I ran it in save mode and in normal mode and it did not report any viruses.

0

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly. Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop. !!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!! Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

0

Logfile of HijackThis v1.99.1 Scan saved at 3:13:12 PM, on 1/5/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Ventrilo\Ventrilo.exe C:\Documents and Settings\Joshua\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R3 - URLSearchHook: (no name) - {6F50A195-5ABC-675A-D444-A9D04B0B676E} - SAPSTR.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [sysconf16] prgsys0984.exe O4 - HKLM\..\Run: [defect08] borlandg.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe" O4 - HKCU\..\Run: [mozilla-text] WinInitDll.exe O4 - HKCU\..\Run: [Preliminary] KeywordFinder.exe O4 - HKCU\..\Run: [prgsys0984] BoundRec.exe O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O15 - Trusted IP range: 206.161.125.149 O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\xsbrhcom.exe O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c... O17 - HKLM\System\CCS\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{667F772D-C005-491A-9862-DF316C22BF52}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{79BCF784-6AD8-4D74-A2A0-CFE7CB688B37}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

0

SmitFraudFix v2.132 Scan done at 15:20:55.50, Fri 01/05/2007 Run from C:\Documents and Settings\Joshua\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Joshua »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Joshua\Application Data C:\Documents and Settings\Joshua\Application Data\Install.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Joshua\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="csgym.exe" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

0

Sorry for the delay. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Update your AVG-AntiSpyware Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode Please post a new fixwareput log, if you need the directions: Please download Fixwareout from this link http://swandog46.geekstogo.com/Fixwareout.exe or http://downloads.subratam.org/Fixwareout.exe Save it to your desktop and run it. Click next, then Install, then make sure "Run fixit" is checked and click finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.Post a copy at the log located at C:\fixwareout\report.txt

0

Also sorry for the delay, I fell asleep. I followed your instructions, the fixwareout program did not prompt be to reboot, after pressing any button to continue a text file popped up. Check for missing files ..... C:\WINDOWS\system32\AUTOEXEC.NT not there ..... End check for missing files ..... please post this at the forum

0

For the missing file, you can follow the below instructions: The bolded parapraph usually works. Open your C:\Windows\Repair folder, and try to copy two files from there, Config.NT and Autoexec.NT Then open C:\Windows\System32 folder, move the Config.NT and Autoexec.NT files from here to recycle Bin and paste the files you copied from the Repair folder !! Restart and now check . You can also try to copy these files form another WinXP system which is working fine.... :) Because the error you are getting is caused by the corruption of either of these two files, and replacing them with good copies can solve the problem :) Also there is an exe file which can restore these files for you: XP_fix OR you can also manually edit these files,,,, follow the instructions here :) Error message when you install or start an MS-DOS or 16-bit Windows-based program http://support.microsoft.com/default.aspx?scid=kb;en-us;324767

0

Thanks for all your help jabuck :). I followed the bold instructions and that did the trick. Fixwareout did its thing and here is the log: Fixwareout Last edited 1/1/2006 Post this report in the forums please ... Prerun check »»»»» HKLM run and Winlogon System values C:\WINDOWS\system32\dmegb.exe will be moved to C:\WINDOWS\temp\dmegb.ren at reboot. C:\WINDOWS\system32\csetz.exe will be moved to C:\WINDOWS\temp\csetz.ren at reboot. »»»»» ... Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E12406BF53D2-BE9B-FD04-800E-D8E196BE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F12D31D019B7-1419-F3D4-20C7-D57AF280{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4F893DE77A86-E229-C334-1DB2-C4C8FECF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}175E7E0427B3-C32A-A934-FCD5-4B1A0B4D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D29CE512A636-724B-03B4-DE51-9EFD5CF7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4963C8C59343-4788-A7B4-D313-46C995D1{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C0DC849A4A44-8A6A-F0C4-0412-136BBEB6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\9 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\10 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\11 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\12 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\13 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\14 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\15 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\16 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B2243B70850A-F218-1E24-3B92-F0180750{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E9F7EC5E0ACD-42E8-C544-9E15-1F92D757{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\19 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\20 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\21 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\22 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\23 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\24 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\25 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\26 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\27 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\28 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\29 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\30 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\31 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\32 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F58B1D644D6B-3B3B-0D04-F6F7-A61FD224{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7B720B6B82BD-8D98-BF54-0F43-8D513BC5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}25A1F1145D66-6F39-B924-BD45-A5472F73{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\bgemd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\yqdm HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion "dpid" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion "pid" ... Random Runs removed from HKLM "dmegb.exe"=- ... PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names... »»»»» Search five digit cs, dm kd and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal Other suspects. C:\WINDOWS\system32\{1D599C64-313D-4B7A-8874-34395C8C3694}.exe Deleted C:\WINDOWS\system32\{37F2745A-54DB-429B-93F6-66D5411F1A52}.exe Deleted »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool. »»»»» Postrun check »»»»» HKLM run »»»»» Winlogon System value "system"="" »»»»»

