Download "HostXpert" from this link HostXpert to your desktop. Open up the HostsXpert program. Make sure that the "make hosts writable?" button in the upper right corner is enabled. Click back up Host files. Then click Restore orginal host files. Close the program. Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\findfast.exe C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk C:\Documents and Settings\mg\Desktop\Live Safety Center.lnk C:\Documents and Settings\mg\Desktop\Online Security Guide.lnk C:\Documents and Settings\mg\Favorites\Online Security Guide.lnk C:\Documents and Settings\mg\Start Menu\Programs\Startup\findfast.exe C:\Documents and Settings\Owner.YOUR-DB03786206\Favorites\Online Security Guide.lnk C:\WINDOWS\crosof~1.net C:\WINDOWS\crosof~1.net\??crosoft.NET\ C:\WINDOWS\system32\3_exception.nls C:\WINDOWS\system32\drivers\ip6fw.sys C:\WINDOWS\system32\drivers\runtime2.sys C:\WINDOWS\system32\ilnmp.ini C:\WINDOWS\system32\ilnmp.ini2 C:\WINDOWS\system32\koos.exe C:\WINDOWS\system32\lxiqqugc.dllbox C:\WINDOWS\system32\pmnli.dll C:\WINDOWS\system32\vgfddwtv\bg1.gif C:\WINDOWS\system32\vgfddwtv\bgtop.gif C:\WINDOWS\system32\vgfddwtv\bottom1.gif C:\WINDOWS\system32\vgfddwtv\essentials.gif C:\WINDOWS\system32\vgfddwtv\icon1.ico C:\WINDOWS\system32\vgfddwtv\install1.gif C:\WINDOWS\system32\vgfddwtv\left1.gif C:\WINDOWS\system32\vgfddwtv\li.gif C:\WINDOWS\system32\vgfddwtv\logo.gif C:\WINDOWS\system32\vgfddwtv\main.htm C:\WINDOWS\system32\vgfddwtv\mainframe.htm C:\WINDOWS\system32\vgfddwtv\reinstall1.gif C:\WINDOWS\system32\vgfddwtv\right1.gif C:\WINDOWS\system32\vgfddwtv\s1.htm C:\WINDOWS\system32\vgfddwtv\s2.htm C:\WINDOWS\system32\vgfddwtv\s3.htm C:\WINDOWS\system32\vgfddwtv\SMTop1.gif C:\WINDOWS\system32\vgfddwtv\SMTop2.gif C:\WINDOWS\system32\vgfddwtv\SMTop3.gif C:\WINDOWS\system32\vgfddwtv\SMTop4.gif C:\WINDOWS\system32\vgfddwtv\soft1_off.gif C:\WINDOWS\system32\vgfddwtv\soft1_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft1_on.gif C:\WINDOWS\system32\vgfddwtv\soft1_on_ext.gif C:\WINDOWS\system32\vgfddwtv\soft2_off.gif C:\WINDOWS\system32\vgfddwtv\soft2_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft2_on.gif C:\WINDOWS\system32\vgfddwtv\soft2_on_ext.gif C:\WINDOWS\system32\vgfddwtv\soft3_off.gif C:\WINDOWS\system32\vgfddwtv\soft3_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft3_on.gif C:\WINDOWS\system32\vgfddwtv\soft3_on_ext.gif C:\WINDOWS\system32\vgfddwtv\softbottom_off.gif C:\WINDOWS\system32\vgfddwtv\softbottom_on.gif C:\WINDOWS\system32\vgfddwtv\softleft_off.gif C:\WINDOWS\system32\vgfddwtv\softleft_on.gif C:\WINDOWS\system32\vgfddwtv\top1.gif C:\WINDOWS\system32\vgfddwtv\top2.gif C:\WINDOWS\system32\vgfddwtv\turnoff1.gif C:\WINDOWS\system32\vgfddwtv\turnon1.gif C:\WINDOWS\system32\vgfddwtv\vgfddwtv1.exe C:\WINDOWS\system32\vgfddwtv\vgfddwtv2.exe C:\WINDOWS\system32\vgfddwtv\vgfddwtv3.exe C:\WINDOWS\system32\nlybfoad.dll C:\WINDOWS\system32\kqwcuhgo.ini C:\WINDOWS\system32\dojjwhqm.dll C:\WINDOWS\system32\lxiqqugc.dll C:\WINDOWS\system32\hewjfutn.dll C:\WINDOWS\system32\nbiteosn.dll C:\WINDOWS\system32\nsoetibn.ini C:\WINDOWS\system32\printr.exe C:\WINDOWS\system32\mcrh.tmp C:\Program Files\Efstcjkw\xcjywzxc.dll C:\WINDOWS\system32\umocllwp.dll C:\WINDOWS\system32\wyybptiq.dll C:\WINDOWS\system32\qommnmn.dll C:\WINDOWS\system32\pmnli.dll Folder:: C:\WINDOWS\system32\vgfddwtv C:\Program Files\Efstcjkw Driver:: qppfzxnj Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{16975C1E-950B-F58A-B187-08ED8F89A6B0}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6e0035fc-03eb-4af7-8160-7776aed505b7}] [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qppfzxnj] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Hijack This log and a new Combofix log please.

