HIJACK.REGEDIT

donj · February 13, 2010

Malewarebytes scan detects and removes HIJACK.REGEDIT, however it keeps coming back. I also ran Combofix. The computer has an internet connection, but the browsers (IE, Firefox, Chrome) will not open a web page. I have included the log files.

Any help will be much appreciated!

mbam_log_2010_02_12__20_52_48_.txt

log.txt

donj · February 13, 2010

Malewarebytes scan detects and removes HIJACK.REGEDIT, however it keeps coming back. I also ran Combofix. The computer has an internet connection, but the browsers (IE, Firefox, Chrome) will not open a web page. I have included the log files.
Any help will be much appreciated!

Combofix must have fixed the registry error...I just ran a quick scan and their is 0 infections now. However, I still cannot connect to the internet.

donj · February 13, 2010

Combofix must have fixed the registry error...I just ran a quick scan and their is 0 infections now. However, I still cannot connect to the internet.

I just did a scan with DDS and attached the results. Still cannot open web pages.

DDS.txt

JSntgRvr · February 14, 2010

Hi, donj

Lets give it a try. Some programs may be compromised.

Copy the entire contents of the Code Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

http://forums.malwarebytes.org/index.php?act=ST&f=7&t=39848

Collect::
c:\windows\system32\aexarasug.exe
c:\windows\system32\accesse.exe
c:\windows\system32\ndismgr.sys

FCopy::
c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys | c:\windows\system32\drivers\tcpip.sys

File::
c:\program files\20484187.dat
c:\program files\20483640.dat
c:\program files\20459281.dat
c:\program files\20458718.dat
c:\program files\1475171.dat
c:\program files\1117984.dat
c:\program files\894875.dat
c:\program files\24539093.dat
c:\documents and settings\Don\Application Data\gaboln\hxmrsftav .exe

DirLook::
c:\documents and settings\Don\Application Data\gaboln
c:\documents and settings\Administrator\Local Settings\Application Data\dgakth
c:\documents and settings\Administrator\Local Settings\Application Data\fnlxtk
c:\documents and settings\Administrator\Local Settings\Application Data\ybchse
c:\documents and settings\Administrator\Local Settings\Application Data\rorqsx
c:\documents and settings\Administrator\Local Settings\Application Data\uquibp
c:\documents and settings\Administrator\Local Settings\Application Data\fvawxd
c:\documents and settings\Administrator\Local Settings\Application Data\fcaahi
c:\documents and settings\Administrator\Local Settings\Application Data\yivbrq
c:\documents and settings\Administrator\Local Settings\Application Data\rvlkrk
c:\documents and settings\Administrator\Local Settings\Application Data\dgyvei
c:\documents and settings\Administrator\Local Settings\Application Data\yfesmo
c:\documents and settings\Administrator\Local Settings\Application Data\dvmgkv
c:\documents and settings\Administrator\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\kvtrff
c:\documents and settings\Administrator\Local Settings\Application Data\mfqqci
c:\documents and settings\Administrator\Local Settings\Application Data\hjahoq
c:\documents and settings\Administrator\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\waegsd
c:\documents and settings\Administrator\Local Settings\Application Data\xmoqog
c:\documents and settings\Administrator\Local Settings\Application Data\csgjfq
c:\documents and settings\Administrator\Local Settings\Application Data\bfakvp
c:\documents and settings\Administrator\Local Settings\Application Data\scxmju
c:\documents and settings\Administrator\Local Settings\Application Data\efqqgh
c:\documents and settings\Administrator\Local Settings\Application Data\nylugr
c:\documents and settings\Administrator\Local Settings\Application Data\ueaerm
c:\documents and settings\Administrator\Local Settings\Application Data\dtxfhc
c:\documents and settings\Administrator\Local Settings\Application Data\rlvfse
c:\documents and settings\Administrator\Local Settings\Application Data\vwwvyy
c:\documents and settings\Administrator\Local Settings\Application Data\syageo
c:\documents and settings\Don\Local Settings\Application Data\abietk
c:\documents and settings\Don\Local Settings\Application Data\ufrtfs
c:\documents and settings\Don\Local Settings\Application Data\wvjbsh
c:\documents and settings\Don\Local Settings\Application Data\fmjtag
c:\documents and settings\Don\Local Settings\Application Data\iloebw
c:\documents and settings\Don\Local Settings\Application Data\sfkibg
c:\documents and settings\Don\Local Settings\Application Data\tvcpnu
c:\documents and settings\Don\Local Settings\Application Data\itddfo
c:\documents and settings\Don\Local Settings\Application Data\gfwhqa
c:\documents and settings\Administrator\Local Settings\Application Data\gkalbi
c:\documents and settings\Administrator\Local Settings\Application Data\cbsmjt
c:\documents and settings\Administrator\Local Settings\Application Data\yvtjiq
c:\documents and settings\Don\Local Settings\Application Data\hlwkjf
c:\documents and settings\Don\Local Settings\Application Data\jkkmib
c:\documents and settings\Don\Local Settings\Application Data\ubalar
c:\documents and settings\Don\Application Data\fbwefs
c:\documents and settings\Don\Local Settings\Application Data\fbwefs
c:\documents and settings\Don\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\hrvqjo
c:\documents and settings\Don\Local Settings\Application Data\wufaqt
c:\documents and settings\Don\Local Settings\Application Data\bnsrrx
c:\documents and settings\Don\Local Settings\Application Data\vkgapu
c:\documents and settings\Don\Local Settings\Application Data\mlcxya
c:\documents and settings\Don\Local Settings\Application Data\fdkcow
c:\documents and settings\Don\Local Settings\Application Data\lllwyr
c:\documents and settings\Don\Local Settings\Application Data\pehutx
c:\documents and settings\Don\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\rivwbq
c:\documents and settings\Administrator\Local Settings\Application Data\xonubk
c:\documents and settings\Administrator\Local Settings\Application Data\bwrapu
c:\documents and settings\Administrator\Local Settings\Application Data\nspvyv
c:\documents and settings\Administrator\Local Settings\Application Data\tbqpir
c:\documents and settings\Administrator\Local Settings\Application Data\urjwug
c:\documents and settings\Administrator\Local Settings\Application Data\pvsmho
c:\documents and settings\Administrator\Local Settings\Application Data\bggytm
c:\documents and settings\Administrator\Local Settings\Application Data\enqmtp
c:\documents and settings\Administrator\Local Settings\Application Data\iluhfh
c:\documents and settings\Administrator\Local Settings\Application Data\txntbr
c:\documents and settings\Administrator\Local Settings\Application Data\lukvov
c:\documents and settings\Administrator\Local Settings\Application Data\rjhxmd
c:\documents and settings\Administrator\Local Settings\Application Data\cirftf
c:\documents and settings\Administrator\Local Settings\Application Data\mcmjto
c:\documents and settings\Administrator\Local Settings\Application Data\usldbm
c:\documents and settings\Administrator\Local Settings\Application Data\djkvjl
c:\documents and settings\Administrator\Local Settings\Application Data\yelsii
c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
c:\documents and settings\Administrator\Local Settings\Application Data\feyrpu
c:\documents and settings\Administrator\Local Settings\Application Data\tjtmwa
c:\documents and settings\Administrator\Local Settings\Application Data\qhowqr
c:\documents and settings\Administrator\Local Settings\Application Data\kufgpl
c:\documents and settings\Administrator\Local Settings\Application Data\irksuq
c:\documents and settings\Administrator\Local Settings\Application Data\oylmel
c:\documents and settings\Administrator\Local Settings\Application Data\lmrcow
c:\documents and settings\Administrator\Local Settings\Application Data\wwfnbu
c:\documents and settings\HP_Administrator\Local Settings\Application Data\xdlqit
c:\documents and settings\Don\Local Settings\Application Data\kgbsoe
c:\documents and settings\Don\Local Settings\Application Data\tavwon
c:\documents and settings\Don\Local Settings\Application Data\puxunk
c:\documents and settings\Don\Local Settings\Application Data\gxnjmv
c:\documents and settings\Don\Local Settings\Application Data\hogqyk
c:\documents and settings\Don\Local Settings\Application Data\lxhkna
c:\documents and settings\Don\Local Settings\Application Data\togeuy
c:\documents and settings\Don\Local Settings\Application Data\eytphw
c:\documents and settings\Don\Local Settings\Application Data\xmkygq
c:\documents and settings\Administrator\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\vissjh
c:\documents and settings\Don\Local Settings\Application Data\canyjj
c:\documents and settings\Don\Local Settings\Application Data\rbkwso
c:\documents and settings\Don\Local Settings\Application Data\cbhpxq
c:\documents and settings\Don\Local Settings\Application Data\nlbgbv
c:\documents and settings\Don\Local Settings\Application Data\taxiac
c:\documents and settings\Don\Local Settings\Application Data\aotkyj

RenV::
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Dell AIO Printer A960\dlbfbmgr .exe
c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Malwarebytes' Anti-Malware\mbam .exe
c:\program files\Norton Internet Security\urllstck .exe
c:\program files\Spyware Doctor\pctstray .exe
c:\windows\ehome\ehtray .exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sefjhf98jfoidsfoishgoiusgdgfgd]

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

(This may not even happen in your condition.)

====================================================================

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
:filefind
ctfmon.exe
rundll32.exe
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

donj · February 15, 2010

Hi, donj

Lets give it a try. Some programs may be compromised.