0

We have run Smitfraudfix option #1 and found an infection,if per chance you have run smitfraudfix option #2 do not run option #2 again. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Once in Safe Mode, open the "SmitfraudFix" folder again and double-click "smitfraudfix.cmd" Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing " Y " and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if "wininet.dll " is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing "Y" and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt Please download ComboFix to the desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the combofix.txt log. Please download VundoFix.exe to your C:\. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer, click OK. Turn your computer back on. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. Post the log located at C:Vundofix.txt and post a new Hijack this log

0

I followed your instructions, but I had to get into safe mode by going to run msconfig, couldn't get the F8 key way to work. And here are the logs you asked for: SmitFraudFix v2.132 Scan done at 9:56:40.53, Sat 01/06/2007 Run from C:\Documents and Settings\Joshua\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "system"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Joshua - 07-01-06 10:05:39.06 Service Pack 1 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Joshua\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-12-06 to 2007-01-06 )))))))))))))))))))))))))))))))))) 2007-01-06 00:16 <DIR> d-------- C:\!KillBox 2007-01-05 15:20 1,674 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-05 11:39 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-01-05 11:39 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2007-01-05 11:39 <DIR> d-------- C:\Program Files\Trojan Remover 2007-01-05 11:39 <DIR> d-------- C:\Documents and Settings\Joshua\Application Data\Simply Super Software 2007-01-05 09:03 <DIR> d-------- C:\fixwareout 2007-01-05 08:40 <DIR> d-------- C:\WINDOWS\pss 2007-01-05 06:36 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-05 06:36 <DIR> d-------- C:\Program Files\Grisoft 2007-01-05 05:48 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-01-05 05:48 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2007-01-05 03:06 34,304 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys 2007-01-05 03:06 14,848 --a------ C:\WINDOWS\system32\drivers\avgntmgr.sys 2007-01-05 03:06 <DIR> d-------- C:\Program Files\AntiVir PersonalEdition Classic 2007-01-05 03:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition Classic 2007-01-04 13:18 28,160 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-01-04 13:18 20,480 --a------ C:\WINDOWS\system32\hidserv.dll 2007-01-04 13:18 13,952 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-01-02 18:10 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\NVIDIA 2007-01-02 06:51 <DIR> dr-h----- C:\Documents and Settings\Joshua\Application Data\SecuROM 2007-01-02 06:49 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-01-02 06:46 <DIR> dr--s---- C:\WINDOWS\assembly 2007-01-02 06:46 <DIR> d-------- C:\WINDOWS\Microsoft.NET 2007-01-02 06:35 <DIR> d-------- C:\Program Files\Sierra 2007-01-02 06:32 <DIR> d-------- C:\Documents and Settings\Joshua\Application Data\InstallShield (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-06 10:04 -------- d-------- C:\Program Files\Mozilla Firefox 2007-01-06 01:52 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-01-05 05:36 -------- d-------- C:\Program Files\Starcraft 2007-01-05 05:33 -------- d--h----- C:\Program Files\InstallShield Installation Information 2007-01-05 05:31 -------- d-------- C:\Program Files\DivX 2007-01-05 04:01 -------- d-------- C:\Program Files\Internet Explorer 2007-01-05 00:52 -------- d-------- C:\Program Files\Warcraft III 2007-01-02 07:03 -------- d---s---- C:\Documents and Settings\Joshua\Application Data\Microsoft 2006-12-23 02:44 -------- d-------- C:\Program Files\World of Warcraft 2006-12-01 19:44 -------- d-------- C:\Program Files\Razer 2006-10-22 13:43 208896 --a------ C:\WINDOWS\system32\NVUNINST.exe 2006-10-22 13:43 208896 --a------ C:\WINDOWS\system32\nvudisp.exe 2006-10-22 12:22 888832 --a------ C:\WINDOWS\system32\nvmobls.dll 2006-10-22 12:22 86016 --a------ C:\WINDOWS\system32\nvmctray.dll 2006-10-22 12:22 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2006-10-22 