0

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:07:53 PM, on 11/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [34895ec3] rundll32.exe "C:\WINDOWS\system32\wyybptiq.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User '?') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.... O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures04.aim.com/ygp/aol/p... O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/so... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O20 - Winlogon Notify: qommnmn - qommnmn.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 6988 bytes ComboFix 07-11-19.4 - Owner 2007-11-29 13:56:33.2 - NTFSx86 Running from: C:\Documents and Settings\All Users\Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner.YOUR-DB03786206\Desktop\CFScript.txt FILE C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\findfast.exe C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk C:\Documents and Settings\mg\Desktop\Live Safety Center.lnk C:\Documents and Settings\mg\Desktop\Online Security Guide.lnk C:\Documents and Settings\mg\Favorites\Online Security Guide.lnk C:\Documents and Settings\mg\Start Menu\Programs\Startup\findfast.exe C:\Documents and Settings\Owner.YOUR-DB03786206\Favorites\Online Security Guide.lnk C:\Program Files\Efstcjkw\xcjywzxc.dll C:\WINDOWS\crosof~1.net C:\WINDOWS\system32\3_exception.nls C:\WINDOWS\system32\dojjwhqm.dll C:\WINDOWS\system32\drivers\ip6fw.sys C:\WINDOWS\system32\drivers\runtime2.sys C:\WINDOWS\system32\hewjfutn.dll C:\WINDOWS\system32\ilnmp.ini C:\WINDOWS\system32\ilnmp.ini2 C:\WINDOWS\system32\koos.exe C:\WINDOWS\system32\kqwcuhgo.ini C:\WINDOWS\system32\lxiqqugc.dll C:\WINDOWS\system32\lxiqqugc.dllbox C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nbiteosn.dll C:\WINDOWS\system32\nlybfoad.dll C:\WINDOWS\system32\nsoetibn.ini C:\WINDOWS\system32\pmnli.dll C:\WINDOWS\system32\printr.exe C:\WINDOWS\system32\qommnmn.dll C:\WINDOWS\system32\umocllwp.dll C:\WINDOWS\system32\vgfddwtv\bg1.gif C:\WINDOWS\system32\vgfddwtv\bgtop.gif C:\WINDOWS\system32\vgfddwtv\bottom1.gif C:\WINDOWS\system32\vgfddwtv\essentials.gif C:\WINDOWS\system32\vgfddwtv\icon1.ico C:\WINDOWS\system32\vgfddwtv\install1.gif C:\WINDOWS\system32\vgfddwtv\left1.gif C:\WINDOWS\system32\vgfddwtv\li.gif C:\WINDOWS\system32\vgfddwtv\logo.gif C:\WINDOWS\system32\vgfddwtv\main.htm C:\WINDOWS\system32\vgfddwtv\mainframe.htm C:\WINDOWS\system32\vgfddwtv\reinstall1.gif C:\WINDOWS\system32\vgfddwtv\right1.gif C:\WINDOWS\system32\vgfddwtv\s1.htm C:\WINDOWS\system32\vgfddwtv\s2.htm C:\WINDOWS\system32\vgfddwtv\s3.htm C:\WINDOWS\system32\vgfddwtv\SMTop1.gif C:\WINDOWS\system32\vgfddwtv\SMTop2.gif C:\WINDOWS\system32\vgfddwtv\SMTop3.gif C:\WINDOWS\system32\vgfddwtv\SMTop4.gif C:\WINDOWS\system32\vgfddwtv\soft1_off.gif C:\WINDOWS\system32\vgfddwtv\soft1_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft1_on.gif C:\WINDOWS\system32\vgfddwtv\soft1_on_ext.gif C:\WINDOWS\system32\vgfddwtv\soft2_off.gif C:\WINDOWS\system32\vgfddwtv\soft2_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft2_on.gif C:\WINDOWS\system32\vgfddwtv\soft2_on_ext.gif C:\WINDOWS\system32\vgfddwtv\soft3_off.gif C:\WINDOWS\system32\vgfddwtv\soft3_off_ext.gif C:\WINDOWS\system32\vgfddwtv\soft3_on.gif C:\WINDOWS\system32\vgfddwtv\soft3_on_ext.gif C:\WINDOWS\system32\vgfddwtv\softbottom_off.gif C:\WINDOWS\system32\vgfddwtv\softbottom_on.gif C:\WINDOWS\system32\vgfddwtv\softleft_off.gif C:\WINDOWS\system32\vgfddwtv\softleft_on.gif C:\WINDOWS\system32\vgfddwtv\top1.gif C:\WINDOWS\system32\vgfddwtv\top2.gif C:\WINDOWS\system32\vgfddwtv\turnoff1.gif C:\WINDOWS\system32\vgfddwtv\turnon1.gif C:\WINDOWS\system32\vgfddwtv\vgfddwtv1.exe C:\WINDOWS\system32\vgfddwtv\vgfddwtv2.exe C:\WINDOWS\system32\vgfddwtv\vgfddwtv3.exe C:\WINDOWS\system32\wyybptiq.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dojjwhqm.dll C:\WINDOWS\system32\hewjfutn.dll C:\WINDOWS\system32\kqwcuhgo.ini C:\WINDOWS\system32\lxiqqugc.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nbiteosn.dll C:\WINDOWS\system32\nlybfoad.dll C:\WINDOWS\system32\nsoetibn.ini C:\WINDOWS\system32\printr.exe C:\WINDOWS\system32\umocllwp.dll C:\WINDOWS\system32\wyybptiq.dll . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))) . 2007-11-27 22:24 2,230 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-27 21:28 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-27 18:05 594 ---hs---- C:\WINDOWS\system32\qitpbyyw.ini 2007-11-27 17:11 71,232 --a------ C:\WINDOWS\system32\soncstgk.exe 2007-11-26 19:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\.housecall6.6 2007-11-26 18:03 1,521,464 --a------ C:\WINDOWS\WRSetup.dll 2007-11-26 18:03 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-11-26 17:56 164 --a------ C:\install.dat 2007-11-26 17:53 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\GetRightToGo 2007-11-25 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-25 07:28 131,072 --a------ C:\Documents and Settings\All Users\Application Data\irktsvml.dll 2007-11-24 11:19 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Acoustica 2007-11-24 11:18 <DIR> d-------- C:\Program Files\VST 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Mixcraft 3 2007-11-24 11:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Acoustica 2007-11-24 11:18 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-11-24 11:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis 2007-11-24 11:07 80 -r-hs---- C:\WINDOWS\system32\E4DC1C39D9.dll 2007-11-03 16:57 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-11-03 16:57 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-11-03 16:57 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 01:29 32,768 -c--a-w C:\WINDOWS\twunk_32.exe 2007-11-27 01:29 306,688 ----a-w C:\WINDOWS\uninst.exe 2007-11-27 01:29 290,816 ----a-w C:\WINDOWS\winhlp32.exe 2007-11-27 01:28 80,384 ----a-w C:\WINDOWS\ST6UNST.exe 2007-11-27 01:28 76,288 -c--a-w C:\WINDOWS\NOTEPAD.exe 2007-11-27 01:28 74,240 -c--a-w C:\WINDOWS\POWERCFG.exe 2007-11-27 01:28 313,856 -c--a-w C:\WINDOWS\IsUninst.exe 2007-11-27 01:28 22,528 -c--a-w C:\WINDOWS\TASKMAN.exe 2007-11-27 01:28 17,920 ----a-w C:\WINDOWS\hh.exe 2007-11-27 01:28 153,600 ----a-w C:\WINDOWS\regedit.exe 2007-11-21 17:47 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\LimeWire 2007-11-13 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-10-20 12:02 --------- d-----w C:\Program Files\iTunes 2007-10-20 12:01 --------- d-----w C:\Program Files\iPod 2007-10-14 21:19 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Apple Computer 2007-10-07 15:42 --------- d-----w C:\Program Files\Viewpoint 2007-10-07 15:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-10-07 15:40 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Viewpoint 2007-10-01 00:55 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\dvdcss 2007-10-01 00:54 --------- d-----w C:\Program Files\ImTOO 2007-10-01 00:31 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\CyberLink 2007-09-28 00:41 --------- d-----w C:\Program Files\Java 2006-09-07 01:04 254 -c--a-w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((( snapshot@2007-11-28_17.18.19.56 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-28 21:15:32 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-11-29 17:52:06 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-11-29 17:52:06 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-11-29 17:52:06 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-11-28 21:37:38 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-29 17:56:33 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-28 21:37:38 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-29 17:56:33 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-29 19:02:05 16,384 --sha-w C:\WINDOWS\TEMP\Cookies\index.dat + 2007-11-29 19:02:05 16,384 --sha-w C:\WINDOWS\TEMP\History\History.IE5\index.dat + 2007-11-29 19:02:05 32,768 --sha-w C:\WINDOWS\TEMP\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [] "Ealb"="C:\WINDOWS\CROSOF~1.NET\attrib.exe" [] "MalwareAlarm"="C:\Program Files\MalwareAlarm\MalwareAlarm.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 09:47] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 09:47] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [] "Recguard"="%WINDIR%\SMINST\RECGUARD.exe" [] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2007-11-26 20:28] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-26 20:28] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42] "34895ec3"="C:\WINDOWS\system32\wyybptiq.dll" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [] C:\Documents and Settings\mg\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe [2006-10-26 19:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\system32\qommnmn.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qommnmn] qommnmn.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.YOUR-DB03786206^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Owner.YOUR-DB03786206\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-11-26 20:28 163840 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] C:\WINDOWS\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "odserv"=3 (0x3) "ehSched"=2 (0x2) "Ati HotKey Poller"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1562eb99-79c1-11db-ad13-0014a596eb8f}] \Shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-11-24 12:42:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 14:01:22 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 14:03:15 - machine was rebooted C:\ComboFix2.txt ... 2007-11-28 17:18 . --- E O F ---

