Go to start> control panel> add/remove programs and uninstall this program if found: Spyprodetector , may be called Spyware Process Detector Your java is out of date and has been exploited. Download the latest version of java from this link Java Click on the JRE 6 Update 7 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline, turn off your Eset nod32 Antivirus 2. Run Combofix and save its log. 3. Restart the computer to get your antivirus running 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

0

ComboFix 08-09-01.03 - Kathy M 2008-09-02 8:15:16.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.272 [GMT -5:00] Running from: C:\Documents and Settings\michelle\My Documents\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Kathy M\Application Data\.# C:\Documents and Settings\Kathy M\Application Data\.#\MBX@830@A141C8.### C:\Documents and Settings\Kathy M\Application Data\.#\MBX@830@A141F8.### C:\Documents and Settings\Kathy M\Application Data\.#\MBX@830@A14228.### C:\Documents and Settings\Kathy M\Application Data\.#\MBX@B78@A141C8.### C:\Documents and Settings\Kathy M\Application Data\.#\MBX@B78@A141F8.### C:\Documents and Settings\Kathy M\Application Data\.#\MBX@B78@A14228.### C:\Documents and Settings\Kathy M\Application Data\FunWebProducts C:\Documents and Settings\Kathy M\Application Data\FunWebProducts\Data\Kathy M\avatar.dat C:\Documents and Settings\Pokerface1204\Application Data\FunWebProducts C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\bin.clearspring.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\bin.clearspring.com\clearspring.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\interclick.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\interclick.com\ud.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\static.youku.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\static.youku.com\v1.0.0237\v\swf\qplayer.swf\youku.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\static.youku.com\v1.0.0268\v\swf\qplayer.swf\qplayer.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\static.youku.com\v1.0.0270\v\swf\qplayer.swf\qplayer.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\#SharedObjects\83NJV2PR\static.youku.com\v1.0.0272\v\swf\qplayer.swf\qplayer.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com C:\Documents and Settings\Pokerface1204\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol C:\smp.bat C:\WINDOWS\system32\afrwcqdr.dll C:\WINDOWS\system32\aglwfjfw.ini C:\WINDOWS\system32\aiyldids.dll C:\WINDOWS\system32\ajohxura.ini C:\WINDOWS\system32\anekpyau.ini C:\WINDOWS\system32\anekpyau.ini2 C:\WINDOWS\system32\apgcjpdo.dll C:\WINDOWS\system32\aqowmq.dll C:\WINDOWS\system32\aszrpx.dll C:\WINDOWS\system32\bagtjkpo.ini C:\WINDOWS\system32\bbitvxep.dll C:\WINDOWS\system32\bjfgdgko.dll C:\WINDOWS\system32\buhkhuhy.dll C:\WINDOWS\system32\cduewgkv.dll C:\WINDOWS\system32\cjvmrjdt.dll C:\WINDOWS\system32\cqfkbxjq.ini C:\WINDOWS\system32\cvnvpcqe.dll C:\WINDOWS\system32\cxldoqej.ini C:\WINDOWS\system32\datywbbs.dll C:\WINDOWS\system32\ddrqcr.dll C:\WINDOWS\system32\dfffeMoq.ini2 C:\WINDOWS\system32\dpdfco.dll C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\drmuvijw.dll C:\WINDOWS\system32\dsngze.dll C:\WINDOWS\system32\emeibemk.ini C:\WINDOWS\system32\entfhbyv.ini C:\WINDOWS\system32\euguqc.dll C:\WINDOWS\system32\fdnprl.dll C:\WINDOWS\system32\ffijtz.dll C:\WINDOWS\system32\fgxrpabn.dll C:\WINDOWS\system32\fqkksz.dll C:\WINDOWS\system32\frdqgnkj.dll C:\WINDOWS\system32\fvkkdjdc.ini C:\WINDOWS\system32\fxjeodcg.dll C:\WINDOWS\system32\ggadpnqd.dll C:\WINDOWS\system32\gwhhqwta.ini C:\WINDOWS\system32\gwpchpsd.dll C:\WINDOWS\system32\hatctkya.ini C:\WINDOWS\system32\hcwyotay.dll C:\WINDOWS\system32\hglbklyj.dll C:\WINDOWS\system32\idnyhy.dll C:\WINDOWS\system32\ijbxld.dll C:\WINDOWS\system32\jaalupfv.ini C:\WINDOWS\system32\jfshhybc.dll C:\WINDOWS\system32\jpsubsvw.dll C:\WINDOWS\system32\jpwajsdm.dll C:\WINDOWS\system32\kersrdrw.dll C:\WINDOWS\system32\kevhllcp.ini C:\WINDOWS\system32\kpdoke.dll C:\WINDOWS\system32\kqdxdhtp.ini C:\WINDOWS\system32\lasjkqwr.dll C:\WINDOWS\system32\lhtnbuxv.dll C:\WINDOWS\system32\logagb.dll C:\WINDOWS\system32\ltgdsgmb.dll C:\WINDOWS\system32\lunjge.dll C:\WINDOWS\system32\lvfehpcf.ini C:\WINDOWS\system32\mtcusurx.dll C:\WINDOWS\system32\myxdkgvb.ini C:\WINDOWS\system32\nmuvrlcy.ini C:\WINDOWS\system32\ogdlrqbw.dll C:\WINDOWS\system32\oiwuze.dll C:\WINDOWS\system32\oujpwahn.ini C:\WINDOWS\system32\pccafv.dll C:\WINDOWS\system32\pklrynhk.ini C:\WINDOWS\system32\plryipru.dll C:\WINDOWS\system32\pvvnuqxd.dll C:\WINDOWS\system32\qfsyxvkv.ini C:\WINDOWS\system32\qkphqmup.ini C:\WINDOWS\system32\qnegpdmf.ini C:\WINDOWS\system32\QXyIRqss.ini C:\WINDOWS\system32\rihvwlxr.dll