12:22 794624 --a------ C:\WINDOWS\system32\nvcplui.exe 2006-10-22 12:22 7700480 --a------ C:\WINDOWS\system32\nvcpl.dll 2006-10-22 12:22 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll 2006-10-22 12:22 5644288 --a------ C:\WINDOWS\system32\nvoglnt.dll 2006-10-22 12:22 5619712 --a------ C:\WINDOWS\system32\nvdisps.dll 2006-10-22 12:22 5255168 --a------ C:\WINDOWS\system32\nvdispsr.dll 2006-10-22 12:22 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2006-10-22 12:22 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2006-10-22 12:22 4527488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2006-10-22 12:22 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2006-10-22 12:22 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2006-10-22 12:22 425984 --a------ C:\WINDOWS\system32\keystone.exe 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcodins.dll 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcod.dll 2006-10-22 12:22 3203072 --a------ C:\WINDOWS\system32\nvgamesr.dll 2006-10-22 12:22 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll 2006-10-22 12:22 3047424 --a------ C:\WINDOWS\system32\nvgames.dll 2006-10-22 12:22 2973696 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2006-10-22 12:22 2924544 --a------ C:\WINDOWS\system32\nvvitvs.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2006-10-22 12:22 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2006-10-22 12:22 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2006-10-22 12:22 212992 --a------ C:\WINDOWS\system32\nvapi.dll 2006-10-22 12:22 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2006-10-22 12:22 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll 2006-10-22 12:22 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2006-10-22 12:22 1622016 --a------ C:\WINDOWS\system32\nwiz.exe 2006-10-22 12:22 159810 --a------ C:\WINDOWS\system32\nvsvc32.exe 2006-10-22 12:22 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2006-10-22 12:22 1470464 --a------ C:\WINDOWS\system32\nview.dll 2006-10-22 12:22 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2006-10-22 12:22 1236992 --a------ C:\WINDOWS\system32\nvwss.dll 2006-10-22 12:22 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2006-10-22 12:22 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "mozilla-text"="WinInitDll.exe" "Preliminary"="KeywordFinder.exe" "prgsys0984"="BoundRec.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "SoundMan"="SOUNDMAN.EXE" "sysconf16"="prgsys0984.exe" "defect08"="borlandg.exe" "razer"="C:\\Program Files\\Razer\\razerhid.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "TrojanScanner"="C:\\Program Files\\Trojan Remover\\Trjscan.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 07-01-06 10:05:55.00 C:\ComboFix.txt ... 07-01-06 10:05 VundoFix V6.2.13 Checking Java version... Sun Java not detected Scan started at 10:10:10 AM 1/6/2007 Listing files found while scanning.... No infected files were found. Beginning removal... Logfile of HijackThis v1.99.1 Scan saved at 10:15:34 AM, on 1/6/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.exe C:\WINDOWS\system32\NOTEPAD.exe C:\Documents and Settings\Joshua\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R3 - URLSearchHook: (no name) - {6F50A195-5ABC-675A-D444-A9D04B0B676E} - SAPSTR.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [sysconf16] prgsys0984.exe O4 - HKLM\..\Run: [defect08] borlandg.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [mozilla-text] WinInitDll.exe O4 - HKCU\..\Run: [Preliminary] KeywordFinder.exe O4 - HKCU\..\Run: [prgsys0984] BoundRec.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O15 - Trusted IP range: 206.161.125.149 O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\xsbrhcom.exe O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c... O17 - HKLM\System\CCS\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{667F772D-C005-491A-9862-DF316C22BF52}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{79BCF784-6AD8-4D74-A2A0-CFE7CB688B37}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

0

Also I think I should add, during this process a message popped up with one of the Anti-spyware programs that said it had identified a virus and I moved it to quarantine. I also just did a quick scan and the downloader.agent.uj was not found. I am trying a full system scan now, but I am tentativly hopeful :)

