Computing.Net - Help removing Zonebac.gen!B please

Subject: Help removing Zonebac.gen!B please

Original Message

Name: lchiv
Date: November 26, 2007 at 20:59:17 Pacific
Subject: Help removing Zonebac.gen!B please
OS: Win Xp Home edition SP2
CPU/Ram: 512MB
Model/Manufacturer: HP Pavilion

Comment:

I'm looking for help to remove backdoorWin32/zonebac.gen !B that has appeared on my computer.
Any help would be appreciated.
Thanks

Report Offensive Message For Removal

Response Number 1

Name: jabuck
Date: November 26, 2007 at 21:42:19 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Please download and install the latest version of HijackThis v2.0.2:
Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Please download FindAWL from this link FindAWF
Double-click on the FindAWF.exe file to run it. It will open a command prompt and ask you to "Press any key to continue". You will be presented with a Menu.
1. Press 1 then Enter to scan for bak folders
2. Press 2 then Enter to restore files from bak folders
3. Press 3 then Enter to remove bak folders
4. Press 4 then Enter to reset domain zones
5. Press E then Enter to EXIT
Press 1 then press Enter. Copy and paste the contents of the AWF.txt file in your next reply.

Report Offensive Follow Up For Removal

Response Number 2

Name: lchiv
Date: November 27, 2007 at 08:21:28 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Thanks for trying to help me out, here are the reports.
Logfile of HijackThis v1.99.1
Scan saved at 7:46:43 AM, on 11/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\IPEVO\Free-1 USB Phone\Free-1 USB Phone.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\windows\system\bak\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\SpyDefender Pro\SpyDefender.exe
C:\Documents and Settings\Owner\My Documents\Unzipped\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LyraHD2TrayApp] "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Free-1] "C:\Program Files\IPEVO\Free-1 USB Phone\Free-1 USB Phone.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SpyDefender Shield] "C:\Program Files\SpyDefender Pro\SpyDefender.exe" --scan2
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Startup: Update WinBMD.lnk = C:\Program Files\WinBMD\WiseUpdt.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.co...
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/1211...
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPi...
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/...
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...
O16 - DPF: {22945A69-1191-4DCF-9E6F-409BDE94D101} (EModelNonVersionSpecificViewControl Class) - http://www.solidworks.com/plugins/e...
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.ed...
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.co...
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxC...
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by107fd.bay107.hotmail.msn.c...
O16 - DPF: {596AF4AC-40A0-474A-9F86-33F0A90F0FD6} (PictureItLauncher Class) - http://photos.msn.com/resources/neu...
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gm...
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageView...
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetu...
O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.brightstreet.com/cif/...
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uplo...
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFI...
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v1...
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yah...
O16 - DPF: {B9F3009B-976B-41C4-A992-229DCCF3367C} (CoAxTrack Class) - http://cdn.digitalcity.com/_media/d...
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binar...
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcapl...
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/h...
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://upload.smugmug.com/photos/ac...
O16 - DPF: {E93A6FCA-C052-45DF-AC9B-B729066092F8} (Util Class) - http://isupport4.hp.com/motivedocs/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/1211...
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads...
O16 - DPF: {FF452CFC-7056-4A5D-A327-1DFEC8EDC82A} (Upload Class) - http://www.neptune.com/features/upl...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\system32\HPHipm11.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Find AWF report by noahdfear ©2006
Version 1.40
The current date is: Tue 11/27/2007
The current time is: 7:54:21.90