0

Please go to start> control panel> add/remove programs and uninstall "LimeWire" at least until we get your computer cleaned. Go to this link, VirusTotal copy the following files one at the time into the "upload and scan box", click submit then post the results. C:\Documents and Settings\All Users\Application Data\irktsvml.dll

0

File irktsvml.dll received on 11.29.2007 04:16:26 (CET)Antivirus Version Last Update Result AhnLab-V3 - - - AntiVir - - TR/Vundo.Gen Authentium - - - Avast - - - AVG - - Downloader.Zlob.SAV BitDefender - - Generic.Otuboh.673FF6EF CAT-QuickHeal - - - ClamAV - - - DrWeb - - - eSafe - - - eTrust-Vet - - - Ewido - - - FileAdvisor - - - Fortinet - - - F-Prot - - - F-Secure - - Zlob.gen94 Ikarus - - Generic.Otuboh Kaspersky - - - McAfee - - - Microsoft - - - NOD32v2 - - - Norman - - Zlob.gen94 Panda - - Adware/VirusAlarma Prevx1 - - TROJAN.AGENT.GEN Rising - - - Sophos - - - Sunbelt - - Trojan.Otuboh Symantec - - - TheHacker - - - VBA32 - - - VirusBuster - - - Webwasher-Gateway - - Trojan.Vundo.Gen Additional information MD5: 06a3702550c8e935baa01a845a0bec0a

0

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\dojjwhqm.dll C:\WINDOWS\system32\hewjfutn.dll C:\WINDOWS\system32\kqwcuhgo.ini C:\WINDOWS\system32\lxiqqugc.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nbiteosn.dll C:\WINDOWS\system32\nlybfoad.dll C:\WINDOWS\system32\nsoetibn.ini C:\WINDOWS\system32\printr.exe C:\WINDOWS\system32\umocllwp.dll C:\WINDOWS\system32\wyybptiq.dll C:\WINDOWS\system32\qitpbyyw.ini C:\WINDOWS\system32\soncstgk.exe C:\Documents and Settings\All Users\Application Data\irktsvml.dll C:\WINDOWS\system32\qommnmn.dll Driver:: qommnmn Registry:: [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qommnmn] XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Hijack This log and a new Combofix log please.