0

My full system scan with AVG checked out :) no more downloader.agent.uj

0

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank R3 - URLSearchHook: (no name) - {6F50A195-5ABC-675A-D444-A9D04B0B676E} - SAPSTR.dll (file missing) O4 - HKLM\..\Run: [sysconf16] prgsys0984.exe O4 - HKLM\..\Run: [defect08] borlandg.exe 4 - HKCU\..\Run: [mozilla-text] WinInitDll.exe O4 - HKCU\..\Run: [Preliminary] KeywordFinder.exe O4 - HKCU\..\Run: [prgsys0984] BoundRec.exe O15 - Trusted IP range: 206.161.125.149 O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\xsbrhcom.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{667F772D-C005-491A-9862-DF316C22BF52}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\..\{79BCF784-6AD8-4D74-A2A0-CFE7CB688B37}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS2\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 O17 - HKLM\System\CS3\Services\Tcpip\..\{39CF471E-4AA4-4AC2-B2C0-AC2ECA786695}: NameServer = 85.255.113.117,85.255.112.90 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.117 85.255.112.90 Exit Hijack This but remain in safe mode. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Post a new hijack This log and a new Combofix log. After restart, if you have any connection problems, do this, don't do this if you can connect to the internet without any problems: Please go to Start -> Control Panel, and choose Network Connections. Then right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically. Click OK twice, and restart your computer. Before you restart the computer. Go to Start > Run and type in cmd Click OK. This will open a commad prompt. Type or copy and paste the following line in the command window: ipconfig /flushdns Hit Enter Exit the command window