Copy the entire contents of the Code Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

http://forums.malwarebytes.org/index.php?act=ST&f=7&t=39848

Collect::
c:\windows\system32\aexarasug.exe
c:\windows\system32\accesse.exe
c:\windows\system32\ndismgr.sys

FCopy::
c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys | c:\windows\system32\drivers\tcpip.sys

File::
c:\program files\20484187.dat
c:\program files\20483640.dat
c:\program files\20459281.dat
c:\program files\20458718.dat
c:\program files\1475171.dat
c:\program files\1117984.dat
c:\program files\894875.dat
c:\program files\24539093.dat
c:\documents and settings\Don\Application Data\gaboln\hxmrsftav .exe

DirLook::
c:\documents and settings\Don\Application Data\gaboln
c:\documents and settings\Administrator\Local Settings\Application Data\dgakth
c:\documents and settings\Administrator\Local Settings\Application Data\fnlxtk
c:\documents and settings\Administrator\Local Settings\Application Data\ybchse
c:\documents and settings\Administrator\Local Settings\Application Data\rorqsx
c:\documents and settings\Administrator\Local Settings\Application Data\uquibp
c:\documents and settings\Administrator\Local Settings\Application Data\fvawxd
c:\documents and settings\Administrator\Local Settings\Application Data\fcaahi
c:\documents and settings\Administrator\Local Settings\Application Data\yivbrq
c:\documents and settings\Administrator\Local Settings\Application Data\rvlkrk
c:\documents and settings\Administrator\Local Settings\Application Data\dgyvei
c:\documents and settings\Administrator\Local Settings\Application Data\yfesmo
c:\documents and settings\Administrator\Local Settings\Application Data\dvmgkv
c:\documents and settings\Administrator\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\kvtrff
c:\documents and settings\Administrator\Local Settings\Application Data\mfqqci
c:\documents and settings\Administrator\Local Settings\Application Data\hjahoq
c:\documents and settings\Administrator\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\waegsd
c:\documents and settings\Administrator\Local Settings\Application Data\xmoqog
c:\documents and settings\Administrator\Local Settings\Application Data\csgjfq
c:\documents and settings\Administrator\Local Settings\Application Data\bfakvp
c:\documents and settings\Administrator\Local Settings\Application Data\scxmju
c:\documents and settings\Administrator\Local Settings\Application Data\efqqgh
c:\documents and settings\Administrator\Local Settings\Application Data\nylugr
c:\documents and settings\Administrator\Local Settings\Application Data\ueaerm
c:\documents and settings\Administrator\Local Settings\Application Data\dtxfhc
c:\documents and settings\Administrator\Local Settings\Application Data\rlvfse
c:\documents and settings\Administrator\Local Settings\Application Data\vwwvyy
c:\documents and settings\Administrator\Local Settings\Application Data\syageo
c:\documents and settings\Don\Local Settings\Application Data\abietk
c:\documents and settings\Don\Local Settings\Application Data\ufrtfs
c:\documents and settings\Don\Local Settings\Application Data\wvjbsh
c:\documents and settings\Don\Local Settings\Application Data\fmjtag
c:\documents and settings\Don\Local Settings\Application Data\iloebw
c:\documents and settings\Don\Local Settings\Application Data\sfkibg
c:\documents and settings\Don\Local Settings\Application Data\tvcpnu
c:\documents and settings\Don\Local Settings\Application Data\itddfo
c:\documents and settings\Don\Local Settings\Application Data\gfwhqa
c:\documents and settings\Administrator\Local Settings\Application Data\gkalbi
c:\documents and settings\Administrator\Local Settings\Application Data\cbsmjt
c:\documents and settings\Administrator\Local Settings\Application Data\yvtjiq
c:\documents and settings\Don\Local Settings\Application Data\hlwkjf
c:\documents and settings\Don\Local Settings\Application Data\jkkmib
c:\documents and settings\Don\Local Settings\Application Data\ubalar
c:\documents and settings\Don\Application Data\fbwefs
c:\documents and settings\Don\Local Settings\Application Data\fbwefs
c:\documents and settings\Don\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\hrvqjo
c:\documents and settings\Don\Local Settings\Application Data\wufaqt
c:\documents and settings\Don\Local Settings\Application Data\bnsrrx
c:\documents and settings\Don\Local Settings\Application Data\vkgapu
c:\documents and settings\Don\Local Settings\Application Data\mlcxya
c:\documents and settings\Don\Local Settings\Application Data\fdkcow
c:\documents and settings\Don\Local Settings\Application Data\lllwyr
c:\documents and settings\Don\Local Settings\Application Data\pehutx
c:\documents and settings\Don\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\rivwbq
c:\documents and settings\Administrator\Local Settings\Application Data\xonubk
c:\documents and settings\Administrator\Local Settings\Application Data\bwrapu
c:\documents and settings\Administrator\Local Settings\Application Data\nspvyv
c:\documents and settings\Administrator\Local Settings\Application Data\tbqpir
c:\documents and settings\Administrator\Local Settings\Application Data\urjwug
c:\documents and settings\Administrator\Local Settings\Application Data\pvsmho
c:\documents and settings\Administrator\Local Settings\Application Data\bggytm
c:\documents and settings\Administrator\Local Settings\Application Data\enqmtp
c:\documents and settings\Administrator\Local Settings\Application Data\iluhfh
c:\documents and settings\Administrator\Local Settings\Application Data\txntbr
c:\documents and settings\Administrator\Local Settings\Application Data\lukvov
c:\documents and settings\Administrator\Local Settings\Application Data\rjhxmd
c:\documents and settings\Administrator\Local Settings\Application Data\cirftf
c:\documents and settings\Administrator\Local Settings\Application Data\mcmjto
c:\documents and settings\Administrator\Local Settings\Application Data\usldbm
c:\documents and settings\Administrator\Local Settings\Application Data\djkvjl
c:\documents and settings\Administrator\Local Settings\Application Data\yelsii
c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
c:\documents and settings\Administrator\Local Settings\Application Data\feyrpu
c:\documents and settings\Administrator\Local Settings\Application Data\tjtmwa
c:\documents and settings\Administrator\Local Settings\Application Data\qhowqr
c:\documents and settings\Administrator\Local Settings\Application Data\kufgpl
c:\documents and settings\Administrator\Local Settings\Application Data\irksuq
c:\documents and settings\Administrator\Local Settings\Application Data\oylmel
c:\documents and settings\Administrator\Local Settings\Application Data\lmrcow
c:\documents and settings\Administrator\Local Settings\Application Data\wwfnbu
c:\documents and settings\HP_Administrator\Local Settings\Application Data\xdlqit
c:\documents and settings\Don\Local Settings\Application Data\kgbsoe
c:\documents and settings\Don\Local Settings\Application Data\tavwon
c:\documents and settings\Don\Local Settings\Application Data\puxunk
c:\documents and settings\Don\Local Settings\Application Data\gxnjmv
c:\documents and settings\Don\Local Settings\Application Data\hogqyk
c:\documents and settings\Don\Local Settings\Application Data\lxhkna
c:\documents and settings\Don\Local Settings\Application Data\togeuy
c:\documents and settings\Don\Local Settings\Application Data\eytphw
c:\documents and settings\Don\Local Settings\Application Data\xmkygq
c:\documents and settings\Administrator\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\vissjh
c:\documents and settings\Don\Local Settings\Application Data\canyjj
c:\documents and settings\Don\Local Settings\Application Data\rbkwso
c:\documents and settings\Don\Local Settings\Application Data\cbhpxq
c:\documents and settings\Don\Local Settings\Application Data\nlbgbv
c:\documents and settings\Don\Local Settings\Application Data\taxiac
c:\documents and settings\Don\Local Settings\Application Data\aotkyj

RenV::
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Dell AIO Printer A960\dlbfbmgr .exe
c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08 .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Malwarebytes' Anti-Malware\mbam .exe
c:\program files\Norton Internet Security\urllstck .exe
c:\program files\Spyware Doctor\pctstray .exe
c:\windows\ehome\ehtray .exe

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sefjhf98jfoidsfoishgoiusgdgfgd]

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

(This may not even happen in your condition.)

====================================================================

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Thank you for your help and Sorry for the delay. Attached are the logs you requested.

log2.txt

SystemLook.txt

JSntgRvr · February 15, 2010

Enter your Control Panel and double-click on Network Connections
Then right click on your Default Connection
- Usually Local Area Connection for Cable and DSL, or AOL Connection.

[*]Left click on Properties

[*]Double-Click on the Internet Protocol (TCP/IP) item

[*]Select the radio dial that says Obtain DNS Servers Automatically

[*]Press OK twice to get out of the properties screen

Go to Start->Run->Type CMD and click Ok. The MSDOS Window will be displayed. At the command prompt, type the following and press Enter after each line:

netsh int ip reset C:\Resetlog.txt

netsh winsock reset catalog

ipconfig /flushdns (The space between g and / is needed)

Exit

Restart the computer.

Copy the entire contents of the Quote Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