0

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:22:44 PM, on 11/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [34895ec3] rundll32.exe "C:\WINDOWS\system32\wyybptiq.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User '?') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.... O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures04.aim.com/ygp/aol/p... O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/so... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 6928 bytes ComboFix 07-11-19.4 - Owner 2007-11-29 22:14:07.3 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.251 [GMT -5:00] Running from: C:\Documents and Settings\All Users\Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner.YOUR-DB03786206\Desktop\CFScript.txt FILE C:\Documents and Settings\All Users\Application Data\irktsvml.dll C:\WINDOWS\system32\dojjwhqm.dll C:\WINDOWS\system32\hewjfutn.dll C:\WINDOWS\system32\kqwcuhgo.ini C:\WINDOWS\system32\lxiqqugc.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nbiteosn.dll C:\WINDOWS\system32\nlybfoad.dll C:\WINDOWS\system32\nsoetibn.ini C:\WINDOWS\system32\printr.exe C:\WINDOWS\system32\qitpbyyw.ini C:\WINDOWS\system32\qommnmn.dll C:\WINDOWS\system32\soncstgk.exe C:\WINDOWS\system32\umocllwp.dll C:\WINDOWS\system32\wyybptiq.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\irktsvml.dll C:\WINDOWS\system32\qitpbyyw.ini C:\WINDOWS\system32\soncstgk.exe D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))) . 2007-11-29 20:32 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-11-27 22:24 2,230 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-27 21:28 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-26 19:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\.housecall6.6 2007-11-26 18:03 1,521,464 --a------ C:\WINDOWS\WRSetup.dll 2007-11-26 18:03 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-11-26 17:56 164 --a------ C:\install.dat 2007-11-26 17:53 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\GetRightToGo 2007-11-25 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-24 11:19 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Acoustica 2007-11-24 11:18 <DIR> d-------- C:\Program Files\VST 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Mixcraft 3 2007-11-24 11:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Acoustica 2007-11-24 11:18 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-11-24 11:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis 2007-11-24 11:07 80 -r-hs---- C:\WINDOWS\system32\E4DC1C39D9.dll 2007-11-03 16:57 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-11-03 16:57 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-11-03 16:57 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-10-20 07:01 <DIR> d-------- C:\Program Files\iPod 2007-10-07 10:40 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Viewpoint . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-30 01:06 --------- d-----w C:\Program Files\LimeWire 2007-11-27 01:29 32,768 -c--a-w C:\WINDOWS\twunk_32.exe 2007-11-27 01:29 306,688 ----a-w C:\WINDOWS\uninst.exe 2007-11-27 01:29 290,816 ----a-w C:\WINDOWS\winhlp32.exe 2007-11-27 01:28 80,384 ----a-w C:\WINDOWS\ST6UNST.exe 2007-11-27 01:28 76,288 -c--a-w C:\WINDOWS\NOTEPAD.exe 2007-11-27 01:28 74,240 -c--a-w C:\WINDOWS\POWERCFG.exe 2007-11-27 01:28 313,856 -c--a-w C:\WINDOWS\IsUninst.exe 2007-11-27 01:28 22,528 -c--a-w C:\WINDOWS\TASKMAN.exe 2007-11-27 01:28 17,920 ----a-w C:\WINDOWS\hh.exe 2007-11-27 01:28 153,600 ----a-w C:\WINDOWS\regedit.exe 2007-11-21 17:47 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\LimeWire 2007-11-13 23:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-10-20 12:02 --------- d-----w C:\Program Files\iTunes 2007-10-14 21:19 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Apple Computer 2007-10-07 15:42 --------- d-----w C:\Program Files\Viewpoint 2007-10-07 15:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-10-01 00:55 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\dvdcss 2007-10-01 00:54 --------- d-----w C:\Program Files\ImTOO 2007-10-01 00:31 --------- d-----w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\CyberLink 2007-09-28 00:41 --------- d-----w C:\Program Files\Java 2007-08-06 22:57 258,048 ------w C:\WINDOWS\Setup1.exe 2006-09-07 01:04 254 -c--a-w C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\wklnhst.dat . ((((((((((((((((((((((((((((( snapshot@2007-11-28_17.18.19.56 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-08 21:59:01 136,704 ----a-w C:\WINDOWS\catchme.exe + 2007-11-08 21:59:01 146,944 ----a-w C:\WINDOWS\catchme.exe - 2007-11-27 01:28:45 102,912 ----a-w C:\WINDOWS\ehome\ehSched.exe + 2007-11-27 01:28:45 110,080 ----a-w C:\WINDOWS\ehome\ehSched.exe - 2007-06-17 05:11:58 51,200 ----a-w C:\WINDOWS\NirCmd.exe + 2007-06-17 05:11:58 58,368 ----a-w C:\WINDOWS\NirCmd.exe - 2007-11-28 21:15:32 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-11-30 03:02:43 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-11-30 03:02:43 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-11-30 03:02:43 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-11-28 21:37:38 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-30 03:07:14 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-28 21:37:38 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-30 03:07:14 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-07-22 23:39:27 289,792 ----a-w C:\WINDOWS\system32\swreg.exe - 2007-11-27 01:29:45 126,464 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe + 2007-11-27 01:29:45 133,632 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [] "Ealb"="C:\WINDOWS\CROSOF~1.NET\attrib.exe" [] "MalwareAlarm"="C:\Program Files\MalwareAlarm\MalwareAlarm.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 09:47] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 09:47] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [] "Recguard"="%WINDIR%\SMINST\RECGUARD.exe" [] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2007-11-26 20:28] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-26 20:28] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42] "34895ec3"="C:\WINDOWS\system32\wyybptiq.dll" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [] C:\Documents and Settings\mg\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe [2006-10-26 19:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\system32\qommnmn.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.YOUR-DB03786206^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Owner.YOUR-DB03786206\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-11-26 20:28 163840 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] C:\WINDOWS\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "odserv"=3 (0x3) "ehSched"=2 (0x2) "Ati HotKey Poller"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1562eb99-79c1-11db-ad13-0014a596eb8f}] \Shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-11-24 12:42:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 22:18:53 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 22:21:33 - machine was rebooted C:\ComboFix2.txt ... 2007-11-29 14:03 C:\ComboFix3.txt ... 2007-11-28 17:18 . --- E O F ---

0

Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O4 - HKLM\..\Run: [34895ec3] rundll32.exe "C:\WINDOWS\system32\wyybptiq.dll",b Exit Hijack This. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Navigate to and delete this file if found: c:\windows\system32\BAE.dll Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Registry:: [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Post a new Hijack This log and a new Combofix log please.