C:\WINDOWS\system32\riutgj.dll C:\WINDOWS\system32\rjkkesnw.dll C:\WINDOWS\system32\rluznn.dll C:\WINDOWS\system32\ruquzr.dll C:\WINDOWS\system32\slqpfibr.ini C:\WINDOWS\system32\tcwpjurl.dll C:\WINDOWS\system32\tcycbdue.dll C:\WINDOWS\system32\tkqauvfx.ini C:\WINDOWS\system32\uantzu.dll C:\WINDOWS\system32\ugbgstep.dll C:\WINDOWS\system32\uhuqsbpj.ini C:\WINDOWS\system32\uunomecx.dll C:\WINDOWS\system32\uydgquox.dll C:\WINDOWS\system32\uyeflorl.dll C:\WINDOWS\system32\vdqlxpax.dll C:\WINDOWS\system32\vjrwuswh.ini C:\WINDOWS\system32\vrkqbhik.dll C:\WINDOWS\system32\vtyvfksi.ini C:\WINDOWS\system32\vypykpmh.ini C:\WINDOWS\system32\wavkva.dll C:\WINDOWS\system32\wkutfvxv.dll C:\WINDOWS\system32\wtbbpbsw.dll C:\WINDOWS\system32\wuimknua.dll C:\WINDOWS\system32\wxbjyvdd.dll C:\WINDOWS\system32\xevmgxsq.ini C:\WINDOWS\system32\xkvmlm.dll C:\WINDOWS\system32\xkwsfp.dll C:\WINDOWS\system32\xoovts.dll C:\WINDOWS\system32\xsjuofdp.dll C:\WINDOWS\system32\xtpsrajw.ini C:\WINDOWS\system32\xuukimyl.dll C:\WINDOWS\system32\xxyuumyi.ini C:\WINDOWS\system32\ybgjhshs.dll C:\WINDOWS\system32\ybxedsyd.ini C:\WINDOWS\system32\yGgQYGgh.ini2 C:\WINDOWS\system32\ykinwumn.ini C:\WINDOWS\system32\yquinino.dll C:\WINDOWS\system32\ytmtlwnj.dll C:\WINDOWS\temp\perflib_perfdata_1cc.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_FAD -------\Legacy_MYWEBSEARCHSERVICE -------\Service_MyWebSearchService ((((((((((((((((((((((((( Files Created from 2008-08-02 to 2008-09-02 ))))))))))))))))))))))))))))))) . 2008-09-02 08:04 . 2008-09-02 08:04 <DIR> d-------- C:\Program Files\Sun 2008-09-02 08:04 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-02 07:59 . 2008-09-02 08:04 <DIR> d-------- C:\Program Files\Java 2008-09-02 07:59 . 2008-09-02 07:59 <DIR> d-------- C:\Program Files\Common Files\Java 2008-09-02 07:41 . 2008-09-02 07:45 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-09-02 07:24 . 2008-09-02 07:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-09-02 05:51 . 2008-09-02 05:51 <DIR> d-------- C:\Documents and Settings\Kathy M\Application Data\Malwarebytes 2008-09-02 05:50 . 2008-09-02 05:51 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-02 05:50 . 2008-09-02 05:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-02 05:50 . 2008-09-02 00:26 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-02 05:50 . 2008-09-02 00:25 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-02 01:51 . 2008-09-02 01:51 <DIR> dr-h----- C:\Documents and Settings\Kathy M\Application Data\SecuROM 2008-09-01 21:05 . 2008-09-01 21:05 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\GTek 2008-09-01 21:04 . 2005-07-18 00:05 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\Jasc Software Inc 2008-09-01 21:03 . 2005-07-18 00:14 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\Symantec 2008-09-01 21:03 . 2008-09-01 21:03 <DIR> d-------- C:\Documents and Settings\michelle 2008-09-01 20:51 . 2008-09-02 07:31 <DIR> d-------- C:\Program Files\Spyware Process Detector 2008-09-01 20:50 . 2008-09-01 20:50 <DIR> d-------- C:\Program Files\ACW 2008-09-01 20:47 . 2004-08-04 00:56 116,224 --a------ C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-09-01 20:47 . 2001-08-17 22:36 23,040 --a------ C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-09-01 20:45 . 2001-08-17 13:28 771,581 --a------ C:\WINDOWS\system32\dllcache\winacisa.sys 2008-09-01 20:44 . 2001-08-17 13:28 765,884 --a------ C:\WINDOWS\system32\dllcache\usrti.sys 2008-09-01 20:43 . 2001-08-17 13:28 794,654 --a------ C:\WINDOWS\system32\dllcache\usr1801.sys 2008-09-01 20:42 . 2001-08-17 22:36 525,568 --a------ C:\WINDOWS\system32\dllcache\tridxp.dll 2008-09-01 20:41 . 2001-08-17 14:01 241,664 --a------ C:\WINDOWS\system32\dllcache\tosdvd02.sys 2008-09-01 20:40 . 2001-08-17 14:56 172,768 --a------ C:\WINDOWS\system32\dllcache\t2r4disp.dll 2008-09-01 20:39 . 2001-08-17 12:18 285,760 --a------ C:\WINDOWS\system32\dllcache\stlnata.sys 2008-09-01 20:38 . 2004-08-04 05:00 456,704 --a------ C:\WINDOWS\system32\dllcache\smtpsvc.dll 2008-09-01 20:37 . 2004-08-03 22:41 404,990 --a------ C:\WINDOWS\system32\dllcache\slntamr.sys 2008-09-01 20:36 . 2001-08-17 22:36 386,560 --a------ C:\WINDOWS\system32\dllcache\sgiul50.dll 2008-09-01 20:35 . 2001-08-17 22:36 495,616 --a------ C:\WINDOWS\system32\dllcache\sblfx.dll 2008-09-01 20:34 . 2004-08-04 00:56 397,056 --a------ C:\WINDOWS\system32\dllcache\s3gnb.dll 2008-09-01 20:33 . 2001-08-17 13:28 899,146 --a------ C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-09-01 20:32 . 2004-08-04 00:56 363,520 --a------ C:\WINDOWS\system32\dllcache\psisdecd.dll 2008-09-01 20:31 . 2004-08-04 00:56 259,328 --a------ C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-09-01 20:30 . 