Folder::
c:\documents and settings\Don\Application Data\gaboln
c:\documents and settings\Administrator\Local Settings\Application Data\dgakth
c:\documents and settings\Administrator\Local Settings\Application Data\fnlxtk
c:\documents and settings\Administrator\Local Settings\Application Data\ybchse
c:\documents and settings\Administrator\Local Settings\Application Data\rorqsx
c:\documents and settings\Administrator\Local Settings\Application Data\uquibp
c:\documents and settings\Administrator\Local Settings\Application Data\fvawxd
c:\documents and settings\Administrator\Local Settings\Application Data\fcaahi
c:\documents and settings\Administrator\Local Settings\Application Data\yivbrq
c:\documents and settings\Administrator\Local Settings\Application Data\rvlkrk
c:\documents and settings\Administrator\Local Settings\Application Data\dgyvei
c:\documents and settings\Administrator\Local Settings\Application Data\yfesmo
c:\documents and settings\Administrator\Local Settings\Application Data\dvmgkv
c:\documents and settings\Administrator\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\uskiwa
c:\documents and settings\Administrator\Local Settings\Application Data\kvtrff
c:\documents and settings\Administrator\Local Settings\Application Data\mfqqci
c:\documents and settings\Administrator\Local Settings\Application Data\hjahoq
c:\documents and settings\Administrator\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\kfaesu
c:\documents and settings\Administrator\Local Settings\Application Data\waegsd
c:\documents and settings\Administrator\Local Settings\Application Data\xmoqog
c:\documents and settings\Administrator\Local Settings\Application Data\csgjfq
c:\documents and settings\Administrator\Local Settings\Application Data\bfakvp
c:\documents and settings\Administrator\Local Settings\Application Data\scxmju
c:\documents and settings\Administrator\Local Settings\Application Data\efqqgh
c:\documents and settings\Administrator\Local Settings\Application Data\nylugr
c:\documents and settings\Administrator\Local Settings\Application Data\ueaerm
c:\documents and settings\Administrator\Local Settings\Application Data\dtxfhc
c:\documents and settings\Administrator\Local Settings\Application Data\rlvfse
c:\documents and settings\Administrator\Local Settings\Application Data\vwwvyy
c:\documents and settings\Administrator\Local Settings\Application Data\syageo
c:\documents and settings\Don\Local Settings\Application Data\abietk
c:\documents and settings\Don\Local Settings\Application Data\ufrtfs
c:\documents and settings\Don\Local Settings\Application Data\wvjbsh
c:\documents and settings\Don\Local Settings\Application Data\fmjtag
c:\documents and settings\Don\Local Settings\Application Data\iloebw
c:\documents and settings\Don\Local Settings\Application Data\sfkibg
c:\documents and settings\Don\Local Settings\Application Data\tvcpnu
c:\documents and settings\Don\Local Settings\Application Data\itddfo
c:\documents and settings\Don\Local Settings\Application Data\gfwhqa
c:\documents and settings\Administrator\Local Settings\Application Data\gkalbi
c:\documents and settings\Administrator\Local Settings\Application Data\cbsmjt
c:\documents and settings\Administrator\Local Settings\Application Data\yvtjiq
c:\documents and settings\Don\Local Settings\Application Data\hlwkjf
c:\documents and settings\Don\Local Settings\Application Data\jkkmib
c:\documents and settings\Don\Local Settings\Application Data\ubalar
c:\documents and settings\Don\Application Data\fbwefs
c:\documents and settings\Don\Local Settings\Application Data\fbwefs
c:\documents and settings\Don\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\yomnfm
c:\documents and settings\Don\Local Settings\Application Data\hrvqjo
c:\documents and settings\Don\Local Settings\Application Data\wufaqt
c:\documents and settings\Don\Local Settings\Application Data\bnsrrx
c:\documents and settings\Don\Local Settings\Application Data\vkgapu
c:\documents and settings\Don\Local Settings\Application Data\mlcxya
c:\documents and settings\Don\Local Settings\Application Data\fdkcow
c:\documents and settings\Don\Local Settings\Application Data\lllwyr
c:\documents and settings\Don\Local Settings\Application Data\pehutx
c:\documents and settings\Don\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\kdhopu
c:\documents and settings\Don\Local Settings\Application Data\rivwbq
c:\documents and settings\Administrator\Local Settings\Application Data\xonubk
c:\documents and settings\Administrator\Local Settings\Application Data\bwrapu
c:\documents and settings\Administrator\Local Settings\Application Data\nspvyv
c:\documents and settings\Administrator\Local Settings\Application Data\tbqpir
c:\documents and settings\Administrator\Local Settings\Application Data\urjwug
c:\documents and settings\Administrator\Local Settings\Application Data\pvsmho
c:\documents and settings\Administrator\Local Settings\Application Data\bggytm
c:\documents and settings\Administrator\Local Settings\Application Data\enqmtp
c:\documents and settings\Administrator\Local Settings\Application Data\iluhfh
c:\documents and settings\Administrator\Local Settings\Application Data\txntbr
c:\documents and settings\Administrator\Local Settings\Application Data\lukvov
c:\documents and settings\Administrator\Local Settings\Application Data\rjhxmd
c:\documents and settings\Administrator\Local Settings\Application Data\cirftf
c:\documents and settings\Administrator\Local Settings\Application Data\mcmjto
c:\documents and settings\Administrator\Local Settings\Application Data\usldbm
c:\documents and settings\Administrator\Local Settings\Application Data\djkvjl
c:\documents and settings\Administrator\Local Settings\Application Data\yelsii
c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
c:\documents and settings\Administrator\Local Settings\Application Data\feyrpu
c:\documents and settings\Administrator\Local Settings\Application Data\tjtmwa
c:\documents and settings\Administrator\Local Settings\Application Data\qhowqr
c:\documents and settings\Administrator\Local Settings\Application Data\kufgpl
c:\documents and settings\Administrator\Local Settings\Application Data\irksuq
c:\documents and settings\Administrator\Local Settings\Application Data\oylmel
c:\documents and settings\Administrator\Local Settings\Application Data\lmrcow
c:\documents and settings\Administrator\Local Settings\Application Data\wwfnbu
c:\documents and settings\HP_Administrator\Local Settings\Application Data\xdlqit
c:\documents and settings\Don\Local Settings\Application Data\kgbsoe
c:\documents and settings\Don\Local Settings\Application Data\tavwon
c:\documents and settings\Don\Local Settings\Application Data\puxunk
c:\documents and settings\Don\Local Settings\Application Data\gxnjmv
c:\documents and settings\Don\Local Settings\Application Data\hogqyk
c:\documents and settings\Don\Local Settings\Application Data\lxhkna
c:\documents and settings\Don\Local Settings\Application Data\togeuy
c:\documents and settings\Don\Local Settings\Application Data\eytphw
c:\documents and settings\Don\Local Settings\Application Data\xmkygq
c:\documents and settings\Administrator\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\qrkfma
c:\documents and settings\Administrator\Local Settings\Application Data\vissjh
c:\documents and settings\Don\Local Settings\Application Data\canyjj
c:\documents and settings\Don\Local Settings\Application Data\rbkwso
c:\documents and settings\Don\Local Settings\Application Data\cbhpxq
c:\documents and settings\Don\Local Settings\Application Data\nlbgbv
c:\documents and settings\Don\Local Settings\Application Data\taxiac
c:\documents and settings\Don\Local Settings\Application Data\aotkyj
file::
c:\program files\42513593.dat
c:\program files\1966312.dat

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

Open the following file and post its contents:

ComboFix-quarantined-files.txt

donj · February 15, 2010

Windows said the fist command line in DOS 'netsh int ip reset C:\ Resetlog.txt' had the wrong syntax. I entered as shown here. I continued on with the rest of your instructions. The logs are attached.

log3.txt

ComboFix_quarantined_files.txt

donj · February 15, 2010

I went back and entered command without space after the slash 'netsh int ip reset C:\Resetlog.txt' and windows said 'could not obtain host info fom machine. some commands may not be available. the system cannot find the file specified.'

donj · February 15, 2010

I connect to a wireless network in my house. Everytime I restart the computer I have to go to 'services' to start 'wireless zero configuration' which controls my wireless usb adapter. After I do this I can see avilable wireless networks and I am connected to my network.

JSntgRvr · February 15, 2010

Something is producing lots of empty folders and files. Are you still unable to connect. The syntax is correct.

Copy the entire contents of the Quote Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

DeQuarantine::
C:\Qoobox\Quarantine\C\documents and settings\Administrator\Local Settings\Application Data\Adobe
Driver::
ImapiServiceSPBBCSvc
WmiClipSrv
ndismgr
Folder::
c:\documents and settings\Administrator\Local Settings\Application Data\jenfak
c:\documents and settings\Don\Local Settings\Application Data\tilheu
c:\documents and settings\Don\Local Settings\Application Data\lfjjqy
c:\documents and settings\Don\Local Settings\Application Data\huckal
c:\documents and settings\Don\Local Settings\Application Data\eeshru
c:\documents and settings\Don\Local Settings\Application Data\hybqlc
c:\documents and settings\Don\Local Settings\Application Data\nhckvw
c:\documents and settings\Don\Local Settings\Application Data\feamic
c:\documents and settings\Don\Application Data\kdwxjb
c:\documents and settings\Don\Local Settings\Application Data\kdwxjb
c:\documents and settings\Don\Local Settings\Application Data\cusjwb
c:\documents and settings\Don\Local Settings\Application Data\ydqcqb
c:\documents and settings\Don\Local Settings\Application Data\bxylki
c:\documents and settings\Don\Local Settings\Application Data\gvcgwa
c:\documents and settings\Don\Local Settings\Application Data\fllnpd
c:\documents and settings\Don\Local Settings\Application Data\wijpci
c:\documents and settings\Don\Local Settings\Application Data\pkvtvf
c:\documents and settings\Don\Application Data\dbbtki
c:\documents and settings\Don\Local Settings\Application Data\dbbtki
c:\documents and settings\Don\Local Settings\Application Data\iyfowa
c:\documents and settings\Don\Local Settings\Application Data\qnrwgx
c:\documents and settings\Administrator\Application Data\mwwedr
c:\documents and settings\Administrator\Local Settings\Application Data\mwwedr
c:\documents and settings\Administrator\Local Settings\Application Data\quaypj
c:\documents and settings\Don\Local Settings\Application Data\smfyft
c:\documents and settings\Don\Local Settings\Application Data\tfjqpi
c:\documents and settings\Don\Local Settings\Application Data\wxfplp
c:\documents and settings\Don\Local Settings\Application Data\rbgkfy
c:\documents and settings\Don\Local Settings\Application Data\mfobrh
c:\documents and settings\Don\Local Settings\Application Data\qdsvea
c:\documents and settings\Don\Local Settings\Application Data\awnbej
c:\documents and settings\Don\Local Settings\Application Data\hpyfji
c:\documents and settings\Don\Local Settings\Application Data\rlcusx
c:\documents and settings\Don\Local Settings\Application Data\ldhgaj
c:\documents and settings\Don\Local Settings\Application Data\okpnte
c:\documents and settings\Don\Local Settings\Application Data\lvjrfp
c:\documents and settings\Don\Local Settings\Application Data\wttymr
c:\documents and settings\Don\Local Settings\Application Data\gnodlb
c:\documents and settings\Don\Local Settings\Application Data\gyknya
c:\documents and settings\Don\Local Settings\Application Data\uqjmlb
c:\documents and settings\Don\Local Settings\Application Data\mngpxg
c:\documents and settings\Don\Application Data\cjuqqa
c:\documents and settings\Don\Local Settings\Application Data\cjuqqa
c:\documents and settings\Don\Local Settings\Application Data\guuhxu
c:\documents and settings\Don\Local Settings\Application Data\qfiskt
c:\documents and settings\Don\Local Settings\Application Data\dgoljg
c:\documents and settings\Don\Local Settings\Application Data\oltbft
c:\documents and settings\Don\Local Settings\Application Data\qsfofw
c:\documents and settings\Don\Local Settings\Application Data\vwtuvy
c:\documents and settings\Don\Local Settings\Application Data\lwtvko
c:\documents and settings\Don\Local Settings\Application Data\ekkfki
c:\documents and settings\Don\Local Settings\Application Data\rfogjq
c:\documents and settings\Don\Local Settings\Application Data\oqikvc
c:\documents and settings\Don\Local Settings\Application Data\wdyhmp
c:\documents and settings\Don\Local Settings\Application Data\idtxan
c:\documents and settings\Don\Local Settings\Application Data\qybnyx
c:\documents and settings\Don\Local Settings\Application Data\qmucns
c:\documents and settings\Don\Local Settings\Application Data\ntgjis
c:\documents and settings\Don\Local Settings\Application Data\karqds
c:\documents and settings\Don\Local Settings\Application Data\sfcaau
c:\documents and settings\Don\Local Settings\Application Data\tjqchm
c:\documents and settings\Don\Local Settings\Application Data\wqcpgp
c:\documents and settings\Don\Local Settings\Application Data\wevnec
c:\documents and settings\Don\Local Settings\Application Data\atvahx
c:\documents and settings\Don\Local Settings\Application Data\vowwgu
c:\documents and settings\Don\Local Settings\Application Data\aawnmp
c:\documents and settings\Don\Local Settings\Application Data\hplfwh
c:\documents and settings\Don\Local Settings\Application Data\jgeljv
c:\documents and settings\Don\Local Settings\Application Data\gpcbik
c:\documents and settings\Don\Local Settings\Application Data\iguiuy
c:\documents and settings\Don\Local Settings\Application Data\kngvuc
c:\documents and settings\Don\Local Settings\Application Data\qpysnm
c:\documents and settings\Don\Local Settings\Application Data\jdocnf
c:\documents and settings\Don\Local Settings\Application Data\diqeao
c:\documents and settings\Don\Local Settings\Application Data\hguymh
c:\documents and settings\Don\Local Settings\Application Data\huqlys
c:\documents and settings\Don\Local Settings\Application Data\cretvp
c:\documents and settings\Don\Local Settings\Application Data\ddoers
c:\documents and settings\Don\Local Settings\Application Data\ffakrk
c:\documents and settings\Don\Local Settings\Application Data\bprtbr
c:\documents and settings\Don\Local Settings\Application Data\gckbvt
c:\documents and settings\Don\Local Settings\Application Data\ijvovw
c:\documents and settings\Don\Local Settings\Application Data\xhdhex
c:\documents and settings\Don\Local Settings\Application Data\typybq
c:\documents and settings\Don\Local Settings\Application Data\wgbmbt
c:\documents and settings\Don\Local Settings\Application Data\dbycfr
c:\documents and settings\Don\Local Settings\Application Data\sjqiei
c:\documents and settings\Don\Local Settings\Application Data\flyqru
c:\documents and settings\Don\Local Settings\Application Data\gcrwej
c:\documents and settings\Don\Local Settings\Application Data\neqaoa
c:\documents and settings\Don\Local Settings\Application Data\courlp
c:\documents and settings\Don\Local Settings\Application Data\astoiq
c:\documents and settings\Don\Local Settings\Application Data\tgkxhj
c:\documents and settings\Don\Local Settings\Application Data\hlfsoo
c:\documents and settings\Don\Application Data\vrbnut
c:\documents and settings\Don\Local Settings\Application Data\vrbnut
c:\documents and settings\Don\Application Data\knloyf
c:\documents and settings\Don\Application Data\eyomay
c:\documents and settings\Don\Application Data\icegtf
c:\documents and settings\Don\Application Data\gsggwc
c:\documents and settings\Don\Application Data\dluswy
c:\documents and settings\Don\Application Data\cuclkk
c:\documents and settings\Don\Application Data\obqbai
c:\documents and settings\Don\Application Data\wetynd
c:\documents and settings\Don\Application Data\qvrfdi
c:\documents and settings\Don\Application Data\desfrg
c:\documents and settings\Don\Application Data\kjindc
c:\documents and settings\Don\Application Data\twikna
File::
c:\program files\1108296.dat
c:\program files\988484.dat
c:\program files\2062203.dat
c:\program files\1885031.dat
c:\program files\1110906.dat
c:\program files\1742984.dat
c:\program files\2696078.dat
c:\program files\3212046.dat
c:\program files\3212015.dat
c:\program files\3212171.dat
c:\program files\3120250.dat
c:\program files\3115921.dat
c:\program files\1688843.dat
c:\program files\1337156.dat
c:\program files\1962781.dat
c:\windows\system32\ndismgr.sys
c:\windows\system32\accesse.exe
c:\windows\system32\aexarasug.exe