0

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:14:08 PM, on 11/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.... O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures04.aim.com/ygp/aol/p... O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/so... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 5939 bytes ComboFix 07-11-19.4 - Owner 2007-11-30 16:15:17.5 - NTFSx86 MINIMAL Running from: C:\Documents and Settings\All Users\Documents\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))) . 2007-11-29 20:32 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-11-27 22:24 2,230 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-27 21:28 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-26 19:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\.housecall6.6 2007-11-26 18:03 1,521,464 --a------ C:\WINDOWS\WRSetup.dll 2007-11-26 18:03 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-11-26 17:56 164 --a------ C:\install.dat 2007-11-26 17:53 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\GetRightToGo 2007-11-25 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-24 11:19 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Acoustica 2007-11-24 11:18 <DIR> d-------- C:\Program Files\VST 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Mixcraft 3 2007-11-24 11:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Acoustica 2007-11-24 11:18 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-11-24 11:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis 2007-11-24 11:07 80 -r-hs---- C:\WINDOWS\system32\E4DC1C39D9.dll 2007-11-03 16:57 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-11-03 16:57 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-11-03 16:57 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2007-10-20 07:01 <DIR> d-------- C:\Program Files\iPod 2007-10-07 10:40 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Viewpoint . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-30 01:06 --------- d-----w C:\Program Files\LimeWire 2007-11-27 01:29 96,768 ----a-w C:\WINDOWS\system32\smlogsvc.exe 2007-11-27 01:29 93,184 -c--a-w C:\WINDOWS\system32\netsh.exe 2007-11-27 01:29 92,672 -c--a-w C:\WINDOWS\system32\makecab.exe 2007-11-27 01:29 90,624 -c--a-w C:\WINDOWS\system32\dpvsetup.exe 2007-11-27 01:29 9,216 -c--a-w C:\WINDOWS\system32\scrnsave.scr 2007-11-27 01:29 86,016 -c--a-w C:\WINDOWS\system32\usrmlnka.exe 2007-11-27 01:29 86,016 ----a-w C:\WINDOWS\system32\msiexec.exe 2007-11-27 01:29 85,504 -c--a-w C:\WINDOWS\system32\tlntsess.exe 2007-11-27 01:29 84,992 -c--a-w C:\WINDOWS\system32\shrpubw.exe 2007-11-27 01:29 84,992 -c--a-w C:\WINDOWS\system32\eventtriggers.exe 2007-11-27 01:29 84,480 -c--a-w C:\WINDOWS\system32\sdbinst.exe 2007-11-27 01:29 84,480 -c--a-w C:\WINDOWS\system32\rtcshare.exe 2007-11-27 01:29 83,968 -c--a-w C:\WINDOWS\system32\nslookup.exe 2007-11-27 01:29 822,272 -c--a-w C:\WINDOWS\system32\mmc.exe 2007-11-27 01:29 82,944 -c--a-w C:\WINDOWS\system32\telnet.exe 2007-11-27 01:29 82,432 ----a-w C:\WINDOWS\system32\locator.exe 2007-11-27 01:29 80,384 ----a-w C:\WINDOWS\system32\tlntsvr.exe 2007-11-27 01:29 79,872 -c--a-w C:\WINDOWS\system32\magnify.exe 2007-11-27 01:29 79,360 -c--a-w C:\WINDOWS\system32\tasklist.exe 2007-11-27 01:29 79,360 -c--a-w C:\WINDOWS\system32\taskkill.exe 2007-11-27 01:29 77,824 -c--a-w C:\WINDOWS\system32\usrshuta.exe 2007-11-27 01:29 77,824 -c--a-w C:\WINDOWS\system32\odbcconf.exe 2007-11-27 01:29 77,312 -c--a-w C:\WINDOWS\system32\sigverif.exe 2007-11-27 01:29 76,288 ----a-w C:\WINDOWS\system32\notepad.exe 2007-11-27 01:29 75,264 -c--a-w C:\WINDOWS\system32\systeminfo.exe 2007-11-27 01:29 74,752 -c--a-w C:\WINDOWS\system32\openfiles.exe 2007-11-27 01:29 74,240 ----a-w C:\WINDOWS\system32\rdshost.exe 2007-11-27 01:29 72,704 -c--a-w C:\WINDOWS\system32\wextract.exe 2007-11-27 01:29 704,512 -c--a-w C:\WINDOWS\system32\ss3dfo.scr 2007-11-27 01:29 70,144 -c--a-w C:\WINDOWS\system32\rsopprov.exe 2007-11-27 01:29 69,632 -c--a-w C:\WINDOWS\system32\usrprbda.exe 2007-11-27 01:29 69,632 -c--a-w C:\WINDOWS\system32\rdpclip.exe 2007-11-27 01:29 68,608 -c--a-w C:\WINDOWS\system32\tlntadmn.exe 2007-11-27 01:29 679,936 -c--a-w C:\WINDOWS\system32\sstext3d.scr 2007-11-27 01:29 66,560 -c--a-w C:\WINDOWS\system32\logman.exe 2007-11-27 01:29 65,536 -c--a-w C:\WINDOWS\system32\driverquery.exe 2007-11-27 01:29 64,512 -c--a-w C:\WINDOWS\system32\gpupdate.exe 2007-11-27 01:29 64,000 -c--a-w C:\WINDOWS\system32\sol.exe 2007-11-27 01:29 64,000 -c--a-w C:\WINDOWS\system32\rasphone.exe 2007-11-27 01:29 63,488 -c--a-w C:\WINDOWS\system32\fsutil.exe 2007-11-27 01:29 62,976 -c--a-w C:\WINDOWS\system32\ipconfig.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\getmac.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\freecell.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\dvdplay.exe 2007-11-27 01:29 610,304 -c--a-w C:\WINDOWS\system32\sspipes.scr 2007-11-27 01:29 60,928 -c--a-w C:\WINDOWS\system32\narrator.exe 2007-11-27 01:29 60,416 -c--a-w C:\WINDOWS\system32\ipv6.exe 2007-11-27 01:29 58,880 -c--a-w C:\WINDOWS\system32\migpwd.exe 2007-11-27 01:29 58,368 -c--a-w C:\WINDOWS\system32\syncapp.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\utilman.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\reg.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\proquota.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\eventcreate.exe 2007-11-27 01:29 56,832 -c--a-w C:\WINDOWS\system32\w32tm.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\rsmui.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\rsm.