In your case just go offline, turn off your antivirus, run combofix, restart the computer to turn the av back on, go online and post the combofix log.

0

here is the combofix log: ComboFix 08-08-19.06 - Kristen Bain 2008-08-22 20:13:37.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.125 [GMT -7:00] Running from: C:\Documents and Settings\Kristen Bain\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Kristen Bain\Application Data\macromedia\Flash Player\#SharedObjects\7W8D9PN9\interclick.com C:\Documents and Settings\Kristen Bain\Application Data\macromedia\Flash Player\#SharedObjects\7W8D9PN9\interclick.com\ud.sol C:\Documents and Settings\Kristen Bain\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Kristen Bain\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\system32\illlbqxe.ini C:\WINDOWS\system32\ooUDNnmp.ini C:\WINDOWS\system32\ooUDNnmp.ini2 D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 ))))))))))))))))))))))))))))))) . 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\Malwarebytes 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-22 19:43 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-22 19:43 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-22 18:52 . 2008-08-22 18:52 4,744 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-20 18:27 . 2008-08-20 18:27 <DIR> d-------- C:\Program Files\Opera 2008-08-20 18:23 . 2008-08-20 18:23 <DIR> d-------- C:\Program Files\Mozilla Thunderbird 2008-08-20 18:23 . 2008-08-20 18:23 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\Thunderbird 2008-08-19 22:56 . 2008-08-21 14:10 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-19 22:09 . 2008-08-22 09:02 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-08-19 22:09 . 2008-08-19 22:09 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-19 22:09 . 2008-08-19 22:09 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\SUPERAntiSpyware.com 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-18 20:23 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-18 20:18 . 2008-08-18 20:18 <DIR> d-------- C:\WINDOWS\EHome 2008-08-18 19:37 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-18 19:36 . 2008-04-13 17:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-08-16 12:45 . 2008-08-16 12:47 <DIR> d-------- C:\Program Files\Rooms - The Main Building 2008-08-14 20:08 . 2008-08-14 20:08 53,248 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-08-14 18:39 . 2006-10-04 19:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2008-08-14 18:39 . 2006-10-04 19:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2008-08-14 18:38 . 2008-08-14 18:39 <DIR> d-------- C:\Program Files\Picasa2 2008-08-13 20:33 . 2008-04-11 12:04 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-13 20:25 . 2008-05-01 07:33 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 00:42 --------- d-----w C:\Program Files\Java 2008-08-20 05:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-20 05:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-20 05:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-08-20 04:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-19 02:49 --------- d-----w C:\Documents and Settings\Kristen Bain\Application Data\uTorrent 2008-07-28 14:46 --------- d-----w C:\Program Files\Google 2008-07-21 03:33 --------- d-----w C:\Program Files\Nancy Drew - The Phantom of Venice 2008-07-09 04:41 --------- d-----w C:\Program Files\Xvid 2008-07-06 01:40 --------- d-----w C:\Program Files\uTorrent 2008-07-05 20:42 --------- d-----w C:\Program Files\Common Files\PC Tools 2008-07-04 19:29 --------- d-----w C:\Program Files\Yahoo! 2008-06-28 16:45 --------- d-----w C:\Program Files\10 Days Under The Sea 2008-03-04 08:26 0 ----a-w C:\Program Files\temp01 2007-09-09 17:09 68,528 ----a-w C:\Documents and Settings\Kristen Bain\Application Data\GDIPFONTCACHEV1.DAT 2007-03-27 15:00 1,172 ----a-w C:\Documents and Settings\Kristen Bain\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12 15360] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 15:32 700416] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-18 21:58 68856] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 22:58 458752] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 05:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 05:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 05:17 118784] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-16 22:22 794713] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-06-23 14:43 102400] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 10:50 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840] "Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52 643072] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-19 22:09 1232152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 08:02 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] C:\Documents and Settings\Kristen Bain\Start Menu\Programs\Startup\ Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-18 17:31:20 4742184] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=kqlnrd.dllavgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-19 22:09] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-19 22:09] . - - - - ORPHANS REMOVED - - - - HKCU-Run-DW6 - C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Kristen Bain\Application Data\Mozilla\Firefox\Profiles\o3qtqkly.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxps://login.yahoo.com/config/mail?.intl=us . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-22 20:25:12 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????S??????`?@?????L?@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\PROGRA~1\HPQ\Shared\HPQTOA~1.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-08-22 20:39:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-23 03:39:10 Pre-Run: 10,211,233,792 bytes free Post-Run: 10,757,586,944 bytes free 174 --- E O F --- 2008-08-20 03:12:04 and here is the malware bytes log: Malwarebytes' Anti-Malware 1.25 Database version: 1078 Windows 5.1.2600 Service Pack 3 7:53:41 PM 8/22/2008 mbam-log-08-22-2008 (19-53-41).txt Scan type: Quick Scan Objects scanned: 46038 Time elapsed: 8 minute(s), 23 second(s) Memory Processes Infected: 1 Memory Modules Infected: 2 Registry Keys Infected: 8 Registry Values Infected: 3 Registry Data Items Infected: 1 Folders Infected: 6 Files Infected: 17 Memory Processes Infected: C:\WINDOWS\system32\mpxu.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: C:\WINDOWS\system32\qyxqxelr.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\kqlnrd.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3222afee-00fd-4fe7-a8e0-6f0dc734841a} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3222afee-00fd-4fe7-a8e0-6f0dc734841a} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\SecuriSoft SARL (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm2d49cf9c (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mpx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2e7afc00 (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\BASE (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\DELETED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\SAVED (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\kqlnrd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\qyxqxelr.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\mpxu.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\mpx.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jrwytrbn.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lryanxew.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Kristen Bain\Local Settings\Temp\nsa830.tmp\System.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080819211259750.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080819212831468.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080819213323250.log (Rogue.WinSpywareProtect) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM2d49cf9c.xml (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BM2d49cf9c.txt (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Kristen Bain\Local Settings\Temp\vista_sp1.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Kristen Bain\Local Settings\Temp\software.php (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Kristen Bain\Local Settings\Temp\atmadm2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. ----------------------- thank you....