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

JSntgRvr · February 15, 2010

But able to connect to the Internet? Go to Services. Doubleclick on the wireless zero configuration. Set it to automatic. While in services, check the Remote Procedure Call. Is it running?

donj · February 15, 2010

logs are attached

log4.txt

DeQuarantine.txt

donj · February 15, 2010

Wireless network configuration is set to automatic already. RPC is started. Even when I start wireless network configuration the browsers still dont connect.

JSntgRvr · February 15, 2010

They should stop soon.

Copy the entire contents of the Quote Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

Folder::
c:\documents and settings\Don\Local Settings\Application Data\wvqpcl
c:\documents and settings\Don\Local Settings\Application Data\ysvhqb
c:\documents and settings\Don\Local Settings\Application Data\gxlpcw
c:\documents and settings\Don\Local Settings\Application Data\buyxat
c:\documents and settings\Don\Local Settings\Application Data\cufeqa
c:\documents and settings\Don\Local Settings\Application Data\aeespn
c:\documents and settings\Don\Local Settings\Application Data\clohpr
c:\documents and settings\Don\Local Settings\Application Data\nvcscp
c:\documents and settings\Don\Local Settings\Application Data\smlfyv
c:\documents and settings\Don\Local Settings\Application Data\qehwqa
c:\documents and settings\Don\Local Settings\Application Data\ibeade
c:\documents and settings\Don\Local Settings\Application Data\fhphxf
c:\documents and settings\Don\Local Settings\Application Data\ncewyp
c:\documents and settings\Don\Local Settings\Application Data\rvyuuw
c:\documents and settings\Don\Local Settings\Application Data\yttvqg
c:\documents and settings\Don\Local Settings\Application Data\uqheod
c:\documents and settings\Don\Local Settings\Application Data\tbdocc
c:\documents and settings\Don\Local Settings\Application Data\ummyxf
c:\documents and settings\Don\Local Settings\Application Data\sxgdjq
c:\documents and settings\Don\Local Settings\Application Data\bogvqo
c:\documents and settings\Don\Local Settings\Application Data\sssgel
c:\documents and settings\Don\Local Settings\Application Data\alfkkk
c:\documents and settings\Don\Local Settings\Application Data\vjsshh
c:\documents and settings\Don\Local Settings\Application Data\lxlnlp
c:\documents and settings\Don\Local Settings\Application Data\flcwli
c:\documents and settings\Don\Local Settings\Application Data\npxlnk
c:\documents and settings\Don\Local Settings\Application Data\vlfblu
c:\documents and settings\Don\Local Settings\Application Data\ffafle
c:\documents and settings\Don\Local Settings\Application Data\mghrgo
c:\documents and settings\Don\Local Settings\Application Data\ofwrcb
c:\documents and settings\Don\Local Settings\Application Data\nvfyue
c:\documents and settings\Don\Local Settings\Application Data\qdqmuh
c:\documents and settings\Don\Local Settings\Application Data\bbbtcj
c:\documents and settings\Don\Local Settings\Application Data\vsgfiu
c:\documents and settings\Don\Local Settings\Application Data\yarsix
c:\documents and settings\Don\Local Settings\Application Data\kxcaoa
c:\documents and settings\Don\Local Settings\Application Data\xmaotw
c:\documents and settings\Don\Local Settings\Application Data\qapxtp
c:\documents and settings\Don\Local Settings\Application Data\nygrly
c:\documents and settings\Don\Local Settings\Application Data\nteblu
c:\documents and settings\Don\Local Settings\Application Data\esoowa
c:\documents and settings\Don\Local Settings\Application Data\rduxdb
c:\documents and settings\Don\Local Settings\Application Data\dvdojy
c:\documents and settings\Don\Local Settings\Application Data\symxre
c:\documents and settings\Don\Local Settings\Application Data\ntvkib
c:\documents and settings\Don\Local Settings\Application Data\crwxyu
c:\documents and settings\Don\Local Settings\Application Data\xduvlt
c:\documents and settings\Don\Local Settings\Application Data\lutvxv
c:\documents and settings\Don\Local Settings\Application Data\ssnwtf
c:\documents and settings\Don\Local Settings\Application Data\kkdcqy
c:\documents and settings\Don\Local Settings\Application Data\qyyepf
c:\documents and settings\Don\Local Settings\Application Data\rprkcu
c:\documents and settings\Don\Local Settings\Application Data\vxufeq
c:\documents and settings\Don\Local Settings\Application Data\lvcxlr
c:\documents and settings\Don\Local Settings\Application Data\bxrnkd
c:\documents and settings\Don\Local Settings\Application Data\jbulxy
c:\documents and settings\Don\Local Settings\Application Data\gobahk
c:\documents and settings\Don\Local Settings\Application Data\wwymwh
c:\documents and settings\Don\Local Settings\Application Data\xbopey
c:\documents and settings\Don\Local Settings\Application Data\ymvrut
c:\documents and settings\Don\Local Settings\Application Data\igqwte
c:\documents and settings\Don\Local Settings\Application Data\uqlnxj
c:\documents and settings\Don\Local Settings\Application Data\yjgmsp
c:\documents and settings\Don\Local Settings\Application Data\nrxsrg
c:\documents and settings\Don\Local Settings\Application Data\ainrjv
c:\documents and settings\Don\Local Settings\Application Data\iixiek
c:\documents and settings\Don\Local Settings\Application Data\bxbccd
c:\documents and settings\Don\Local Settings\Application Data\elnegy
c:\documents and settings\Don\Local Settings\Application Data\ttfkfp
c:\documents and settings\Don\Local Settings\Application Data\dwonjq
c:\documents and settings\Don\Local Settings\Application Data\laqlvm
c:\documents and settings\Don\Local Settings\Application Data\bbnkgr
c:\documents and settings\Don\Application Data\prspia
c:\documents and settings\Don\Local Settings\Application Data\prspia
c:\documents and settings\Don\Local Settings\Application Data\svoxgy
c:\documents and settings\Don\Local Settings\Application Data\ksmasd
c:\documents and settings\Don\Local Settings\Application Data\aoacmw
c:\documents and settings\Don\Local Settings\Application Data\cfaops
c:\documents and settings\Don\Local Settings\Application Data\hontxn
c:\documents and settings\Don\Local Settings\Application Data\fahxjy
c:\documents and settings\Don\Local Settings\Application Data\gqafvn
c:\documents and settings\Don\Local Settings\Application Data\nlxtbm
c:\documents and settings\Don\Local Settings\Application Data\xvmgnk
c:\documents and settings\Don\Local Settings\Application Data\ednawg
c:\documents and settings\Don\Local Settings\Application Data\ncaqeb
c:\documents and settings\Don\Local Settings\Application Data\igigqj
c:\documents and settings\Don\Local Settings\Application Data\huxvug
c:\documents and settings\Don\Local Settings\Application Data\akbqsa
c:\documents and settings\Don\Local Settings\Application Data\ssidci
c:\documents and settings\Don\Local Settings\Application Data\lscrgx
c:\documents and settings\Don\Local Settings\Application Data\njuxtm
c:\documents and settings\Don\Local Settings\Application Data\indogu
c:\documents and settings\Don\Local Settings\Application Data\twuhlj
c:\documents and settings\Don\Local Settings\Application Data\tjxmqg
c:\documents and settings\Don\Local Settings\Application Data\iothxk
c:\documents and settings\Don\Local Settings\Application Data\jfmoky
c:\documents and settings\Don\Local Settings\Application Data\ihyyia
c:\documents and settings\Don\Local Settings\Application Data\gatirl
File::
c:\program files\946234.dat
c:\program files\1591921.dat
c:\program files\927609.dat
c:\program files\927437.dat
c:\program files\924171.dat
c:\program files\1208046.dat
c:\program files\914968.dat
c:\program files\1153515.dat
c:\program files\943562.dat
c:\program files\1173921.dat
c:\program files\1960578.dat

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

Copy the entire contents of the Quote Box below to Notepad.
Name the file as Test.bat
Change the Save as Type to All Files
and Save it on the desktop
Once saved, double click on the Test.bat file and post its report.