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\powercfg.exe 2007-11-27 01:29 545,792 -c--a-w C:\WINDOWS\system32\spider.exe 2007-11-27 01:29 54,272 -c--a-w C:\WINDOWS\system32\uwdf.exe 2007-11-27 01:29 521,728 ----a-w C:\WINDOWS\system32\logonui.exe 2007-11-27 01:29 52,736 -c--a-w C:\WINDOWS\system32\extrac32.exe 2007-11-27 01:29 52,736 ----a-w C:\WINDOWS\system32\mshta.exe 2007-11-27 01:29 52,736 ----a-w C:\WINDOWS\system32\drwtsn32.exe 2007-11-27 01:29 51,712 -c--a-w C:\WINDOWS\system32\tscupgrd.exe 2007-11-27 01:29 51,200 -c--a-w C:\WINDOWS\system32\ipsec6.exe 2007-11-27 01:29 49,664 -c--a-w C:\WINDOWS\system32\net.exe 2007-11-27 01:29 49,664 -c--a-w C:\WINDOWS\system32\ftp.exe 2007-11-27 01:29 49,664 ----a-w C:\WINDOWS\system32\shmgrate.exe 2007-11-27 01:29 47,616 -c--a-w C:\WINDOWS\system32\osuninst.exe 2007-11-27 01:29 47,104 -c--a-w C:\WINDOWS\system32\ssmypics.scr 2007-11-27 01:29 46,592 -c--a-w C:\WINDOWS\system32\grpconv.exe 2007-11-27 01:29 46,592 -c--a-w C:\WINDOWS\system32\esentutl.exe 2007-11-27 01:29 46,080 ----a-w C:\WINDOWS\system32\wdfmgr.exe 2007-11-27 01:29 440,832 -c--a-w C:\WINDOWS\system32\wiaacmgr.exe 2007-11-27 01:29 44,032 -c--a-w C:\WINDOWS\system32\syskey.exe 2007-11-27 01:29 44,032 -c--a-w C:\WINDOWS\system32\netstat.exe 2007-11-27 01:29 43,520 -c--a-w C:\WINDOWS\system32\typeperf.exe 2007-11-27 01:29 43,008 -c--a-w C:\WINDOWS\system32\rcimlby.exe 2007-11-27 01:29 427,008 ----a-w C:\WINDOWS\system32\ntvdm.exe 2007-11-27 01:29 414,720 -c--a-w C:\WINDOWS\system32\mstsc.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\vssadmin.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\regini.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\odbcad32.exe 2007-11-27 01:29 40,960 ----a-w C:\WINDOWS\system32\mnmsrvc.exe 2007-11-27 01:29 40,448 -c--a-w C:\WINDOWS\system32\ping6.exe 2007-11-27 01:29 40,448 ----a-w C:\WINDOWS\system32\rundll32.exe 2007-11-27 01:29 4,403,712 -c--a-w C:\WINDOWS\system32\wpgldfsh.scr 2007-11-27 01:29 393,216 -c--a-w C:\WINDOWS\system32\ssflwbox.scr 2007-11-27 01:29 39,936 -c--a-w C:\WINDOWS\system32\relog.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wupdmgr.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wpnpinst.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wpabaln.exe 2007-11-27 01:29 38,912 -c--a-w C:\WINDOWS\system32\tracert6.exe 2007-11-27 01:29 38,912 -c--a-w C:\WINDOWS\system32\ntsd.exe 2007-11-27 01:29 38,400 -c--a-w C:\WINDOWS\system32\sethc.exe 2007-11-27 01:29 38,400 -c--a-w C:\WINDOWS\system32\sc.exe 2007-11-27 01:29 37,888 -c--a-w C:\WINDOWS\system32\xcopy.exe 2007-11-27 01:29 37,376 -c--a-w C:\WINDOWS\system32\dplaysvr.exe 2007-11-27 01:29 36,864 -c--a-w C:\WINDOWS\system32\lights.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-28_17.18.19.56 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-08 21:59:01 136,704 ----a-w C:\WINDOWS\catchme.exe + 2007-11-08 21:59:01 146,944 ----a-w C:\WINDOWS\catchme.exe - 2007-11-27 01:28:45 102,912 ----a-w C:\WINDOWS\ehome\ehSched.exe + 2007-11-27 01:28:45 110,080 ----a-w C:\WINDOWS\ehome\ehSched.exe - 2007-06-17 05:11:58 51,200 ----a-w C:\WINDOWS\NirCmd.exe + 2007-06-17 05:11:58 58,368 ----a-w C:\WINDOWS\NirCmd.exe - 2007-11-28 21:15:32 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-11-30 21:09:20 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-11-30 21:09:20 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-11-30 21:09:20 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-11-28 21:37:38 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-11-30 21:00:24 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-28 21:37:38 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-11-30 21:00:24 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-07-22 23:39:27 289,792 ----a-w C:\WINDOWS\system32\swreg.exe - 2007-11-27 01:29:45 126,464 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe + 2007-11-27 01:29:45 133,632 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [] "Ealb"="C:\WINDOWS\CROSOF~1.NET\attrib.exe" [] "MalwareAlarm"="C:\Program Files\MalwareAlarm\MalwareAlarm.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 09:47] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 09:47] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [] "Recguard"="%WINDIR%\SMINST\RECGUARD.exe" [] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2007-11-26 20:28] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-26 20:28] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [] C:\Documents and Settings\mg\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe [2006-10-26 19:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\system32\qommnmn.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.YOUR-DB03786206^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Owner.YOUR-DB03786206\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-11-26 20:28 163840 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] C:\WINDOWS\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "odserv"=3 (0x3) "ehSched"=2 (0x2) "Ati HotKey Poller"=2 (0x2) S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;C:\WINDOWS\system32\DRIVERS\el575nd5.sys S3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1562eb99-79c1-11db-ad13-0014a596eb8f}] \Shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-11-24 12:42:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 16:19:12 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-30 16:21:18 C:\ComboFix2.txt ... 2007-11-30 15:59 C:\ComboFix3.txt ... 2007-11-29 22:21 . --- E O F ---

