish
  
• Re-enable your Anvirisus software.
  
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
  

[AdvancedSetup]

Please post an update

[KPP]

Please post an update

DDS (Ver_09-10-13.01) - NTFSx86

Run by Kate at 21:23:03.14 on Wed 10/14/2009

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_01

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.63 [GMT -5:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Kate\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://dallas.craigslist.org/wrg/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

uRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

Trusted Zone: abc.com

Trusted Zone: abc.com\ll.media

Trusted Zone: fox.com\gksrv

Trusted Zone: fox.com\www

Trusted Zone: go.com\abc

Trusted Zone: go.com\fep.abc

Trusted Zone: google.com\www

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kate\applic~1\mozilla\firefox\profiles\dav8808z.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://dallas.craigslist.org/dal/etc/

FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

S3 AdWatchDrv;AW Realtime Driver;\??\c:\windows\system32\drivers\awrtpd.sys --> c:\windows\system32\drivers\AWRTPD.sys [?]

=============== Created Last 30 ================

2009-10-13 05:29 <DIR> --d----- C:\Combo-Fix

2009-10-12 19:53 12,958 a------- c:\windows\ijifaxytuc.dat

2009-10-12 01:29 <DIR> --d----- c:\program files\Trend Micro

2009-10-11 02:10 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-10-11 02:10 19,160 a------- c:\windows\system32\drivers\mbam.sys

==================== Find3M ====================

2009-10-11 08:10 236,544 a------- c:\windows\PEV.exe

2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll

2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll

2009-05-02 06:52 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050220090503\index.dat

============= FINISH: 21:23:48.34 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-10-13.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 7/9/2005 9:59:57 PM

System Uptime: 10/14/2009 6:21:54 PM (3 hours ago)

Motherboard: Dell Computer Corporation | |

Processor: Intel® Pentium® 4 CPU 1.80GHz | Socket 478 | 1794/400mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 29 GiB total, 4.347 GiB free.

D: is CDROM ()

E: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1348: 7/31/2009 5:18:52 AM - System Checkpoint

RP1349: 8/2/2009 1:20:17 AM - System Checkpoint

RP1350: 8/5/2009 7:13:42 PM - System Checkpoint

RP1351: 8/7/2009 5:52:08 PM - System Checkpoint

RP1352: 8/9/2009 7:54:42 PM - System Checkpoint

RP1353: 8/11/2009 3:19:53 AM - System Checkpoint

RP1354: 8/12/2009 5:35:38 PM - System Checkpoint

RP1355: 8/12/2009 8:43:34 PM - Software Distribution Service 3.0

RP1356: 8/18/2009 1:44:58 AM - System Checkpoint

RP1357: 8/19/2009 4:12:44 AM - System Checkpoint

RP1358: 8/20/2009 4:52:29 AM - System Checkpoint

RP1359: 8/26/2009 5:28:54 AM - Software Distribution Service 3.0

RP1360: 9/1/2009 3:35:10 PM - System Checkpoint

RP1361: 9/2/2009 12:31:47 AM - Software Distribution Service 3.0

RP1362: 9/3/2009 7:36:24 PM - System Checkpoint

RP1363: 9/4/2009 7:57:57 PM - System Checkpoint

RP1364: 9/6/2009 4:11:24 PM - System Checkpoint

RP1365: 9/7/2009 10:51:23 PM - System Checkpoint

RP1366: 9/8/2009 10:52:24 PM - System Checkpoint

RP1367: 9/9/2009 12:46:23 AM - Software Distribution Service 3.0

RP1368: 9/10/2009 8:30:01 PM - System Checkpoint

RP1369: 9/11/2009 8:46:53 PM - System Checkpoint

RP1370: 9/12/2009 9:07:14 PM - System Checkpoint

RP1371: 9/13/2009 9:25:08 PM - System Checkpoint

RP1372: 9/14/2009 11:06:29 PM - System Checkpoint

RP1373: 9/16/2009 12:49:17 AM - System Checkpoint

RP1374: 9/17/2009 12:00:25 PM - System Checkpoint

RP1375: 9/19/2009 8:45:12 PM - System Checkpoint

RP1376: 9/22/2009 11:38:34 PM - System Checkpoint

RP1377: 9/24/2009 12:20:35 AM - System Checkpoint

RP1378: 9/25/2009 10:24:45 PM - System Checkpoint

RP1379: 9/26/2009 10:32:14 PM - System Checkpoint

RP1380: 9/28/2009 12:23:56 AM - System Checkpoint

RP1381: 9/29/2009 4:26:51 PM - System Checkpoint

RP1382: 9/30/2009 11:16:16 PM - System Checkpoint

RP1383: 10/2/2009 1:45:37 AM - System Checkpoint

RP1384: 10/3/2009 9:07:17 AM - System Checkpoint

RP1385: 10/3/2009 6:23:28 PM - Software Distribution Service 3.0

RP1386: 10/5/2009 1:24:41 AM - System Checkpoint

RP1387: 10/6/2009 2:43:43 AM - System Checkpoint

RP1388: 10/8/2009 7:28:23 PM - System Checkpoint

RP1389: 10/11/2009 5:55:44 AM - System Checkpoint

RP1390: 10/13/2009 5:32:37 AM - ComboFix created restore point

RP1391: 10/14/2009 6:54:01 PM - System Checkpoint

==== Installed Programs ======================

[AdvancedSetup]

Please delete this file: c:\windows\ijifaxytuc.dat

Then uninstall your old version of Java and update to the latest one here:

Download and Update Java Runtime

The most current version of Sun Java is: Java Runtime Environment (JRE) 6 Update 16.