2001-08-17 14:05 351,616 --a------ C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-09-01 20:29 . 2001-08-17 12:50 198,144 --a------ C:\WINDOWS\system32\dllcache\nv3.sys 2008-09-01 20:28 . 2001-08-17 12:11 128,000 --a------ C:\WINDOWS\system32\dllcache\n100325.sys 2008-09-01 20:27 . 2004-08-04 05:00 1,875,968 --a------ C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-09-01 20:26 . 2001-08-17 12:50 320,384 --a------ C:\WINDOWS\system32\dllcache\mgaum.sys 2008-09-01 20:25 . 2004-08-04 05:00 1,158,818 --a------ C:\WINDOWS\system32\dllcache\korwbrkr.lex 2008-09-01 20:24 . 2001-08-17 22:36 242,176 --a------ C:\WINDOWS\system32\dllcache\kdsusd.dll 2008-09-01 20:23 . 2004-08-04 05:00 471,102 --a------ C:\WINDOWS\system32\dllcache\imskdic.dll 2008-09-01 20:22 . 2004-08-04 05:00 13,463,552 --a------ C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-09-01 20:21 . 2001-08-17 22:36 324,608 --a------ C:\WINDOWS\system32\dllcache\hpojwia.dll 2008-09-01 20:20 . 2001-08-17 14:56 1,733,120 --a------ C:\WINDOWS\system32\dllcache\g400d.dll 2008-09-01 20:19 . 2001-08-17 12:14 444,416 --a------ C:\WINDOWS\system32\dllcache\fpcibase.sys 2008-09-01 20:18 . 2001-08-17 12:17 629,952 --a------ C:\WINDOWS\system32\dllcache\eqn.sys 2008-09-01 20:17 . 2001-08-17 12:14 952,007 --a------ C:\WINDOWS\system32\dllcache\diwan.sys 2008-09-01 20:16 . 2001-08-17 22:36 614,429 --a------ C:\WINDOWS\system32\dllcache\digiview.exe 2008-09-01 20:15 . 2004-08-04 05:00 1,677,824 --a------ C:\WINDOWS\system32\dllcache\chsbrkr.dll 2008-09-01 20:14 . 2001-08-17 13:28 714,698 --a------ C:\WINDOWS\system32\dllcache\cbmdmkxx.sys 2008-09-01 20:13 . 2001-08-17 13:28 871,388 --a------ C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-09-01 20:12 . 2004-08-04 00:56 1,888,992 --a------ C:\WINDOWS\system32\dllcache\ati3duag.dll 2008-09-01 20:11 . 2004-05-13 00:39 876,653 --a------ C:\WINDOWS\system32\dllcache\fp4awel.dll 2008-09-01 20:10 . 2003-03-24 16:52 20,540 --a------ C:\WINDOWS\system32\dllcache\admin.dll 2008-09-01 20:10 . 2003-03-24 16:52 16,439 --a------ C:\WINDOWS\system32\dllcache\admin.exe 2008-09-01 18:45 . 2008-09-01 18:45 <DIR> d-------- C:\ERDNT 2008-09-01 03:19 . 2008-09-01 03:19 <DIR> d-------- C:\Program Files\ESET 2008-09-01 03:19 . 2008-09-01 03:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET 2008-09-01 00:54 . 2008-09-02 00:54 1,194 ---hs---- C:\WINDOWS\system32\uwivftpm.ini 2008-08-31 19:12 . 2008-08-31 19:25 509 --a------ C:\WINDOWS\SysMech6.INI 2008-08-31 06:38 . 2008-08-31 06:38 4,096 --a------ C:\Volume{52C8E4FE-B853-42c1-9528-92978438BBF3} 2008-08-31 06:38 . 2008-08-31 19:38 4,096 --a------ C:\[u]0[/u]1F60800-D0F4738C 2008-08-31 06:36 . 2008-08-31 06:36 <DIR> d-------- C:\Program Files\Common Files\Kaspersky Lab 2008-08-31 06:35 . 2008-08-31 06:35 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-08-31 06:34 . 2005-09-24 03:31 1,778,688 --a------ C:\WINDOWS\system32\Incinerator.dll 2008-08-31 06:34 . 2005-09-23 15:26 88,192 --a------ C:\WINDOWS\system32\drivers\IoloFltr.sys 2008-08-31 06:34 . 2005-09-12 21:18 30,942 --a------ C:\WINDOWS\system32\iolobtdfg.exe 2008-08-31 06:34 . 2005-09-12 21:20 25,264 --a------ C:\WINDOWS\system32\smrgdf.exe 2008-08-31 06:34 . 2004-05-29 06:15 9,728 --a------ C:\WINDOWS\system32\drivers\filedisk.sys 2008-08-31 03:46 . 2008-08-31 03:46 <DIR> d-------- C:\Documents and Settings\Kathy M\Application Data\VSRevoGroup 2008-08-30 23:58 . 2008-08-30 23:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-08-30 20:11 . 2008-08-31 20:56 <DIR> d-------- C:\Program Files\a-squared HiJackFree 2008-08-30 11:55 . 2008-08-30 20:41 <DIR> d-------- C:\Program Files\Lavasoft 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Program Files\CCleaner 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-08-29 11:50 . 2008-08-30 11:49 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-29 10:41 . 2008-08-30 11:50 <DIR> d-------- C:\michelle 2008-08-29 10:13 . 2008-08-29 10:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sunbelt 2008-08-29 09:12 . 2008-09-02 07:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-29 08:18 . 2008-08-30 12:01 1,074 ---hs---- C:\WINDOWS\system32\ahentpwu.ini 2008-08-27 03:50 . 2008-08-30 11:52 <DIR> d-------- C:\Documents and Settings\Pokerface1204\Application Data\SPORE Creature Creator 2008-08-27 03:43 . 2008-09-02 01:40 <DIR> d-------- C:\Program Files\Electronic Arts 2008-08-21 14:24 . 2008-08-30 11:54 <DIR> d-------- C:\Program Files\Microsoft Games 2008-08-20 19:23 . 2008-08-29 06:23 1,306 ---hs---- C:\WINDOWS\system32\stycuokw.ini 2008-08-08 16:57 . 2008-08-31 00:17 0 --a------ C:\WINDOWS\system32\null . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-02 10:46 --------- d--h--w C:\Documents and Settings\Kathy M\Application Data\GTek 2008-09-02 06:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-02 02:04 --------- d-----w C:\Program Files\Web Publish 2008-09-01 02:30 --------- d-----w C:\Program Files\Google 2008-09-01 02:10 --------- d-----w C:\Program Files\Yahoo! 2008-08-31 11:34 --------- d-----w C:\Program Files\iolo 2008-08-31 08:42 --------- d-----w C:\Program Files\Common Files\AOL 2008-08-31 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo 2008-08-31 08:38 --------- d-----w C:\Program Files\IncrediMail 2008-08-30 16:54 --------- d-----w C:\Program Files\Common 2008-08-30 16:53 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\iolo 2008-08-30 16:52 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\ArcSoft 2008-08-30 00:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-26 04:55 --------- d-----w C:\Program Files\Modem Helper 2008-08-24 14:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-21 14:33 --------- d-----w C:\Program Files\NovaLogic 2008-08-18 22:29 23 ----a-w C:\Documents and Settings\Kathy M\jagex_runescape_preferences.dat 2008-08-03 00:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\Yahoo! 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-19 02:58 --------- d-----w C:\Program Files\Your Company Name 2008-07-19 02:58 --------- d-----w C:\Program Files\Virtual Assistant 2008-07-19 02:58 --------- d-----w C:\Program Files\Symantec 2008-07-19 02:58 --------- d-----w C:\Program Files\Nova Development 2008-07-19 02:58 --------- d-----w C:\Program Files\MSXML 4.0 2008-07-19 02:58 --------- d-----w C:\Program Files\Lexmark Toolbar 2008-07-19 02:58 --------- d-----w C:\Program Files\DSC Driver 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\Jasc Software Inc 2008-07-07 19:56 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\Ulead Systems . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "Motive SmartBridge"="C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe" [2006-04-21 438359] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv41"= ir41_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kaspersky Anti-Hacker.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kaspersky Anti-Hacker.lnk backup=C:\WINDOWS\pss\Kaspersky Anti-Hacker.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] -ra------ 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer] --a------ 2005-09-24 03:36 1245696 C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemGuardAlerter] --a------ 2005-09-24 03:39 672256 C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "dvpapi"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "sprtsvc_dellsupportcenter"=2 (0x2) "MyWebSearchService"=2 (0x2) "LexBceS"=2 (0x2) "kavsvc"=2 (0x2) "IOLO_SRV"=2 (0x2) "ioloSystemService"=2 (0x2) "ioloFileInfoList"=2 (0x2) "IDriverT"=3 (0x3) "DSBrokerService"=3 (0x3) "aawservice"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "%PROVIDERID%"="bin\sprtcmd.exe" /P %PROVIDERID% "0c65d2fa"=rundll32.exe "C:\WINDOWS\system32\onfymslf.dll",b "BM0f56e166"=Rundll32.exe "C:\WINDOWS\system32\cduewgkv.dll",s [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiHacker] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\1183611985\\ee\\aolsoftware.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R0 IoloFilter;IoloFilter;C:\WINDOWS\system32\drivers\IoloFltr.sys [2005-09-23 88192] R0 Klpf;Klpf;C:\WINDOWS\system32\drivers\Klpf.sys [2005-08-04 25139] R0 Klpid;Klpid;C:\WINDOWS\system32\drivers\Klpid.sys [2005-08-04 31862] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 34312] S2 spydetector;spydetector;C:\Program Files\Spyware Process Detector\spydetector.sys [ ] S4 ioloFileInfoList;iolo FileInfoList Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [ ] S4 ioloSystemService;iolo System Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [ ] . - - - - ORPHANS REMOVED - - - - HKCU-Run-spyprodetector - C:\Program Files\Spyware Process Detector\spydetector.exe HKLM-Run-%PROVIDERID% - bin\sprtcmd.exe HKU-Default-Run-AOL Fast Start - C:\Program Files\AOL 9.0a\AOL.exe MSConfigStartUp-0c65d2fa - C:\WINDOWS\system32\onfymslf.dll MSConfigStartUp-KAVPersonal50 - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Kathy M\Application Data\Mozilla\Firefox\Profiles\tg94f5rv.default\ . . ------- File Associations (Beta) ------- . JSEFile=NOTEPAD.EXE %1 VBEFile=NOTEPAD.EXE %1 VBSFile=NOTEPAD.EXE %1 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-02 08:26:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\netdde.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\snmp.exe . ************************************************************************** . Completion time: 2008-09-02 8:33:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-02 13:33:52 Pre-Run: 19,144,663,040 bytes free Post-Run: 19,316,527,104 bytes free 387 --- E O F --- 2008-09-02 12:45:26