0

my pages are loading again.... i don't have any idea what those logs say, but it LOOKS good. does it seem like the bad stuff is gone? i'm sending you homemade cookies when this is all done.

0

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Folder:: C:\Program Files\temp01 Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Restart the computer. Post a new Combofix log, a new Hijack This log and a new Malwarebytes log please..

0

combofix log: ComboFix 08-08-21.02 - Kristen Bain 2008-08-22 21:21:34.2 - NTFSx86 Running from: C:\Documents and Settings\Kristen Bain\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Kristen Bain\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\temp01\ . ((((((((((((((((((((((((( Files Created from 2008-07-23 to 2008-08-23 ))))))))))))))))))))))))))))))) . 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\Malwarebytes 2008-08-22 19:43 . 2008-08-22 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-22 19:43 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-22 19:43 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-08-22 18:52 . 2008-08-22 18:52 4,744 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-20 18:27 . 2008-08-20 18:27 <DIR> d-------- C:\Program Files\Opera 2008-08-20 18:23 . 2008-08-20 18:23 <DIR> d-------- C:\Program Files\Mozilla Thunderbird 2008-08-20 18:23 . 2008-08-20 18:23 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\Thunderbird 2008-08-19 22:56 . 2008-08-21 14:10 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-19 22:09 . 2008-08-22 09:02 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-08-19 22:09 . 2008-08-19 22:09 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-19 22:09 . 2008-08-19 22:09 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Documents and Settings\Kristen Bain\Application Data\SUPERAntiSpyware.com 2008-08-19 21:36 . 2008-08-19 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\en 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-18 20:25 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-18 20:23 . 2008-08-18 20:25 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-18 20:18 . 2008-08-18 20:18 <DIR> d-------- C:\WINDOWS\EHome 2008-08-18 19:37 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-18 19:36 . 2008-04-13 17:11 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll 2008-08-16 12:45 . 2008-08-16 12:47 <DIR> d-------- C:\Program Files\Rooms - The Main Building 2008-08-14 20:08 . 2008-08-14 20:08 53,248 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-08-14 18:39 . 2006-10-04 19:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2008-08-14 18:39 . 2006-10-04 19:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2008-08-14 18:38 . 2008-08-14 18:39 <DIR> d-------- C:\Program Files\Picasa2 2008-08-13 20:33 . 2008-04-11 12:04 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-13 20:25 . 2008-05-01 07:33 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 00:42 --------- d-----w C:\Program Files\Java 2008-08-20 05:24 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-08-20 05:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-20 05:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8 2008-08-20 04:04 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-19 02:49 --------- d-----w C:\Documents and Settings\Kristen Bain\Application Data\uTorrent 2008-07-28 14:46 --------- d-----w C:\Program Files\Google 2008-07-21 03:33 --------- d-----w C:\Program Files\Nancy Drew - The Phantom of Venice 2008-07-09 04:41 --------- d-----w C:\Program Files\Xvid 2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:26 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-07-06 01:40 --------- d-----w C:\Program Files\uTorrent 2008-07-05 20:42 --------- d-----w C:\Program Files\Common Files\PC Tools 2008-07-04 19:29 --------- d-----w C:\Program Files\Yahoo! 