• Go to http://java.sun.com/javase/downloads/index.jsp
  
• Go to Java SE Runtime Environment (JRE) - JRE 6 Update 16 about half way down the page and click on the Download button.
  
• In Platform box choose Windows.
  
• Check the box to Accept License Agreement and click Continue.
  
• Click on Windows Offline Installation, click on the link under it which says jre-6u16-windows-i586.exe and save the downloaded file to your desktop.
  
• Install the new version by running the newly-downloaded file with the java icon which will be on your desktop, and follow the on-screen instructions.
  
• Uncheck the Toolbar button (unless you want the toolbar)
  
• Reboot your computer
  

[KPP]

RE: YOUR INSTRUCTION c:\windows\ijifaxytuc.dat - DELETED

RE: Then uninstall your old version of Java and update to the latest one here. Cannot do this. I work online and the company I work for uses that old version of Java.

[KPP]

Still doing the ESET online scan. Does it always take forever? Only 41% complete and it's been running for 45 minutes.

[KPP]

Guess what? The scan is still running, and it has found a bunch of bugs. Who knew? You, I guess. Anyway, it's now 85% completed. I'll be posting the results whenever it finishes.

I do have a related question for you. I have a problem running anit-virus software, probably due to not having enough RAM. I mean my computer practically freezes when I go online if I have an antivirus program running. Is there s/w you can recommend that I could run that wouldn't slow down my computer? I am going to get more RAM, but don't have the bucks to do so right now.

Thanks for all your help. You are greatly appreciated!

Kate

[KPP]

HERE'S THE RESULTS OF THE ESET SCAN. DO I CLOSE THE PROGRAM W/O HAVING THE BUGS REMOVED?

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=6

# IEXPLORE.EXE=7.00.6000.16876 (vista_gdr.090625-2339)

# OnlineScanner.ocx=1.0.0.6050

# api_version=3.0.2

# EOSSerial=c9ea1f4217e67a44a1934c04a809e306

# end=finished

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2009-10-15 04:03:25

# local_time=2009-10-14 11:03:25 (-0600, Central Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# scanned=75752

# found=6

# cleaned=0

# scan_time=5499

C:\Qoobox\Quarantine\C\Documents and Settings\Kate\Application Data\lizkavd.exe.vir Win32/Adware.XPAntiSpyware.AA application 00000000000000000000000000000000 I

C:\Qoobox\Quarantine\C\Documents and Settings\Kate\Application Data\seres.exe.vir a variant of Win32/Kryptik.AOK trojan 00000000000000000000000000000000 I

C:\Qoobox\Quarantine\C\Documents and Settings\Kate\Application Data\svcst.exe.vir a variant of Win32/Kryptik.AOK trojan 00000000000000000000000000000000 I

C:\Qoobox\Quarantine\C\WINDOWS\ieocx.dll.vir a variant of Win32/Kryptik.RE trojan 00000000000000000000000000000000 I

C:\Qoobox\Quarantine\C\WINDOWS\system32\UACxhxiqowykmppevd.dll.vir Win32/Olmarik.IG trojan 00000000000000000000000000000000 I

C:\Qoobox\Quarantine\C\WINDOWS\system32\_scui.cpl.vir a variant of Win32/Kryptik.AMK trojan 00000000000000000000000000000000 I

[AdvancedSetup]

Those are all okay. Combofix found them and removed them already.

Please download the following cleanup tool and run it: http://oldtimer.geekstogo.com/OTC.exe

How is the computer running now?

Are there still any signs of infection?

[KPP]

Ron,

The computer seems to be running great, but there are a few oddities. For example, the icons under my "Favorites" have changed dramatically. My AT&T mail icon is gone, and in its place is a very weird looking icon with the letters L S on it. Another icon has also changed to something I've never seen before.

I also have a couple questions for you, which I can't remember if I've asked already.

1) For eons, I've been getting an error message on startup regarding: CD Recording Software, Roxio, Inc. Issue Description:

A CD-recording driver is installed that might cause stability problems, including problems shutting down and problems using a CD/DVD drive. This driver will be disabled. This driver might have been installed by Easy CD Creator, Windows Media Player or RealJukebox. You might not be able to record CDs until you obtain compatible drivers.

CAN I FIX THIS? I have not been able to burn a CD in years. What software should I use?

2) I have a problem running anti-virus software because it causes my computer to freeze up when I'm on the Internet. I think it's because I need more RAM, but don't have the bucks to buy more right now. Any s/w you recommend that might run better?

3) ABC Player at abc.com. Cannot get it to work. There are a number of TV shows there I'd like to watch. Any ideas?

4) I just bought a new keyboard and Windows Plug 'n Play isn't recognizing it when I plug in the USB port.

5) And one last thing: How do I get my "Recent Documents" back on my Start List. I use this all the time.

Thank you for fixing my computer and listening to my silly-ass questions.

[AdvancedSetup]

Well please run the following scanner and we'll see if we can fix some of this quickly or not. If not then I'll have you open a new post in the PC Help forum where others can assist you with most of this.

What MFG computer and model do you have?

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

1. DDS.txt
   
   
2. Attach.txt
   
   

• Save both reports to your desktop
  
  
• Please include the following logs in your next reply:
  DDS.txt
  and
  Attach.txt
  
  

[KPP]

I already downloaded and ran that scanner and posted both the dds.txt info and the attach.txt previously.

I have a Dell Dimension Desktop

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 7/9/2005 9:59:57 PM

Motherboard: Dell Computer Corporation | |

Processor: Intel® Pentium® 4 CPU 1.80GHz | Socket 478 | 1794/400mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 29 GiB total, 4.347 GiB free.

D: is CDROM ()

E: is CDROM ()