0

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\uwivftpm.ini C:\WINDOWS\system32\ahentpwu.ini C:\WINDOWS\system32\stycuokw.ini C:\WINDOWS\system32\cduewgkv.dll C:\WINDOWS\system32\onfymslf.dll Driver:: spydetector Folder:: C:\Program Files\Spyware Process Detector Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "MyWebSearchService"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "0c65d2fa"=- "BM0f56e166"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Post a new Combofix log, follow the same instructions as you did in response #7.

0

ComboFix 08-09-01.05 - Kathy M 2008-09-02 18:55:18.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.240 [GMT -5:00] Running from: C:\Documents and Settings\Kathy M\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Kathy M\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . [i] ADS - svchost.exe: deleted 68 bytes in 1 streams. [/i] [i] ADS - ntoskrnl.exe: deleted 36 bytes in 1 streams. [/i] [i] ADS - explorer.exe: deleted 68 bytes in 1 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Spyware Process Detector C:\Program Files\Spyware Process Detector\spydetector.db1 C:\Program Files\Spyware Process Detector\spydetector.db2 C:\WINDOWS\system32\ahentpwu.ini C:\WINDOWS\system32\stycuokw.ini C:\WINDOWS\system32\uwivftpm.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SPYDETECTOR -------\Service_spydetector ((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 ))))))))))))))))))))))))))))))) . 2008-09-02 09:01 . 2008-09-02 09:01 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-02 09:01 . 2008-09-02 09:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-02 08:04 . 2008-09-02 08:04 <DIR> d-------- C:\Program Files\Sun 2008-09-02 08:04 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-09-02 07:59 . 2008-09-02 08:04 <DIR> d-------- C:\Program Files\Java 2008-09-02 07:59 . 2008-09-02 07:59 <DIR> d-------- C:\Program Files\Common Files\Java 2008-09-02 07:41 . 2008-09-02 07:45 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-09-02 07:24 . 2008-09-02 07:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-09-02 05:51 . 2008-09-02 05:51 <DIR> d-------- C:\Documents and Settings\Kathy M\Application Data\Malwarebytes 2008-09-02 05:50 . 2008-09-02 05:51 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-02 05:50 . 2008-09-02 05:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-02 05:50 . 2008-09-02 00:26 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-02 05:50 . 2008-09-02 00:25 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-02 01:51 . 2008-09-02 01:51 <DIR> dr-h----- C:\Documents and Settings\Kathy M\Application Data\SecuROM 2008-09-01 21:05 . 2008-09-01 21:05 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\GTek 2008-09-01 21:04 . 2005-07-18 00:05 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\Jasc Software Inc 2008-09-01 21:03 . 2005-07-18 00:14 <DIR> d-------- C:\Documents and Settings\michelle\Application Data\Symantec 2008-09-01 21:03 . 2008-09-01 21:03 <DIR> d-------- C:\Documents and Settings\michelle 2008-09-01 20:50 . 2008-09-01 20:50 <DIR> d-------- C:\Program Files\ACW 2008-09-01 20:47 . 2004-08-04 00:56 116,224 --a------ C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-09-01 20:47 . 2001-08-17 22:36 23,040 --a------ C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-09-01 20:45 . 2001-08-17 13:28 771,581 --a------ C:\WINDOWS\system32\dllcache\winacisa.sys 2008-09-01 20:44 . 2001-08-17 13:28 765,884 --a------ C:\WINDOWS\system32\dllcache\usrti.sys 2008-09-01 20:43 . 2001-08-17 13:28 794,654 --a------ C:\WINDOWS\system32\dllcache\usr1801.sys 2008-09-01 20:42 . 2001-08-17 22:36 525,568 --a------ C:\WINDOWS\system32\dllcache\tridxp.dll 2008-09-01 20:41 . 2001-08-17 14:01 241,664 --a------ C:\WINDOWS\system32\dllcache\tosdvd02.sys 2008-09-01 20:40 . 2001-08-17 14:56 172,768 --a------ C:\WINDOWS\system32\dllcache\t2r4disp.dll 2008-09-01 20:39 . 2001-08-17 12:18 285,760 --a------ C:\WINDOWS\system32\dllcache\stlnata.sys 2008-09-01 20:38 . 2004-08-04 05:00 456,704 --a------ C:\WINDOWS\system32\dllcache\smtpsvc.dll 2008-09-01 20:37 . 2004-08-03 22:41 404,990 --a------ C:\WINDOWS\system32\dllcache\slntamr.sys 2008-09-01 20:36 . 2001-08-17 22:36 386,560 --a------ C:\WINDOWS\system32\dllcache\sgiul50.dll 2008-09-01 20:35 . 2001-08-17 22:36 495,616 --a------ C:\WINDOWS\system32\dllcache\sblfx.dll 2008-09-01 20:34 . 2004-08-04 00:56 397,056 --a------ C:\WINDOWS\system32\dllcache\s3gnb.dll 2008-09-01 20:33 . 