2008-06-28 16:45 --------- d-----w C:\Program Files\10 Days Under The Sea 2008-06-24 17:57 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:43 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:46 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:46 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2008-03-04 08:26 0 ----a-w C:\Program Files\temp01 2007-09-09 17:09 68,528 ----a-w C:\Documents and Settings\Kristen Bain\Application Data\GDIPFONTCACHEV1.DAT 2007-03-27 15:00 1,172 ----a-w C:\Documents and Settings\Kristen Bain\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 17:12 15360] "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 15:32 700416] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-18 21:58 68856] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 22:58 458752] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 05:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 05:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 05:17 118784] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-16 22:22 794713] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-06-23 14:43 102400] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-06-19 10:50 40960] "RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 10:23 1187840] "Reminder"="C:\Windows\CREATOR\Remind_XP.exe" [2006-02-09 09:52 643072] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-19 22:09 1232152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-06-02 08:02 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe] C:\Documents and Settings\Kristen Bain\Start Menu\Programs\Startup\ Yahoo! Widgets.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe [2008-03-18 17:31:20 4742184] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.exe [2001-02-13 02:01:04 83360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-22 21:28:33 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????L?@? ????S??????`?@?????L?@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-22 21:39:43 ComboFix-quarantined-files.txt 2008-08-23 04:39:33 ComboFix2.txt 2008-08-23 03:39:17 Pre-Run: 10,784,952,320 bytes free Post-Run: 10,769,281,024 bytes free 157 --- E O F --- 2008-08-20 03:12:04 -------------- hijack this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:41:53 PM, on 8/22/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe C:\PROGRA~1\hpq\Shared\HPQTOA~1.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Kristen Bain\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/login_verify2?&.src=ym R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.symantec.com/techsupp/se... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - ($þ - (no file) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: (no name) - ø#þ - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - S-1-5-18 Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (User 'Default user') O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user') O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=presario&pf=laptop O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {A57B79D8-9501-42B7-BA9B-B961454712F2} (WLANinfo.WLANX) - https://www.jiwire.com/activeX/wlaninfo.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 8862 bytes ----------------- malwarebytes log: Malwarebytes' Anti-Malware 1.25 Database version: 1078 Windows 5.1.2600 Service Pack 3 9:48:14 PM 8/22/2008 mbam-log-08-22-2008 (21-48-14).txt Scan type: Quick Scan Objects scanned: 43768 Time elapsed: 5 minute(s), 15 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) thanks.....

0

Your computer is clean, now for some clean-up. Got to start> run> type in combofix /u (note the space after combofix)> then press enter. This will uninstall combofix. Go to start> control panel> add/remove programs and uninstall these programs: HijackThis Malwarebytes Navigate to and delete this folder: C:/Smitrem Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.symantec.com/techsupp/se... O2 - BHO: (no name) - ($þ - (no file) O2 - BHO: (no name) - ø#þ - (no file) O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe Exit Hijack This Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. You should defrag the computer. How is the computer operating?

0

thank you again. i have done all of this and am halfway through a defrag. the computer is doing great! better than before, so thank you so very much. i did install Spyware Blaster and will check for weekly updates. 2 questions: 1. should i continue using SuperAntiSpyWare or should i uninstall? 2. this problem happened because of a torrent. i understand that torrenting is risky, but do i now have protecttions that make it less so, or do you advise against it altogether? i DO NOT wnat to have this happen again. thanks again.

0

Sorry for the delayed reply, a tropical has the power down. Users choice on SuperAntispyware, its just up to you. All torrents are not bad, this is not a lot of help but may get you hesded in the right direction. I don't use torrents so I can't help much. Glad we could help.

0