0

Ok I followed your instructions and here are the log files: Logfile of HijackThis v1.99.1 Scan saved at 2:18:56 PM, on 1/6/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Joshua\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O15 - Trusted IP range: 206.161.125.149 O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c... O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe Joshua - 07-01-06 14:19:19.18 Service Pack 1 ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Joshua\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-12-06 to 2007-01-06 )))))))))))))))))))))))))))))))))) 2007-01-06 10:10 <DIR> d-------- C:\VundoFix Backups 2007-01-06 10:09 88,064 --a------ C:\VundoFix.exe 2007-01-06 00:16 <DIR> d-------- C:\!KillBox 2007-01-05 15:20 1,674 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-05 11:39 75,264 --a------ C:\WINDOWS\system32\unacev2.dll 2007-01-05 11:39 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll 2007-01-05 11:39 <DIR> d-------- C:\Program Files\Trojan Remover 2007-01-05 11:39 <DIR> d-------- C:\Documents and Settings\Joshua\Application Data\Simply Super Software 2007-01-05 09:03 <DIR> d-------- C:\fixwareout 2007-01-05 08:40 <DIR> d-------- C:\WINDOWS\pss 2007-01-05 06:36 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-05 06:36 <DIR> d-------- C:\Program Files\Grisoft 2007-01-05 05:48 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-01-05 05:48 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP 2007-01-05 03:06 34,304 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys 2007-01-05 03:06 14,848 --a------ C:\WINDOWS\system32\drivers\avgntmgr.sys 2007-01-05 03:06 <DIR> d-------- C:\Program Files\AntiVir PersonalEdition Classic 2007-01-05 03:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\AntiVir PersonalEdition Classic 2007-01-04 13:18 28,160 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-01-04 13:18 20,480 --a------ C:\WINDOWS\system32\hidserv.dll 2007-01-04 13:18 13,952 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-01-02 18:10 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\NVIDIA 2007-01-02 06:51 <DIR> dr-h----- C:\Documents and Settings\Joshua\Application Data\SecuROM 2007-01-02 06:49 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-01-02 06:46 <DIR> dr--s---- C:\WINDOWS\assembly 2007-01-02 06:46 <DIR> d-------- C:\WINDOWS\Microsoft.NET 2007-01-02 06:35 <DIR> d-------- C:\Program Files\Sierra 2007-01-02 06:32 <DIR> d-------- C:\Documents and Settings\Joshua\Application Data\InstallShield (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-06 10:04 -------- d-------- C:\Program Files\Mozilla Firefox 2007-01-06 01:52 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-01-05 05:36 -------- d-------- C:\Program Files\Starcraft 2007-01-05 05:33 -------- d--h----- C:\Program Files\InstallShield Installation Information 2007-01-05 05:31 -------- d-------- C:\Program Files\DivX 2007-01-05 04:01 -------- d-------- C:\Program Files\Internet Explorer 2007-01-05 00:52 -------- d-------- C:\Program Files\Warcraft III 2007-01-02 07:03 -------- d---s---- C:\Documents and Settings\Joshua\Application Data\Microsoft 2006-12-23 02:44 -------- d-------- C:\Program Files\World of Warcraft 2006-12-01 19:44 -------- d-------- C:\Program Files\Razer 2006-10-22 13:43 208896 --a------ C:\WINDOWS\system32\NVUNINST.exe 2006-10-22 13:43 208896 --a------ C:\WINDOWS\system32\nvudisp.exe 2006-10-22 12:22 888832 --a------ C:\WINDOWS\system32\nvmobls.dll 2006-10-22 12:22 86016 --a------ C:\WINDOWS\system32\nvmctray.dll 2006-10-22 12:22 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2006-10-22 12:22 794624 --a------ C:\WINDOWS\system32\nvcplui.exe 2006-10-22 12:22 7700480 --a------ C:\WINDOWS\system32\nvcpl.dll 2006-10-22 12:22 581632 --a------ C:\WINDOWS\system32\nvhwvid.dll 2006-10-22 12:22 5644288 --a------ C:\WINDOWS\system32\nvoglnt.dll 2006-10-22 12:22 5619712 --a------ C:\WINDOWS\system32\nvdisps.dll 2006-10-22 12:22 5255168 --a------ C:\WINDOWS\system32\nvdispsr.dll 2006-10-22 12:22 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2006-10-22 12:22 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2006-10-22 12:22 4527488 --a------ C:\WINDOWS\system32\nv4_disp.dll 2006-10-22 12:22 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2006-10-22 12:22 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2006-10-22 12:22 425984 --a------ C:\WINDOWS\system32\keystone.exe 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcodins.dll 2006-10-22 12:22 35840 --a------ C:\WINDOWS\system32\nvcod.dll 2006-10-22 12:22 3203072 --a------ C:\WINDOWS\system32\nvgamesr.dll 2006-10-22 12:22 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll 2006-10-22 12:22 3047424 --a------ C:\WINDOWS\system32\nvgames.dll 2006-10-22 12:22 2973696 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2006-10-22 12:22 2924544 --a------ C:\WINDOWS\system32\nvvitvs.dll 2006-10-22 12:22 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2006-10-22 12:22 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2006-10-22 12:22 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2006-10-22 12:22 212992 --a------ C:\WINDOWS\system32\nvapi.dll 2006-10-22 12:22 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2006-10-22 12:22 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll 2006-10-22 12:22 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2006-10-22 12:22 1622016 --a------ C:\WINDOWS\system32\nwiz.exe 2006-10-22 12:22 159810 --a------ C:\WINDOWS\system32\nvsvc32.exe 2006-10-22 12:22 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2006-10-22 12:22 1470464 --a------ C:\WINDOWS\system32\nview.dll 2006-10-22 12:22 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2006-10-22 12:22 1236992 --a------ C:\WINDOWS\system32\nvwss.dll 2006-10-22 12:22 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2006-10-22 12:22 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "SoundMan"="SOUNDMAN.EXE" "razer"="C:\\Program Files\\Razer\\razerhid.exe" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "TrojanScanner"="C:\\Program Files\\Trojan Remover\\Trjscan.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 07-01-06 14:19:48.65 C:\ComboFix.txt ... 07-01-06 14:19 C:\ComboFix2.txt ... 07-01-06 10:05

0

Download “Winhelp2002's “ domain cleaner from this link DelDomains.inf To execute this file right click the desktop icon and select Install from the menu. Then post a new hijack this log please.

0

Thanks for all your help jabuck I really appreciate it! Here is the new log: Logfile of HijackThis v1.99.1 Scan saved at 3:00:11 PM, on 1/6/2007 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\SOUNDMAN.exe C:\Program Files\Razer\razerhid.exe C:\WINDOWS\System32\RUNDLL32.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Razer\razerofa.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Joshua\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.exe O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/c... O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

0

Your Hijack This Log is clean. Are you running ok now?

0

Yes everything is running fine. It's wonderful. Thank you so much

0