0

You need an antivirus program and an antispyware program. You can get AVG free antivirus Here You should add "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version. Go to star> controlpanel> add/remove this program as it is a rogue program: MalwareAlarm Go to start> control panel> administrative tools> services> scroll down to Print Spooler (Spooler) and right click on it> click stop. Then double click it> click the blue drop down arrow on the far right of startup type> click disable>apply>ok. Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Driver:: qommnmn Registry:: [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": O23 - Service: Print Spooler (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) Post a new Combofix log and a new Hijack This log please.

0

ComboFix 07-11-19.4 - Owner 2007-12-01 10:00:53.6 - NTFSx86 Running from: C:\Documents and Settings\All Users\Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\Owner.YOUR-DB03786206\Desktop\CFScript.txt . ((((((((((((((((((((((((( Files Created from 2007-11-01 to 2007-12-01 ))))))))))))))))))))))))))))))) . 2007-12-01 09:47 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-11-29 20:32 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-11-27 22:24 2,230 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-27 21:28 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-26 19:33 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\.housecall6.6 2007-11-26 18:03 1,521,464 --a------ C:\WINDOWS\WRSetup.dll 2007-11-26 18:03 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2007-11-26 17:56 164 --a------ C:\install.dat 2007-11-26 17:53 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\GetRightToGo 2007-11-25 08:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-24 11:19 <DIR> d-------- C:\Documents and Settings\Owner.YOUR-DB03786206\Application Data\Acoustica 2007-11-24 11:18 <DIR> d-------- C:\Program Files\VST 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-11-24 11:18 <DIR> d-------- C:\Program Files\Acoustica Mixcraft 3 2007-11-24 11:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Acoustica 2007-11-24 11:18 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-11-24 11:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis 2007-11-24 11:07 80 -r-hs---- C:\WINDOWS\system32\E4DC1C39D9.dll 2007-11-03 16:57 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-11-03 16:57 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-11-03 16:57 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-30 01:06 --------- d-----w C:\Program Files\LimeWire 2007-11-27 01:29 96,768 ----a-w C:\WINDOWS\system32\smlogsvc.exe 2007-11-27 01:29 93,184 -c--a-w C:\WINDOWS\system32\netsh.exe 2007-11-27 01:29 92,672 -c--a-w C:\WINDOWS\system32\makecab.exe 2007-11-27 01:29 90,624 -c--a-w C:\WINDOWS\system32\dpvsetup.exe 2007-11-27 01:29 9,216 -c--a-w C:\WINDOWS\system32\scrnsave.scr 2007-11-27 01:29 86,016 -c--a-w C:\WINDOWS\system32\usrmlnka.exe 2007-11-27 01:29 86,016 ----a-w C:\WINDOWS\system32\msiexec.exe 2007-11-27 01:29 85,504 -c--a-w C:\WINDOWS\system32\tlntsess.exe 2007-11-27 01:29 84,992 -c--a-w C:\WINDOWS\system32\shrpubw.exe 2007-11-27 01:29 84,992 -c--a-w C:\WINDOWS\system32\eventtriggers.exe 2007-11-27 01:29 84,480 -c--a-w C:\WINDOWS\system32\sdbinst.exe 2007-11-27 01:29 84,480 -c--a-w C:\WINDOWS\system32\rtcshare.exe 2007-11-27 01:29 83,968 -c--a-w C:\WINDOWS\system32\nslookup.exe 2007-11-27 01:29 822,272 -c--a-w C:\WINDOWS\system32\mmc.exe 2007-11-27 01:29 82,944 -c--a-w C:\WINDOWS\system32\telnet.exe 2007-11-27 01:29 82,432 ----a-w C:\WINDOWS\system32\locator.exe 2007-11-27 01:29 80,384 ----a-w C:\WINDOWS\system32\tlntsvr.exe 2007-11-27 01:29 79,872 -c--a-w C:\WINDOWS\system32\magnify.exe 2007-11-27 01:29 79,360 -c--a-w C:\WINDOWS\system32\tasklist.exe 2007-11-27 01:29 79,360 -c--a-w C:\WINDOWS\system32\taskkill.exe 2007-11-27 01:29 77,824 -c--a-w C:\WINDOWS\system32\usrshuta.exe 2007-11-27 01:29 77,824 -c--a-w C:\WINDOWS\system32\odbcconf.exe 2007-11-27 01:29 77,312 -c--a-w C:\WINDOWS\system32\sigverif.exe 2007-11-27 01:29 76,288 ----a-w C:\WINDOWS\system32\notepad.exe 2007-11-27 01:29 75,264 -c--a-w C:\WINDOWS\system32\systeminfo.exe 2007-11-27 01:29 74,752 -c--a-w C:\WINDOWS\system32\openfiles.exe 2007-11-27 01:29 74,240 ----a-w C:\WINDOWS\system32\rdshost.exe 2007-11-27 01:29 72,704 -c--a-w C:\WINDOWS\system32\wextract.exe 2007-11-27 01:29 704,512 -c--a-w C:\WINDOWS\system32\ss3dfo.scr 2007-11-27 01:29 70,144 -c--a-w C:\WINDOWS\system32\rsopprov.exe 2007-11-27 01:29 69,632 -c--a-w C:\WINDOWS\system32\usrprbda.exe 2007-11-27 01:29 69,632 -c--a-w C:\WINDOWS\system32\rdpclip.exe 2007-11-27 01:29 68,608 -c--a-w C:\WINDOWS\system32\tlntadmn.exe 2007-11-27 01:29 679,936 -c--a-w C:\WINDOWS\system32\sstext3d.scr 2007-11-27 01:29 66,560 -c--a-w C:\WINDOWS\system32\logman.exe 2007-11-27 01:29 65,536 -c--a-w C:\WINDOWS\system32\driverquery.exe 2007-11-27 01:29 64,512 -c--a-w C:\WINDOWS\system32\gpupdate.exe 2007-11-27 01:29 64,000 -c--a-w C:\WINDOWS\system32\sol.exe 2007-11-27 01:29 64,000 -c--a-w C:\WINDOWS\system32\rasphone.exe 2007-11-27 01:29 63,488 -c--a-w C:\WINDOWS\system32\fsutil.exe 2007-11-27 01:29 62,976 -c--a-w C:\WINDOWS\system32\ipconfig.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\getmac.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\freecell.exe 2007-11-27 01:29 62,464 -c--a-w C:\WINDOWS\system32\dvdplay.exe 2007-11-27 01:29 610,304 -c--a-w C:\WINDOWS\system32\sspipes.scr 2007-11-27 01:29 60,928 -c--a-w C:\WINDOWS\system32\narrator.exe 2007-11-27 01:29 60,416 -c--a-w C:\WINDOWS\system32\ipv6.exe 2007-11-27 01:29 58,880 -c--a-w C:\WINDOWS\system32\migpwd.exe 2007-11-27 01:29 58,368 -c--a-w C:\WINDOWS\system32\syncapp.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\utilman.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\reg.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\proquota.exe 2007-11-27 01:29 57,344 -c--a-w C:\WINDOWS\system32\eventcreate.exe 2007-11-27 01:29 56,832 -c--a-w C:\WINDOWS\system32\w32tm.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\rsmui.