@Echo off
cd /d %~dp0
ECHO Working....... Please wait
nbtstat -n >Report.txt
ipconfig /All >>Report.txt
Ping Yahoo.com >>Report.txt
Ping Google.com >>Report.txt
Net Start >>Report.txt
Notepad Report.txt
Del %0

donj · February 15, 2010

the files are attached. i included a second test report which was done after i started 'wireless zero configuration' and set windows to automatically detect wireless network setings.

log5.txt

Report.txt

Report2.txt

JSntgRvr · February 15, 2010

Remove Comodo from your system.

Copy the entire contents of the Quote Box below to Notepad.
Name the file as CFScript.txt
Change the Save as Type to All Files
and Save it on the desktop

Folder::
c:\documents and settings\Don\Local Settings\Application Data\jhfvqo
c:\documents and settings\Don\Local Settings\Application Data\jmnsha
c:\documents and settings\Don\Local Settings\Application Data\flsaon
c:\documents and settings\Don\Local Settings\Application Data\ofnfnw
c:\documents and settings\Don\Local Settings\Application Data\gclhbc
c:\documents and settings\Don\Local Settings\Application Data\hseonq
c:\documents and settings\Don\Local Settings\Application Data\oxswym
c:\documents and settings\Don\Local Settings\Application Data\oafiwm
c:\documents and settings\Don\Local Settings\Application Data\lsttxi
c:\documents and settings\Don\Local Settings\Application Data\scmdfh
c:\documents and settings\Don\Local Settings\Application Data\tsfkrw
c:\documents and settings\Don\Local Settings\Application Data\vjxrfl
c:\documents and settings\Don\Local Settings\Application Data\fdsveu
c:\documents and settings\Don\Local Settings\Application Data\ahbmqd
c:\documents and settings\Don\Application Data\mihfpp
c:\documents and settings\Don\Local Settings\Application Data\mihfpp
c:\documents and settings\Don\Local Settings\Application Data\fvxopj
c:\documents and settings\Don\Local Settings\Application Data\hmqucx
c:\documents and settings\Don\Application Data\cqylog
c:\documents and settings\Don\Local Settings\Application Data\cqylog
c:\documents and settings\Don\Local Settings\Application Data\godgbx
c:\documents and settings\Don\Local Settings\Application Data\ryqrnw
c:\documents and settings\Don\Local Settings\Application Data\okkvyi
c:\documents and settings\Don\Local Settings\Application Data\dluswy
c:\documents and settings\Don\Local Settings\Application Data\vekuyg
c:\documents and settings\Don\Local Settings\Application Data\xucclu
c:\documents and settings\Don\Local Settings\Application Data\ugwgxg
c:\documents and settings\Don\Application Data\sjsewp
c:\documents and settings\Don\Local Settings\Application Data\sjsewp
c:\documents and settings\Don\Application Data\mwjnwj
c:\documents and settings\Don\Local Settings\Application Data\mwjnwj
c:\documents and settings\Don\Application Data\vqerws
c:\documents and settings\Don\Local Settings\Application Data\vqerws
c:\documents and settings\Don\Local Settings\Application Data\hbrejq
c:\documents and settings\Don\Local Settings\Application Data\pwythb
c:\documents and settings\Don\Local Settings\Application Data\xacrtv
c:\documents and settings\Don\Application Data\fxhono
c:\documents and settings\Don\Local Settings\Application Data\ymxxni
c:\documents and settings\Don\Local Settings\Application Data\slxrjf
c:\documents and settings\Don\Local Settings\Application Data\cfsvjo
c:\documents and settings\Don\Local Settings\Application Data\fxhono
c:\documents and settings\Don\Local Settings\Application Data\badtcw
c:\documents and settings\Don\Application Data\ehohba
c:\documents and settings\Don\Local Settings\Application Data\ehohba
c:\documents and settings\Don\Local Settings\Application Data\rnkchf
c:\documents and settings\Don\Local Settings\Application Data\nfkfqf
c:\documents and settings\Don\Local Settings\Application Data\wyfkqo
c:\documents and settings\Don\Local Settings\Application Data\dbxhky
c:\documents and settings\Don\Local Settings\Application Data\uxvjwd
c:\documents and settings\Don\Local Settings\Application Data\vooqjr
c:\documents and settings\Don\Local Settings\Application Data\pceajl
c:\documents and settings\Don\Local Settings\Application Data\ttnmgs
c:\documents and settings\Don\Local Settings\Application Data\senwik
c:\documents and settings\Don\Application Data\uqjahk
c:\documents and settings\Don\Local Settings\Application Data\uqjahk
c:\documents and settings\Don\Local Settings\Application Data\baecxu
c:\documents and settings\Don\Local Settings\Application Data\swceky
c:\documents and settings\Don\Local Settings\Application Data\ktygxe
c:\documents and settings\Don\Local Settings\Application Data\lfjqth
c:\documents and settings\Don\Local Settings\Application Data\dpdobp
c:\documents and settings\Don\Local Settings\Application Data\ymrwym
c:\documents and settings\Don\Local Settings\Application Data\wwxgdg
c:\documents and settings\Don\Local Settings\Application Data\pkopda
c:\documents and settings\Don\Local Settings\Application Data\huinki
c:\documents and settings\Don\Local Settings\Application Data\roeskr
c:\documents and settings\Don\Local Settings\Application Data\epkkjf
c:\documents and settings\Don\Local Settings\Application Data\qkjhfn
c:\documents and settings\Don\Local Settings\Application Data\buwsrm
c:\documents and settings\Don\Local Settings\Application Data\lorwrv
c:\documents and settings\Don\Local Settings\Application Data\gsanee
c:\documents and settings\Don\Local Settings\Application Data\fnrqns
c:\documents and settings\Don\Local Settings\Application Data\uqbbvx
c:\documents and settings\Don\Local Settings\Application Data\hvyolo
c:\documents and settings\Don\Local Settings\Application Data\rgmaxm
c:\documents and settings\Don\Local Settings\Application Data\bdtpvw
c:\documents and settings\Don\Local Settings\Application Data\lnhbiu
c:\documents and settings\Don\Local Settings\Application Data\tyxxyi
c:\documents and settings\Don\Local Settings\Application Data\lqndvc
c:\documents and settings\Don\Local Settings\Application Data\eedmuu
c:\documents and settings\Don\Local Settings\Application Data\bkotqv
c:\documents and settings\Don\Local Settings\Application Data\ruuroy
c:\documents and settings\Don\Local Settings\Application Data\pgovbk
c:\documents and settings\Don\Local Settings\Application Data\vbmlfj
c:\documents and settings\Don\Local Settings\Application Data\xrloam
c:\documents and settings\Don\Local Settings\Application Data\ksrhyy
c:\documents and settings\Don\Local Settings\Application Data\qhnjxg
c:\documents and settings\Don\Local Settings\Application Data\sqlivj
c:\documents and settings\Don\Local Settings\Application Data\yxncfe
c:\documents and settings\Don\Local Settings\Application Data\xsqcmc
c:\documents and settings\Don\Local Settings\Application Data\pmyxxc
c:\documents and settings\Don\Local Settings\Application Data\robpgu
c:\documents and settings\Don\Local Settings\Application Data\biwtge
c:\documents and settings\Don\Local Settings\Application Data\njdmfr
c:\documents and settings\Don\Local Settings\Application Data\pcqavl
c:\documents and settings\Don\Application Data\yvlevu
c:\documents and settings\Don\Application Data\rjcnuo
c:\documents and settings\Don\Local Settings\Application Data\yvlevu
c:\documents and settings\Don\Local Settings\Application Data\tauuid
c:\documents and settings\Don\Local Settings\Application Data\rjcnuo
c:\documents and settings\Don\Application Data\cdwsuy
c:\documents and settings\Don\Local Settings\Application Data\lwrwui
c:\documents and settings\Don\Local Settings\Application Data\cdwsuy
c:\documents and settings\Don\Application Data\xspsdk
File::
c:\program files\913859.dat
c:\program files\2408937.dat
c:\program files\1060687.dat
c:\program files\1187359.dat

Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report.

Lets take a deeper look.

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
OTL should now start. Change the following settings
- Change Drivers to All
- Change Registry and Extra Registry to All
- Under File Scans, change File age to 30
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please attach the contents of these files in your next reply.

Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe.
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
- Sections
- Processes
- Threads
- Libraries
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
[*] Then click the Scan button & wait for it to finish.
[*] Once done click on the [save..] button, and in the File name area, type in "ark.txt"
[*]Save it where you can easily find it, such as your desktop and post its contents in your next reply.

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

I will check these report in the AM.

donj · February 15, 2010

I uninstalled Comodo last week and I did a search. The only file that shows up is the quarantined one in combofix. Also, when I did the OTL scan I changed everything as you said, but when I started the scan it changed file age to 14, drivers to none and registry to none. I tried it again and it did the same thing. When I did the GMER scan the desktop went away and all that I see is the background. It has been like that for about 20 minutes. Is it still scanning? I will attach the logs from the previous two scans.

log6.txt

OTL.Txt

Extras.Txt

JSntgRvr · February 15, 2010

Hi, donj

The reports submitted provide no clue as to what is the problem. Perhaps we should take a look at the computer from an external source.

First, if you were unable to run GMER, follow these steps:

Double click GMER.exe.
No need to scan. Just wait until the initial scan is finished.
Once done click on the Rootkit tab, then on the[save..] button, and in the File name area, type in "ark.txt"
Change the Save as Type to All Files
Save the log where you can easily find it, such as your desktop.
Post it in your next reply

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Please copy and paste the contents of that report in your next reply.