2001-08-17 13:28 899,146 --a------ C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-09-01 20:32 . 2004-08-04 00:56 363,520 --a------ C:\WINDOWS\system32\dllcache\psisdecd.dll 2008-09-01 20:31 . 2004-08-04 00:56 259,328 --a------ C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-09-01 20:30 . 2001-08-17 14:05 351,616 --a------ C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-09-01 20:29 . 2001-08-17 12:50 198,144 --a------ C:\WINDOWS\system32\dllcache\nv3.sys 2008-09-01 20:28 . 2001-08-17 12:11 128,000 --a------ C:\WINDOWS\system32\dllcache\n100325.sys 2008-09-01 20:27 . 2004-08-04 05:00 1,875,968 --a------ C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-09-01 20:26 . 2001-08-17 12:50 320,384 --a------ C:\WINDOWS\system32\dllcache\mgaum.sys 2008-09-01 20:25 . 2004-08-04 05:00 1,158,818 --a------ C:\WINDOWS\system32\dllcache\korwbrkr.lex 2008-09-01 20:24 . 2001-08-17 22:36 242,176 --a------ C:\WINDOWS\system32\dllcache\kdsusd.dll 2008-09-01 20:23 . 2004-08-04 05:00 471,102 --a------ C:\WINDOWS\system32\dllcache\imskdic.dll 2008-09-01 20:22 . 2004-08-04 05:00 13,463,552 --a------ C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-09-01 20:21 . 2001-08-17 22:36 324,608 --a------ C:\WINDOWS\system32\dllcache\hpojwia.dll 2008-09-01 20:20 . 2001-08-17 14:56 1,733,120 --a------ C:\WINDOWS\system32\dllcache\g400d.dll 2008-09-01 20:19 . 2001-08-17 12:14 444,416 --a------ C:\WINDOWS\system32\dllcache\fpcibase.sys 2008-09-01 20:18 . 2001-08-17 12:17 629,952 --a------ C:\WINDOWS\system32\dllcache\eqn.sys 2008-09-01 20:17 . 2001-08-17 12:14 952,007 --a------ C:\WINDOWS\system32\dllcache\diwan.sys 2008-09-01 20:16 . 2001-08-17 22:36 614,429 --a------ C:\WINDOWS\system32\dllcache\digiview.exe 2008-09-01 20:15 . 2004-08-04 05:00 1,677,824 --a------ C:\WINDOWS\system32\dllcache\chsbrkr.dll 2008-09-01 20:14 . 2001-08-17 13:28 714,698 --a------ C:\WINDOWS\system32\dllcache\cbmdmkxx.sys 2008-09-01 20:13 . 2001-08-17 13:28 871,388 --a------ C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-09-01 20:12 . 2004-08-04 00:56 1,888,992 --a------ C:\WINDOWS\system32\dllcache\ati3duag.dll 2008-09-01 20:11 . 2004-05-13 00:39 876,653 --a------ C:\WINDOWS\system32\dllcache\fp4awel.dll 2008-09-01 20:10 . 2003-03-24 16:52 20,540 --a------ C:\WINDOWS\system32\dllcache\admin.dll 2008-09-01 20:10 . 2003-03-24 16:52 16,439 --a------ C:\WINDOWS\system32\dllcache\admin.exe 2008-09-01 18:45 . 2008-09-01 18:45 <DIR> d-------- C:\ERDNT 2008-09-01 03:19 . 2008-09-01 03:19 <DIR> d-------- C:\Program Files\ESET 2008-09-01 03:19 . 2008-09-01 03:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET 2008-08-31 19:12 . 2008-08-31 19:25 509 --a------ C:\WINDOWS\SysMech6.INI 2008-08-31 06:38 . 2008-08-31 06:38 4,096 --a------ C:\Volume{52C8E4FE-B853-42c1-9528-92978438BBF3} 2008-08-31 06:38 . 2008-08-31 19:38 4,096 --a------ C:\[u]0[/u]1F60800-D0F4738C 2008-08-31 06:36 . 2008-09-02 08:56 <DIR> d-------- C:\Program Files\Common Files\Kaspersky Lab 2008-08-31 06:35 . 2008-09-02 08:56 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-08-31 03:46 . 2008-08-31 03:46 <DIR> d-------- C:\Documents and Settings\Kathy M\Application Data\VSRevoGroup 2008-08-30 23:58 . 2008-08-30 23:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf 2008-08-30 20:11 . 2008-08-31 20:56 <DIR> d-------- C:\Program Files\a-squared HiJackFree 2008-08-30 11:55 . 2008-08-30 20:41 <DIR> d-------- C:\Program Files\Lavasoft 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Program Files\CCleaner 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-08-30 11:55 . 2008-08-30 11:55 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-08-29 11:50 . 2008-08-30 11:49 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-29 10:41 . 2008-08-30 11:50 <DIR> d-------- C:\michelle 2008-08-29 10:13 . 2008-08-29 10:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sunbelt 2008-08-29 09:12 . 2008-09-02 07:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-08-27 03:50 . 2008-08-30 11:52 <DIR> d-------- C:\Documents and Settings\Pokerface1204\Application Data\SPORE Creature Creator 2008-08-27 03:43 . 2008-09-02 01:40 <DIR> d-------- C:\Program Files\Electronic Arts 2008-08-21 14:24 . 2008-08-30 11:54 <DIR> d-------- C:\Program Files\Microsoft Games 2008-08-08 16:57 . 2008-08-31 00:17 0 --a------ C:\WINDOWS\system32\null . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-02 13:51 --------- d-----w C:\Program Files\iolo 2008-09-02 10:46 --------- d--h--w C:\Documents and Settings\Kathy M\Application Data\GTek 2008-09-02 06:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-02 02:04 --------- d-----w C:\Program Files\Web Publish 2008-09-01 02:30 --------- d-----w C:\Program Files\Google 2008-09-01 02:10 --------- d-----w C:\Program Files\Yahoo! 2008-08-31 08:42 --------- d-----w C:\Program Files\Common Files\AOL 2008-08-31 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\iolo 2008-08-31 08:38 --------- d-----w C:\Program Files\IncrediMail 2008-08-30 16:54 --------- d-----w C:\Program Files\Common 2008-08-30 16:53 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\iolo 2008-08-30 16:52 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\ArcSoft 2008-08-30 00:31 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-26 04:55 --------- d-----w C:\Program Files\Modem Helper 2008-08-24 14:12 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-21 14:33 --------- d-----w C:\Program Files\NovaLogic 2008-08-18 22:29 23 ----a-w C:\Documents and Settings\Kathy M\jagex_runescape_preferences.dat 2008-08-03 00:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\Yahoo! 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-07-19 02:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-19 02:58 --------- d-----w C:\Program Files\Your Company Name 2008-07-19 02:58 --------- d-----w C:\Program Files\Virtual Assistant 2008-07-19 02:58 --------- d-----w C:\Program Files\Symantec 2008-07-19 02:58 --------- d-----w C:\Program Files\Nova Development 2008-07-19 02:58 --------- d-----w C:\Program Files\MSXML 4.0 2008-07-19 02:58 --------- d-----w C:\Program Files\Lexmark Toolbar 2008-07-19 02:58 --------- d-----w C:\Program Files\DSC Driver 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-07-19 02:58 --------- d-----w C:\Program Files\Common Files\Jasc Software Inc 2008-07-07 19:56 --------- d-----w C:\Documents and Settings\Kathy M\Application Data\Ulead Systems . ((((((((((((((((((((((((((((( snapshot@2008-09-02_ 8.33.12.92 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-02 23:59:39 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4f4.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920] "Motive SmartBridge"="C:\PROGRA~1\VIRTUA~1\SMARTB~1\SprintDSLAlert.exe" [2006-04-21 438359] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-06-10 1447168] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv41"= ir41_32.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kaspersky Anti-Hacker.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kaspersky Anti-Hacker.lnk backup=C:\WINDOWS\pss\Kaspersky Anti-Hacker.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater] -ra------ 2007-03-01 10:37 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "dvpapi"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "sprtsvc_dellsupportcenter"=2 (0x2) "LexBceS"=2 (0x2) "kavsvc"=2 (0x2) "IOLO_SRV"=2 (0x2) "ioloSystemService"=2 (0x2) "ioloFileInfoList"=2 (0x2) "IDriverT"=3 (0x3) "DSBrokerService"=3 (0x3) "aawservice"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "%PROVIDERID%"="bin\sprtcmd.exe" /P %PROVIDERID% [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\1183611985\\ee\\aolsoftware.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"= "C:\\Program Files\\Electronic Arts\\EADM\\Core.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-06-10 34312] S0 IoloFilter;IoloFilter;C:\WINDOWS\system32\drivers\IoloFltr.sys [ ] S4 ioloFileInfoList;iolo FileInfoList Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [ ] S4 ioloSystemService;iolo System Service;C:\Program Files\iolo\common\lib\ioloServiceManager.exe [ ] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-SMSystemAnalyzer - C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe MSConfigStartUp-SystemGuardAlerter - C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-02 19:10:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\netdde.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\system32\snmp.exe . ************************************************************************** . Completion time: 2008-09-02 19:17:33 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-03 00:17:28 ComboFix2.txt 2008-09-02 13:34:01 Pre-Run: 19,841,785,856 bytes free Post-Run: 19,824,259,072 bytes free 230 --- E O F --- 2008-09-02 12:45:26 can this infection get into the other three computers I run off this modem? I wished I understood these programs your using better so I could clean up my 16 year olds computer. Thats the next one I have to clean. Thank you for so much help.