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\rsm.exe 2007-11-27 01:29 56,320 -c--a-w C:\WINDOWS\system32\powercfg.exe 2007-11-27 01:29 545,792 -c--a-w C:\WINDOWS\system32\spider.exe 2007-11-27 01:29 54,272 -c--a-w C:\WINDOWS\system32\uwdf.exe 2007-11-27 01:29 521,728 ----a-w C:\WINDOWS\system32\logonui.exe 2007-11-27 01:29 52,736 -c--a-w C:\WINDOWS\system32\extrac32.exe 2007-11-27 01:29 52,736 ----a-w C:\WINDOWS\system32\mshta.exe 2007-11-27 01:29 52,736 ----a-w C:\WINDOWS\system32\drwtsn32.exe 2007-11-27 01:29 51,712 -c--a-w C:\WINDOWS\system32\tscupgrd.exe 2007-11-27 01:29 51,200 -c--a-w C:\WINDOWS\system32\ipsec6.exe 2007-11-27 01:29 49,664 -c--a-w C:\WINDOWS\system32\net.exe 2007-11-27 01:29 49,664 -c--a-w C:\WINDOWS\system32\ftp.exe 2007-11-27 01:29 49,664 ----a-w C:\WINDOWS\system32\shmgrate.exe 2007-11-27 01:29 47,616 -c--a-w C:\WINDOWS\system32\osuninst.exe 2007-11-27 01:29 47,104 -c--a-w C:\WINDOWS\system32\ssmypics.scr 2007-11-27 01:29 46,592 -c--a-w C:\WINDOWS\system32\grpconv.exe 2007-11-27 01:29 46,592 -c--a-w C:\WINDOWS\system32\esentutl.exe 2007-11-27 01:29 46,080 ----a-w C:\WINDOWS\system32\wdfmgr.exe 2007-11-27 01:29 440,832 -c--a-w C:\WINDOWS\system32\wiaacmgr.exe 2007-11-27 01:29 44,032 -c--a-w C:\WINDOWS\system32\syskey.exe 2007-11-27 01:29 44,032 -c--a-w C:\WINDOWS\system32\netstat.exe 2007-11-27 01:29 43,520 -c--a-w C:\WINDOWS\system32\typeperf.exe 2007-11-27 01:29 43,008 -c--a-w C:\WINDOWS\system32\rcimlby.exe 2007-11-27 01:29 427,008 ----a-w C:\WINDOWS\system32\ntvdm.exe 2007-11-27 01:29 414,720 -c--a-w C:\WINDOWS\system32\mstsc.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\vssadmin.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\regini.exe 2007-11-27 01:29 40,960 -c--a-w C:\WINDOWS\system32\odbcad32.exe 2007-11-27 01:29 40,960 ----a-w C:\WINDOWS\system32\mnmsrvc.exe 2007-11-27 01:29 40,448 -c--a-w C:\WINDOWS\system32\ping6.exe 2007-11-27 01:29 40,448 ----a-w C:\WINDOWS\system32\rundll32.exe 2007-11-27 01:29 4,403,712 -c--a-w C:\WINDOWS\system32\wpgldfsh.scr 2007-11-27 01:29 393,216 -c--a-w C:\WINDOWS\system32\ssflwbox.scr 2007-11-27 01:29 39,936 -c--a-w C:\WINDOWS\system32\relog.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wupdmgr.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wpnpinst.exe 2007-11-27 01:29 39,424 -c--a-w C:\WINDOWS\system32\wpabaln.exe 2007-11-27 01:29 38,912 -c--a-w C:\WINDOWS\system32\tracert6.exe 2007-11-27 01:29 38,912 -c--a-w C:\WINDOWS\system32\ntsd.exe 2007-11-27 01:29 38,400 -c--a-w C:\WINDOWS\system32\sethc.exe 2007-11-27 01:29 38,400 -c--a-w C:\WINDOWS\system32\sc.exe 2007-11-27 01:29 37,888 -c--a-w C:\WINDOWS\system32\xcopy.exe 2007-11-27 01:29 37,376 -c--a-w C:\WINDOWS\system32\dplaysvr.exe 2007-11-27 01:29 36,864 -c--a-w C:\WINDOWS\system32\lights.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-28_17.18.19.56 ))))))))))))))))))))))))))))))))))))))))) . - 2007-11-08 21:59:01 136,704 ----a-w C:\WINDOWS\catchme.exe + 2007-11-08 21:59:01 146,944 ----a-w C:\WINDOWS\catchme.exe - 2007-11-27 01:28:45 102,912 ----a-w C:\WINDOWS\ehome\ehSched.exe + 2007-11-27 01:28:45 110,080 ----a-w C:\WINDOWS\ehome\ehSched.exe - 2007-06-17 05:11:58 51,200 ----a-w C:\WINDOWS\NirCmd.exe + 2007-06-17 05:11:58 58,368 ----a-w C:\WINDOWS\NirCmd.exe - 2007-11-28 21:15:32 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-01 14:31:03 16,384 -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2007-12-01 14:31:03 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2007-11-28 21:15:32 32,768 -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-12-01 14:31:03 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-11-28 21:37:38 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-01 14:35:31 63,188 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-11-28 21:37:38 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-01 14:35:31 403,968 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-07-22 23:39:27 289,792 ----a-w C:\WINDOWS\system32\swreg.exe - 2007-11-27 01:29:45 126,464 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe + 2007-11-27 01:29:45 133,632 ----a-w C:\WINDOWS\system32\wbem\wmiapsrv.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [] "Ealb"="C:\WINDOWS\CROSOF~1.NET\attrib.exe" [] "MalwareAlarm"="C:\Program Files\MalwareAlarm\MalwareAlarm.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 09:47] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 09:47] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 23:56] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [] "Recguard"="%WINDIR%\SMINST\RECGUARD.exe" [] "MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2007-11-26 20:28] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-11-26 20:28] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 13:42] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Power2GoExpress"="NA" [] C:\Documents and Settings\mg\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.exe [2006-10-26 19:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{ED203331-9C33-49D8-8714-D24A366A04EC}"= C:\WINDOWS\system32\qommnmn.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner.YOUR-DB03786206^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Owner.YOUR-DB03786206\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-11-26 20:28 163840 --a------ C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] C:\WINDOWS\Creator\Remind_XP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "odserv"=3 (0x3) "ehSched"=2 (0x2) "Ati HotKey Poller"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1562eb99-79c1-11db-ad13-0014a596eb8f}] \Shell\AutoRun\command - F:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder "2007-11-24 12:42:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-01 10:03:13 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-01 10:04:01 C:\ComboFix2.txt ... 2007-11-30 16:21 C:\ComboFix3.txt ... 2007-11-30 15:59 . --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:06:57 AM, on 12/1/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = Download Directory R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [Power2GoExpress] NA (User '?') O4 - HKUS\.DEFAULT\..\Run: [Power2GoExpress] NA (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.co... O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.... O16 - DPF: {9E17A5F9-2B9C-4C66-A592-199A4BA1FBC8} - http://pictures04.aim.com/ygp/aol/p... O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/so... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O23 - Service: Ad-Aware 2007 Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe (file missing) -- End of file - 6627 bytes

0

Looking much better but I still don't see an antivirus program running. This is a waste of time without an av running. Run Hijack This again and remove these items: O4 - HKCU\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb O4 - HKCU\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [Ealb] "C:\WINDOWS\CROSOF~1.NET\attrib.exe" -vt yazb (User '?') O4 - HKUS\S-1-5-21-3582902138-2123205628-3047769735-1006\..\Run: [MalwareAlarm] C:\Program Files\MalwareAlarm\MalwareAlarm.exe (User '?') Your java is out of date and can be exploited. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed . Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version. Post a new Hijack This log please.

0