Now, back to the external source, you will need a flash drive to move information from the sick computer to a working computer, so we can see the progress of our actions. Save these instructions in your flash drive as a text file (use notepad) so you can have access to these while in an external environment (PE).

Here is what you need to do.

Two programs to download

First

Download ISOBurner. Click Here for ISOBurner Instructions. Install the program, and follow the next set of steps.

Second

Download OTLPE.iso and burn to a CD using ISO Burner. NOTE: This file is 276.7MB in size so it may take some time to download.
When downloaded double click and this will then open ISOBurner to burn the file to CD
Boot the Non working computer using the boot CD you just created.
In order to do so, the computer must be set to boot from the CD first
Note : For information click here
Your system should now display a REATOGO-X-PE desktop.
Double-click on the OTLPE icon.
When asked "Do you wish to load the remote registry", select Yes
When asked "Do you wish to load remote user profile(s) for scanning", select Yes
Ensure the box "Automatically Load All Remaining Users" is checked and press OK
OTL should now start. Change the following settings
- Change Drivers to All
- Change Registry to All
- Under the Custom Scan box paste this in
  
  %SYSTEMDRIVE%\*.*
  
  /md5start
  
  eventlog.dll
  
  scecli.dll
  
  netlogon.dll
  
  cngaudit.dll
  
  sceclt.dll
  
  ntelogon.dll
  
  logevent.dll
  
  iaStor.sys
  
  nvstor.sys
  
  atapi.sys
  
  IdeChnDr.sys
  
  viasraid.sys
  
  AGP440.sys
  
  vaxscsi.sys
  
  nvatabus.sys
  
  viamraid.sys
  
  nvata.sys
  
  nvgts.sys
  
  iastorv.sys
  
  ViPrt.sys
  
  eNetHook.dll
  
  ahcix86.sys
  
  KR10N.sys
  
  nvstor32.sys
  
  ahcix86s.sys
  
  nvrd32.sys
  
  /md5stop
  
  %systemroot%\*. /mp /s
  
  %systemroot%\System32\config\*.sav
[*]Press Run Scan to start the scan.
[*]When finished, the file will be saved in drive C:\OTL.txt
[*]Copy this file to your USB drive.
[*]Please post the contents of the C:\OTL.txt file in your reply.

donj · February 15, 2010

I'm having trouble downloading OLTPE, but I attached the file from GMER for now.

ark.txt

JSntgRvr · February 16, 2010

Lets try another program.

Download OTS.exe by OldTimer to your Desktop.

Close any open browsers.
Double-click on OTS.exe to start the program.
Leave all settings as they appear as default, except for the following:
- Under Drivers, select "All".
- Under Registry, select "All".
- File age should be 30 days.
- Under Additional Scans, click on the "Extras" button.

[*]Now click the Run Scan button on the toolbar.

[*]The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.

[*]When the scan is complete Notepad will open with the report file loaded in it.

[*]Save that notepad file

Use the Reply button and attach the notepad file here (Do not copy and paste in a reply, rather attach it to it).

donj · February 16, 2010

Lets try another program.
Download OTS.exe by OldTimer to your Desktop.
Close any open browsers.
Double-click on OTS.exe to start the program.
Leave all settings as they appear as default, except for the following:
Under Drivers, select "All".
Under Registry, select "All".
File age should be 30 days.
Under Additional Scans, click on the "Extras" button.
[*]Now click the Run Scan button on the toolbar.
[*]The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Save that notepad file
Use the Reply button and attach the notepad file here (Do not copy and paste in a reply, rather attach it to it).