0

I noticed this morning that her antivirus is still catching Virtumonde and quarantine it. I thought I should let you know. Thanks so much for all the support.

0

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply.

0

I have used Kaspersky before but I uninstalled it. I can not get it to run it tells me I need to enable the add on. Im not sure which one to run. then I get : You need to install Java version 1.5 or later to run Kaspersy Online Scanner 7.0

0

Its working now. I figured it out. I will submit the file when its done. Can I use these same instructions you have given me to get vertrumonde off my daughters machine. I posted a little earlier today on hers.

0

No, the procedure is simalar but there will be different files on the other computer and we need a Hijack This log to help with the procedure.

0

I posted her hijack this log on her post. Her post is titled: Have Virtumonde She is losing memory bad. I hope someone will be able to help with that one, so she dont mess up my pc.... I will be back with that Kaspersky log soon. Thank you again for all your help.

0

The moderator will delete that post because the Hijack This log was posted without a request. Once deleted repost, no logs yet please only state the problem on the computer.

0

I reposted with out the log. I forgot. I posted it this time as Virus and Losing RAM. Oops... Keep working with it..it can be fixed...

0

---------------------- KASPERSKY ONLINE SCANNER 7 REPORT Wednesday, September 3, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Wednesday, September 03, 2008 20:17:25 Records in database: 1188827 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Files scanned: 59738 Threat name: 19 Infected objects: 41 Suspicious objects: 0 Duration of the scan: 04:27:57 File name / Threat name / Threats count C:\Documents and Settings\Pokerface1204\My Documents\XPantivirus2008_v77011819.exe Infected: Trojan.Win32.FraudPack.gen 1 C:\Program Files\BadgeHelp\Backspin\Backspin.exe Infected: Backdoor.Win32.MSNMaker.cf 1 C:\QooBox\Quarantine\C\WINDOWS\system32\aiyldids.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coo 1 C:\QooBox\Quarantine\C\WINDOWS\system32\apgcjpdo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.bzp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\aqowmq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cqz 1 C:\QooBox\Quarantine\C\WINDOWS\system32\aszrpx.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.bzp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\bbitvxep.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\bjfgdgko.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ckp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\cvnvpcqe.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dae 1 C:\QooBox\Quarantine\C\WINDOWS\system32\datywbbs.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cqo 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ddrqcr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\dsngze.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coc 1 C:\QooBox\Quarantine\C\WINDOWS\system32\euguqc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dfg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fdnprl.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cle 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ffijtz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.csr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fgxrpabn.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.csr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\fqkksz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dae 1 C:\QooBox\Quarantine\C\WINDOWS\system32\frdqgnkj.dll.vir Infected: Trojan.Win32.Monder.gqa 1 C:\QooBox\Quarantine\C\WINDOWS\system32\idnyhy.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.coo 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ijbxld.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jfshhybc.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cpu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jpsubsvw.dll.vir Infected: Trojan.Win32.Monder.gqa 1 C:\QooBox\Quarantine\C\WINDOWS\system32\jpwajsdm.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.chq 1 C:\QooBox\Quarantine\C\WINDOWS\system32\kpdoke.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dfh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lasjkqwr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dfg 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ltgdsgmb.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cdb 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lunjge.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dae 1 C:\QooBox\Quarantine\C\WINDOWS\system32\pccafv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cpu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\plryipru.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.csr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rihvwlxr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dfh 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rjkkesnw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cle 1 C:\QooBox\Quarantine\C\WINDOWS\system32\rluznn.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.clv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\tcwpjurl.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.clv 1 C:\QooBox\Quarantine\C\WINDOWS\system32\uantzu.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cqo 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wkutfvxv.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cpu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\wtbbpbsw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.dae 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xkvmlm.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cpu 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xkwsfp.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ckp 1 C:\QooBox\Quarantine\C\WINDOWS\system32\xoovts.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.csr 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ybgjhshs.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.cqz 1 C:\QooBox\Quarantine\C\WINDOWS\system32\ytmtlwnj.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.afqp 1 The selected area was scanned. Keep working with it..it can be fixed...

0

She purchased System Mechanic 7 Pro. Should I go ahead and put it in with the KASPERSKY that comes with it and get rid of the ESET NOD32 Antivirus? Or should I wait till we are done? Keep working with it..it can be fixed...

0

This will uninstall/damage this program but you should remove it and reinstall it later if wanted: BadgeHelp (pogo cheat codes) Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\Documents and Settings\Pokerface1204\My Documents\XPantivirus2008_v77011819.exe Folder:: C:\Program Files\BadgeHelp XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Lets us know how the compter is operating?

0

Seems to be running great. I am going to send it back to her at let them test drive it. If I have any more issues I will bring it back over here and we will go from there. But, one question She purchased System Mechanic 7 Pro. It has KASPERSKY that comes with it is it better than the free ESET NOD32 Antivirus? Keep working with it..it can be fixed...

0

I would keep Eset. Go to start> run> type in combofix /u (note the space after combofix) then press enter. Give it a minute. This will uninstall Combofix. Go to start>control panel> add/remove programs and uninstall Hijack This. Keep the other programs. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

The lady Im working on this for told me to tell you thank you so much for taking the time to help me. That she will avoid alot of the sites I told her to. Thanks again so much if she has issues I will be back. Hopefully not though. Thanks, LadyLeo Keep working with it..it can be fixed...

0

Glad we could help.

0