file is attached

OTS.Txt

JSntgRvr · February 16, 2010

Start OTS. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[unregister Dlls]
[Win32 Services - Safe List]
YN -> (cmdAgent) COMODO Internet Security Helper Service [Disabled | Stopped] ->
[Driver Services - All]
YY -> (cmdGuard) COMODO Internet Security Sandbox Driver [File_System | System | Running] -> C:\WINDOWS\system32\drivers\cmdguard.sys
YY -> (Inspect) COMODO Internet Security Firewall Driver [Kernel | Boot | Running] -> C:\WINDOWS\System32\DRIVERS\inspect.sys
YY -> (cmdHlp) COMODO Internet Security Helper Driver [Kernel | System | Running] -> C:\WINDOWS\system32\drivers\cmdhlp.sys
[Registry - All]
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
YN -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 2 domain(s) found.
YN -> buy-internetsecurity10.com .[http] -> Trusted sites
YN -> 1 domain(s) and sub-domain(s) not assigned to a zone. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4 domain(s) found.
YN -> buy-internetsecurity10.com .[http] -> Trusted sites
YN -> is10-soft-download.com .[http] -> Trusted sites
YN -> is-software-download.com .[http] -> Trusted sites
YN -> is-software-download25.com .[http] -> Trusted sites
[Files/Folders - Created Within 30 Days]
NY -> lhashi -> C:\Documents and Settings\Don\Local Settings\Application Data\lhashi
NY -> ubvwhr -> C:\Documents and Settings\Don\Local Settings\Application Data\ubvwhr
NY -> xiglgu -> C:\Documents and Settings\Don\Local Settings\Application Data\xiglgu
NY -> hccpgf -> C:\Documents and Settings\Don\Local Settings\Application Data\hccpgf
NY -> jstwst -> C:\Documents and Settings\Don\Local Settings\Application Data\jstwst
NY -> cgkgsn -> C:\Documents and Settings\Don\Local Settings\Application Data\cgkgsn
NY -> tdiifr -> C:\Documents and Settings\Don\Local Settings\Application Data\tdiifr
NY -> hofulc -> C:\Documents and Settings\Don\Local Settings\Application Data\hofulc
NY -> jlyoei -> C:\Documents and Settings\Don\Local Settings\Application Data\jlyoei
NY -> eqifqq -> C:\Documents and Settings\Don\Local Settings\Application Data\eqifqq
NY -> tyyloh -> C:\Documents and Settings\Don\Local Settings\Application Data\tyyloh
NY -> aehoju -> C:\Documents and Settings\Don\Local Settings\Application Data\aehoju
NY -> jxdtjf -> C:\Documents and Settings\Don\Local Settings\Application Data\jxdtjf
NY -> bnbxfr -> C:\Documents and Settings\Don\Local Settings\Application Data\bnbxfr
NY -> jqdvrn -> C:\Documents and Settings\Don\Local Settings\Application Data\jqdvrn
NY -> lhvdec -> C:\Documents and Settings\Don\Local Settings\Application Data\lhvdec
NY -> kjindc -> C:\Documents and Settings\Don\Local Settings\Application Data\kjindc
NY -> utvapa -> C:\Documents and Settings\Don\Local Settings\Application Data\utvapa
NY -> desfrg -> C:\Documents and Settings\Don\Local Settings\Application Data\desfrg
NY -> qvrfdi -> C:\Documents and Settings\Don\Local Settings\Application Data\qvrfdi
NY -> labupq -> C:\Documents and Settings\Don\Local Settings\Application Data\labupq
NY -> cgfqpg -> C:\Documents and Settings\Don\Local Settings\Application Data\cgfqpg
NY -> dwxwcu -> C:\Documents and Settings\Don\Local Settings\Application Data\dwxwcu
NY -> pxepci -> C:\Documents and Settings\Don\Local Settings\Application Data\pxepci
NY -> wetynd -> C:\Documents and Settings\Don\Local Settings\Application Data\wetynd
NY -> twikna -> C:\Documents and Settings\Don\Local Settings\Application Data\twikna
NY -> eqdpnk -> C:\Documents and Settings\Don\Local Settings\Application Data\eqdpnk
NY -> birbog -> C:\Documents and Settings\Don\Local Settings\Application Data\birbog
NY -> nkxtnt -> C:\Documents and Settings\Don\Local Settings\Application Data\nkxtnt
NY -> mtgnbf -> C:\Documents and Settings\Don\Local Settings\Application Data\mtgnbf
NY -> obqbai -> C:\Documents and Settings\Don\Local Settings\Application Data\obqbai
NY -> ejihyy -> C:\Documents and Settings\Don\Local Settings\Application Data\ejihyy
NY -> dspbmk -> C:\Documents and Settings\Don\Local Settings\Application Data\dspbmk
NY -> gaboln -> C:\Documents and Settings\Don\Local Settings\Application Data\gaboln
NY -> bejfxv -> C:\Documents and Settings\Don\Local Settings\Application Data\bejfxv
NY -> ihmckq -> C:\Documents and Settings\Don\Local Settings\Application Data\ihmckq
NY -> kxfjxf -> C:\Documents and Settings\Don\Local Settings\Application Data\kxfjxf
NY -> cuclkk -> C:\Documents and Settings\Don\Local Settings\Application Data\cuclkk
NY -> fcnajn -> C:\Documents and Settings\Don\Local Settings\Application Data\fcnajn
NY -> wylcws -> C:\Documents and Settings\Don\Local Settings\Application Data\wylcws
NY -> gsggwc -> C:\Documents and Settings\Don\Local Settings\Application Data\gsggwc
NY -> stmyvo -> C:\Documents and Settings\Don\Local Settings\Application Data\stmyvo
NY -> rdtsja -> C:\Documents and Settings\Don\Local Settings\Application Data\rdtsja
NY -> ukfgie -> C:\Documents and Settings\Don\Local Settings\Application Data\ukfgie
NY -> vbxnus -> C:\Documents and Settings\Don\Local Settings\Application Data\vbxnus
NY -> mhciui -> C:\Documents and Settings\Don\Local Settings\Application Data\mhciui
NY -> eeakin -> C:\Documents and Settings\Don\Local Settings\Application Data\eeakin
NY -> oonwul -> C:\Documents and Settings\Don\Local Settings\Application Data\oonwul
NY -> fusruc -> C:\Documents and Settings\Don\Local Settings\Application Data\fusruc
NY -> yiibuv -> C:\Documents and Settings\Don\Local Settings\Application Data\yiibuv
NY -> icegtf -> C:\Documents and Settings\Don\Local Settings\Application Data\icegtf
NY -> jsvmht -> C:\Documents and Settings\Don\Local Settings\Application Data\jsvmht
NY -> bptoty -> C:\Documents and Settings\Don\Local Settings\Application Data\bptoty
NY -> tmrrhe -> C:\Documents and Settings\Don\Local Settings\Application Data\tmrrhe
NY -> dgmvgn -> C:\Documents and Settings\Don\Local Settings\Application Data\dgmvgn
NY -> qhqmox -> C:\Documents and Settings\Don\Local Settings\Application Data\qhqmox
NY -> rxitbm -> C:\Documents and Settings\Don\Local Settings\Application Data\rxitbm
NY -> tobbnb -> C:\Documents and Settings\Don\Local Settings\Application Data\tobbnb
NY -> mcrknt -> C:\Documents and Settings\Don\Local Settings\Application Data\mcrknt
NY -> llydaf -> C:\Documents and Settings\Don\Local Settings\Application Data\llydaf
NY -> eyomay -> C:\Documents and Settings\Don\Local Settings\Application Data\eyomay
NY -> oskqaj -> C:\Documents and Settings\Don\Local Settings\Application Data\oskqaj
NY -> xmfvas -> C:\Documents and Settings\Don\Local Settings\Application Data\xmfvas
NY -> gphtmn -> C:\Documents and Settings\Don\Local Settings\Application Data\gphtmn
NY -> hgaayc -> C:\Documents and Settings\Don\Local Settings\Application Data\hgaayc
NY -> knloyf -> C:\Documents and Settings\Don\Local Settings\Application Data\knloyf
NY -> frteln -> C:\Documents and Settings\Don\Local Settings\Application Data\frteln
NY -> olpjlx -> C:\Documents and Settings\Don\Local Settings\Application Data\olpjlx
NY -> tnrpch -> C:\Documents and Settings\Don\Local Settings\Application Data\tnrpch
NY -> xspsdk -> C:\Documents and Settings\Don\Local Settings\Application Data\xspsdk
NY -> lkospl -> C:\Documents and Settings\Don\Local Settings\Application Data\lkospl
NY -> gpxict -> C:\Documents and Settings\Don\Local Settings\Application Data\gpxict
NY -> thvinv -> C:\Documents and Settings\Don\Application Data\thvinv
NY -> thvinv -> C:\Documents and Settings\Don\Local Settings\Application Data\thvinv
NY -> olfxae -> C:\Documents and Settings\Don\Local Settings\Application Data\olfxae
NY -> rsqmyh -> C:\Documents and Settings\Don\Local Settings\Application Data\rsqmyh
NY -> sjitlv -> C:\Documents and Settings\Don\Local Settings\Application Data\sjitlv
NY -> uabayk -> C:\Documents and Settings\Don\Local Settings\Application Data\uabayk
NY -> etwfxt -> C:\Documents and Settings\Don\Local Settings\Application Data\etwfxt
NY -> aoxcwq -> C:\Documents and Settings\Don\Local Settings\Application Data\aoxcwq
NY -> gdtevw -> C:\Documents and Settings\Don\Local Settings\Application Data\gdtevw
NY -> bcoflq -> C:\Documents and Settings\Don\Local Settings\Application Data\bcoflq
NY -> bcoflq -> C:\Documents and Settings\Don\Application Data\bcoflq
NY -> djatlt -> C:\Documents and Settings\Don\Local Settings\Application Data\djatlt
NY -> otnfxs -> C:\Documents and Settings\Don\Local Settings\Application Data\otnfxs
NY -> xnijxc -> C:\Documents and Settings\Don\Local Settings\Application Data\xnijxc
NY -> koocwp -> C:\Documents and Settings\Don\Application Data\koocwp
NY -> ihdowl -> C:\Documents and Settings\Don\Local Settings\Application Data\ihdowl
NY -> koocwp -> C:\Documents and Settings\Don\Local Settings\Application Data\koocwp
NY -> mfhjje -> C:\Documents and Settings\Don\Local Settings\Application Data\mfhjje
NY -> ecflvi -> C:\Documents and Settings\Don\Local Settings\Application Data\ecflvi
NY -> bqlbgt -> C:\Documents and Settings\Don\Local Settings\Application Data\bqlbgt
NY -> vutrsc -> C:\Documents and Settings\Don\Local Settings\Application Data\vutrsc
NY -> viqmnf -> C:\Documents and Settings\Don\Local Settings\Application Data\viqmnf
NY -> gnvbjs -> C:\Documents and Settings\Don\Application Data\gnvbjs
NY -> gnvbjs -> C:\Documents and Settings\Don\Local Settings\Application Data\gnvbjs
NY -> ciwyip -> C:\Documents and Settings\Don\Application Data\ciwyip
NY -> ciwyip -> C:\Documents and Settings\Don\Local Settings\Application Data\ciwyip
NY -> tfubuu -> C:\Documents and Settings\Don\Application Data\tfubuu
NY -> tfubuu -> C:\Documents and Settings\Don\Local Settings\Application Data\tfubuu
NY -> mpoycd -> C:\Documents and Settings\Don\Local Settings\Application Data\mpoycd
NY -> wackob -> C:\Documents and Settings\Don\Local Settings\Application Data\wackob
NY -> mtpbbp -> C:\Documents and Settings\Don\Local Settings\Application Data\mtpbbp
NY -> vnkfba -> C:\Documents and Settings\Don\Local Settings\Application Data\vnkfba
NY -> wedmno -> C:\Documents and Settings\Don\Local Settings\Application Data\wedmno
NY -> hxxrnx -> C:\Documents and Settings\Don\Local Settings\Application Data\hxxrnx
NY -> sbqukl -> C:\Documents and Settings\Don\Local Settings\Application Data\sbqukl
NY -> dlegwj -> C:\Documents and Settings\Don\Local Settings\Application Data\dlegwj
NY -> dlegwj -> C:\Documents and Settings\Don\Application Data\dlegwj
NY -> nfalwt -> C:\Documents and Settings\Don\Local Settings\Application Data\nfalwt
NY -> cnqrvj -> C:\Documents and Settings\Don\Local Settings\Application Data\cnqrvj
NY -> ukotio -> C:\Documents and Settings\Don\Local Settings\Application Data\ukotio
NY -> bpddtj -> C:\Documents and Settings\Don\Local Settings\Application Data\bpddtj
NY -> xjuejf -> C:\Documents and Settings\Don\Local Settings\Application Data\xjuejf
NY -> aanlvt -> C:\Documents and Settings\Don\Local Settings\Application Data\aanlvt
NY -> dhxyvw -> C:\Documents and Settings\Don\Local Settings\Application Data\dhxyvw
NY -> nrmkiv -> C:\Documents and Settings\Don\Local Settings\Application Data\nrmkiv
NY -> wlscvv -> C:\Documents and Settings\Don\Local Settings\Application Data\wlscvv
NY -> gfnhvg -> C:\Documents and Settings\Don\Local Settings\Application Data\gfnhvg
NY -> tmunbk -> C:\Documents and Settings\Don\Local Settings\Application Data\tmunbk
NY -> cfcrrp -> C:\Documents and Settings\Don\Application Data\cfcrrp
NY -> cfcrrp -> C:\Documents and Settings\Don\Local Settings\Application Data\cfcrrp
NY -> wjkiex -> C:\Documents and Settings\Don\Local Settings\Application Data\wjkiex
NY -> xtihcb -> C:\Documents and Settings\Don\Local Settings\Application Data\xtihcb
NY -> lntrmd -> C:\Documents and Settings\Don\Local Settings\Application Data\lntrmd
NY -> xcvggt -> C:\Documents and Settings\Don\Local Settings\Application Data\xcvggt
NY -> fpanvg -> C:\Documents and Settings\Don\Application Data\fpanvg
NY -> fpanvg -> C:\Documents and Settings\Don\Local Settings\Application Data\fpanvg
NY -> nuucxi -> C:\Documents and Settings\Don\Local Settings\Application Data\nuucxi
NY -> rsywjb -> C:\Documents and Settings\Don\Local Settings\Application Data\rsywjb
NY -> emkhtc -> C:\Documents and Settings\Don\Local Settings\Application Data\emkhtc
NY -> wurtdk -> C:\Documents and Settings\Don\Local Settings\Application Data\wurtdk
NY -> kkpyyp -> C:\Documents and Settings\Don\Local Settings\Application Data\kkpyyp
NY -> gaiahb -> C:\Documents and Settings\Don\Local Settings\Application Data\gaiahb
NY -> wtkqcu -> C:\Documents and Settings\Don\Local Settings\Application Data\wtkqcu
NY -> wrnbpw -> C:\Documents and Settings\Don\Local Settings\Application Data\wrnbpw
NY -> yhnots -> C:\Documents and Settings\Don\Local Settings\Application Data\yhnots
NY -> axgugh -> C:\Documents and Settings\Don\Local Settings\Application Data\axgugh
NY -> krbagq -> C:\Documents and Settings\Don\Application Data\krbagq
NY -> krbagq -> C:\Documents and Settings\Don\Local Settings\Application Data\krbagq
NY -> tsxrls -> C:\Documents and Settings\Don\Local Settings\Application Data\tsxrls
NY -> vjqyxh -> C:\Documents and Settings\Don\Local Settings\Application Data\vjqyxh
NY -> yqcmwk -> C:\Documents and Settings\Don\Local Settings\Application Data\yqcmwk
NY -> lrifwx -> C:\Documents and Settings\Don\Local Settings\Application Data\lrifwx
NY -> gpxdis -> C:\Documents and Settings\Don\Local Settings\Application Data\gpxdis
NY -> hgqjui -> C:\Documents and Settings\Don\Local Settings\Application Data\hgqjui
NY -> thwcuu -> C:\Documents and Settings\Don\Local Settings\Application Data\thwcuu
NY -> qpuunu -> C:\Documents and Settings\Don\Local Settings\Application Data\qpuunu
NY -> hgcgsq -> C:\Documents and Settings\Don\Local Settings\Application Data\hgcgsq
NY -> pcjvqa -> C:\Documents and Settings\Don\Local Settings\Application Data\pcjvqa
NY -> xadwnk -> C:\Documents and Settings\Don\Local Settings\Application Data\xadwnk
NY -> htycmt -> C:\Documents and Settings\Don\Application Data\htycmt
NY -> htycmt -> C:\Documents and Settings\Don\Local Settings\Application Data\htycmt
NY -> utladn -> C:\Documents and Settings\Don\Local Settings\Application Data\utladn
NY -> nehluy -> C:\Documents and Settings\Don\Local Settings\Application Data\nehluy
NY -> tlifeu -> C:\Documents and Settings\Don\Local Settings\Application Data\tlifeu
NY -> qbnpur -> C:\Documents and Settings\Don\Local Settings\Application Data\qbnpur
NY -> camrvt -> C:\Documents and Settings\Don\Local Settings\Application Data\camrvt
NY -> xpfref -> C:\Documents and Settings\Don\Local Settings\Application Data\xpfref
NY -> hjaweo -> C:\Documents and Settings\Don\Application Data\hjaweo
NY -> hjaweo -> C:\Documents and Settings\Don\Local Settings\Application Data\hjaweo
NY -> bwqgei -> C:\Documents and Settings\Don\Local Settings\Application Data\bwqgei
NY -> aydqci -> C:\Documents and Settings\Don\Local Settings\Application Data\aydqci
NY -> ccfila -> C:\Documents and Settings\Don\Local Settings\Application Data\ccfila
NY -> wkmvbh -> C:\Documents and Settings\Don\Local Settings\Application Data\wkmvbh
NY -> arxjbk -> C:\Documents and Settings\Don\Local Settings\Application Data\arxjbk
NY -> fgtlyq -> C:\Documents and Settings\Don\Local Settings\Application Data\fgtlyq
NY -> xocxiy -> C:\Documents and Settings\Don\Local Settings\Application Data\xocxiy
NY -> efdmtu -> C:\Documents and Settings\Don\Local Settings\Application Data\efdmtu
NY -> rwcmfw -> C:\Documents and Settings\Don\Local Settings\Application Data\rwcmfw
NY -> dpdwvn -> C:\Documents and Settings\Don\Local Settings\Application Data\dpdwvn
NY -> woeqrk -> C:\Documents and Settings\Don\Local Settings\Application Data\woeqrk
NY -> ebxscm -> C:\Documents and Settings\Don\Local Settings\Application Data\ebxscm
NY -> rcelby -> C:\Documents and Settings\Don\Local Settings\Application Data\rcelby
NY -> wqanaf -> C:\Documents and Settings\Don\Application Data\wqanaf
NY -> wqanaf -> C:\Documents and Settings\Don\Local Settings\Application Data\wqanaf
NY -> xrdhqp -> C:\Documents and Settings\Don\Local Settings\Application Data\xrdhqp
NY -> sjisxb -> C:\Documents and Settings\Don\Local Settings\Application Data\sjisxb
NY -> vetacg -> C:\Documents and Settings\Don\Local Settings\Application Data\vetacg
NY -> omcnlo -> C:\Documents and Settings\Don\Local Settings\Application Data\omcnlo
NY -> xgwrlx -> C:\Documents and Settings\Don\Local Settings\Application Data\xgwrlx
NY -> rhjwfu -> C:\Documents and Settings\Don\Application Data\rhjwfu
NY -> rhjwfu -> C:\Documents and Settings\Don\Local Settings\Application Data\rhjwfu
NY -> cmolbi -> C:\Documents and Settings\Don\Local Settings\Application Data\cmolbi
NY -> tfrlrb -> C:\Documents and Settings\Don\Local Settings\Application Data\tfrlrb
NY -> fiituh -> C:\Documents and Settings\Don\Local Settings\Application Data\fiituh
NY -> ecpyvg -> C:\Documents and Settings\Don\Application Data\ecpyvg
NY -> tiuuvw -> C:\Documents and Settings\Don\Local Settings\Application Data\tiuuvw
NY -> ecpyvg -> C:\Documents and Settings\Don\Local Settings\Application Data\ecpyvg
NY -> sxdboa -> C:\Documents and Settings\Don\Local Settings\Application Data\sxdboa
NY -> anpbsc -> C:\Documents and Settings\Don\Local Settings\Application Data\anpbsc
NY -> dubosf -> C:\Documents and Settings\Don\Local Settings\Application Data\dubosf
NY -> pvhhrs -> C:\Documents and Settings\Don\Local Settings\Application Data\pvhhrs
NY -> guard32.dll -> C:\WINDOWS\System32\guard32.dll
NY -> cmdguard.sys -> C:\WINDOWS\System32\drivers\cmdguard.sys
NY -> inspect.sys -> C:\WINDOWS\System32\drivers\inspect.sys
NY -> cmdhlp.sys -> C:\WINDOWS\System32\drivers\cmdhlp.sys
NY -> utduii -> C:\Documents and Settings\Don\Application Data\utduii
NY -> nhseic -> C:\Documents and Settings\Don\Local Settings\Application Data\nhseic
NY -> utduii -> C:\Documents and Settings\Don\Local Settings\Application Data\utduii
NY -> ouhjyk -> C:\Documents and Settings\Don\Local Settings\Application Data\ouhjyk
NY -> ffhprk -> C:\Documents and Settings\Don\Local Settings\Application Data\ffhprk
NY -> ingljj -> C:\Documents and Settings\Don\Local Settings\Application Data\ingljj
NY -> xukfjx -> C:\Documents and Settings\Don\Local Settings\Application Data\xukfjx
NY -> fiou.exe -> C:\fiou.exe
NY -> 9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Files/Folders - Modified Within 30 Days]
NY -> sfi.dat -> C:\WINDOWS\System32\drivers\sfi.dat
NY -> OTS.exe -> C:\Documents and Settings\Don\Desktop\OTS.exe
NY -> 21586562.dat -> C:\Program Files\21586562.dat
NY -> 21586312.dat -> C:\Program Files\21586312.dat
NY -> 21586140.dat -> C:\Program Files\21586140.dat
NY -> 21585890.dat -> C:\Program Files\21585890.dat
NY -> 21586046.dat -> C:\Program Files\21586046.dat
NY -> 21585515.dat -> C:\Program Files\21585515.dat
NY -> 21584578.dat -> C:\Program Files\21584578.dat
NY -> 21585421.dat -> C:\Program Files\21585421.dat
NY -> 21585296.dat -> C:\Program Files\21585296.dat
NY -> 21585218.dat -> C:\Program Files\21585218.dat
NY -> 21584234.dat -> C:\Program Files\21584234.dat
NY -> 21577656.dat -> C:\Program Files\21577656.dat
NY -> 21577343.dat -> C:\Program Files\21577343.dat
NY -> 21577171.dat -> C:\Program Files\21577171.dat
NY -> 21576718.dat -> C:\Program Files\21576718.dat
NY -> 1959984.dat -> C:\Program Files\1959984.dat
NY -> 1959546.dat -> C:\Program Files\1959546.dat
NY -> 1958359.dat -> C:\Program Files\1958359.dat
NY -> 1956953.dat -> C:\Program Files\1956953.dat
NY -> 1956281.dat -> C:\Program Files\1956281.dat
NY -> 1955343.dat -> C:\Program Files\1955343.dat
NY -> 1954171.dat -> C:\Program Files\1954171.dat
NY -> 1952328.dat -> C:\Program Files\1952328.dat
NY -> 1951828.dat -> C:\Program Files\1951828.dat
NY -> 1951234.dat -> C:\Program Files\1951234.dat
NY -> 1947828.dat -> C:\Program Files\1947828.dat
NY -> 1947015.dat -> C:\Program Files\1947015.dat
NY -> 1946484.dat -> C:\Program Files\1946484.dat
NY -> 1944937.dat -> C:\Program Files\1944937.dat
NY -> guard32.dll -> C:\WINDOWS\System32\guard32.dll
NY -> cmdguard.sys -> C:\WINDOWS\System32\drivers\cmdguard.sys
NY -> inspect.sys -> C:\WINDOWS\System32\drivers\inspect.sys
NY -> cmdhlp.sys -> C:\WINDOWS\System32\drivers\cmdhlp.sys
NY -> fiou.exe -> C:\fiou.exe
NY -> 9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Files - No Company Name]
NY -> 21586562.dat -> C:\Program Files\21586562.dat
NY -> 21586312.dat -> C:\Program Files\21586312.dat
NY -> 21586140.dat -> C:\Program Files\21586140.dat
NY -> 21585890.dat -> C:\Program Files\21585890.dat
NY -> 21586046.dat -> C:\Program Files\21586046.dat
NY -> 21585515.dat -> C:\Program Files\21585515.dat
NY -> 21584578.dat -> C:\Program Files\21584578.dat
NY -> 21585421.dat -> C:\Program Files\21585421.dat
NY -> 21585296.dat -> C:\Program Files\21585296.dat
NY -> 21585218.dat -> C:\Program Files\21585218.dat
NY -> 21584234.dat -> C:\Program Files\21584234.dat
NY -> 21577656.dat -> C:\Program Files\21577656.dat
NY -> 21577343.dat -> C:\Program Files\21577343.dat
NY -> 21577171.dat -> C:\Program Files\21577171.dat
NY -> 21576718.dat -> C:\Program Files\21576718.dat
NY -> 1959984.dat -> C:\Program Files\1959984.dat
NY -> 1959546.dat -> C:\Program Files\1959546.dat
NY -> 1958359.dat -> C:\Program Files\1958359.dat
NY -> 1956953.dat -> C:\Program Files\1956953.dat
NY -> 1956281.dat -> C:\Program Files\1956281.dat
NY -> 1955343.dat -> C:\Program Files\1955343.dat
NY -> 1954171.dat -> C:\Program Files\1954171.dat
NY -> 1952328.dat -> C:\Program Files\1952328.dat
NY -> 1951828.dat -> C:\Program Files\1951828.dat
NY -> 1951234.dat -> C:\Program Files\1951234.dat
NY -> 1947828.dat -> C:\Program Files\1947828.dat
NY -> 1947015.dat -> C:\Program Files\1947015.dat
NY -> 1946484.dat -> C:\Program Files\1946484.dat
NY -> 1944937.dat -> C:\Program Files\1944937.dat
NY -> sfi.dat -> C:\WINDOWS\System32\drivers\sfi.dat
[Empty Temp Folders]
[start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTS scan log. This time select a file age of 60 days.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

donj · February 16, 2010

Start OTS. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTS scan log. This time select a file age of 60 days.
I will review the information when it comes back in.
Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

As soon as I hit 'Fix' the desktop icons go away, the cursor is an hourglass in the OTS window and on the bottom of OTS it says: 'Fixing Service /driver:YY-> (cmdGuard) COMODO Internet Security Sandbox Driver [File System | System | Running] -> C:\Windows\'

It has been stuck like that for a few minutes. Is it still working?

JSntgRvr · February 16, 2010

It is suppose to be a fast fix. Try to run it again.

JSntgRvr · February 16, 2010

If it still hanging, follow these steps:

Copy the entire contents of the Quote Box below to Notepad.
Name the file as fix.bat
Change the Save as Type to All Files
and Save it on the desktop
Once saved, double click on the fix.bat file.

SC stop cmdGuard
SC Delete cmdGuard
SC stop Inspect
SC Delete Inspect
SC stop cmdHlp
SC Delete cmdHlp
Del %0

Attempt to run the fix again.

HIJACK.REGEDIT

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information