bak folders found
~~~~~~~~~~~

Directory of C:\WINDOWS\BAK
08/27/2003 02:20 PM 94,208 SM1BG.EXE
1 File(s) 94,208 bytes
Directory of C:\PROGRA~1\ITUNES\BAK
10/30/2006 09:36 AM 256,576 iTunesHelper.exe
1 File(s) 256,576 bytes
Directory of C:\PROGRA~1\MICROS~2\BAK
09/01/2003 05:52 PM 376,912 WCESCOMM.EXE
1 File(s) 376,912 bytes
Directory of C:\PROGRA~1\QUICKT~1\BAK
10/25/2006 06:58 PM 282,624 qttask.exe
1 File(s) 282,624 bytes
Directory of C:\WINDOWS\SMINST\BAK
09/13/2002 10:42 PM 212,992 RECGUARD.EXE
1 File(s) 212,992 bytes
Directory of C:\WINDOWS\SYSTEM\BAK
11/26/2007 08:26 PM 181 hpsysdrv.DAT
05/07/1998 05:04 PM 52,736 hpsysdrv.exe
2 File(s) 52,917 bytes
Directory of C:\WINDOWS\SYSTEM32\BAK
08/04/2004 01:56 AM 15,360 ctfmon.exe
03/11/2003 06:11 PM 114,688 hkcmd.exe
2 File(s) 130,048 bytes
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK
10/14/2006 05:11 AM 190,464 GoogleDesktop.exe
1 File(s) 190,464 bytes
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~3\BAK
06/26/2007 10:54 AM 68,856 GoogleToolbarNotifier.exe
1 File(s) 68,856 bytes
Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK
09/14/2007 02:21 AM 421,888 avgcc.exe
1 File(s) 421,888 bytes
Directory of C:\PROGRA~1\HEWLET~1\HPSHAR~1\BAK
04/17/2002 06:42 PM 69,632 hpgs2wnd.exe
1 File(s) 69,632 bytes
Directory of C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK
02/19/2006 02:41 AM 49,152 HPWuSchd2.exe
1 File(s) 49,152 bytes
Directory of C:\PROGRA~1\IPEVO\FREE-1~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK
12/10/2004 07:44 PM 11,776 mimboot.exe
1 File(s) 11,776 bytes
Directory of C:\PROGRA~1\SKYPE\PHONE\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\SUPPORT.COM\BIN\BAK
11/18/2005 10:33 PM 1,851,392 tgcmd.exe
1 File(s) 1,851,392 bytes
Directory of C:\PROGRA~1\THEWEA~1\DESKTO~1\BAK
04/19/2006 08:30 AM 728,176 DesktopWeather.exe
1 File(s) 728,176 bytes
Directory of C:\PROGRA~1\WILDTA~1\APPS\BAK
04/30/2003 04:21 PM 184,784 GameChannel.exe
1 File(s) 184,784 bytes
Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK
05/21/2004 11:49 AM 2,498,560 ypager.exe
1 File(s) 2,498,560 bytes
Directory of C:\WINDOWS\SYSTEM32\P2PNET~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\ADOBE\ACROBA~3.0\READER\BAK
11/22/2004 08:18 AM 307,200 AdobeUpdateManager.exe
1 File(s) 307,200 bytes
Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~2\BAK
12/10/2002 04:54 PM 127,022 LVCOMS.EXE
1 File(s) 127,022 bytes
Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK
09/13/2003 08:36 PM 50,688 WkUFind.exe
1 File(s) 50,688 bytes
Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK
06/15/2006 08:10 AM 180,269 realsched.exe
1 File(s) 180,269 bytes
Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\UNLOAD\BAK
06/22/2002 08:27 AM 69,632 hpqcmon.exe
1 File(s) 69,632 bytes
Directory of C:\PROGRA~1\JAVA\JRE16~2.0_0\BIN\BAK
07/12/2007 04:00 AM 132,496 jusched.exe
1 File(s) 132,496 bytes
Directory of C:\PROGRA~1\THOMSON\LYRAJU~1\LYRAHD~1\BAK
08/12/2003 07:24 AM 282,624 LYRAHD2TrayApp.exe
1 File(s) 282,624 bytes
Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK
05/21/2002 11:28 PM 188,416 hpztsb05.exe
1 File(s) 188,416 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
26636 Oct 18 2007 "C:\WINDOWS\SM1BG.EXE"
94208 Aug 27 2003 "C:\WINDOWS\bak\SM1BG.EXE"
94208 Aug 27 2003 "C:\WINDOWS\DRIVERS\SM1\SM1bg.exe"
26636 Oct 18 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
102400 Dec 18 2006 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe"
108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe"
26636 Oct 18 2007 "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
376912 Sep 1 2003 "C:\Program Files\Microsoft ActiveSync\bak\WCESCOMM.EXE"
26636 Oct 18 2007 "C:\Program Files\QuickTime\qttask.exe"
282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
26636 Oct 18 2007 "C:\WINDOWS\SMINST\RECGUARD.EXE"
212992 Sep 13 2002 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE"
186 Oct 26 2007 "C:\WINDOWS\system\hpsysdrv.DAT"
181 Nov 26 2007 "C:\WINDOWS\system\bak\hpsysdrv.DAT"
26636 Oct 18 2007 "C:\WINDOWS\system\hpsysdrv.exe"
52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
26636 Oct 18 2007 "C:\WINDOWS\system32\hkcmd.exe"
114688 Mar 11 2003 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 Mar 11 2003 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\hkcmd.exe"
52272 Feb 9 2007 "C:\Program Files\Google\googletoolbar4user.exe"
458820 Nov 17 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe"
2132280 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe"
26636 Oct 18 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
559784 Jun 15 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe"
138168 Feb 9 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
190464 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
52272 Feb 9 2007 "C:\Program Files\Google\googletoolbar4user.exe"
458820 Nov 17 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe"
2132280 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe"
26636 Oct 18 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
559784 Jun 15 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe"
138168 Feb 9 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
190464 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
579072 Oct 23 2007 "C:\Program Files\Grisoft\AVG7\avgcc.exe"
421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
26636 Oct 18 2007 "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
69632 Apr 17 2002 "C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe"
26636 Oct 18 2007 "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
49152 Feb 19 2006 "C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
26636 Oct 18 2007 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe"
11776 Dec 10 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mimboot.exe"
11776 Dec 24 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mimboot.exe"
26636 Oct 18 2007 "C:\Program Files\Support.com\bin\tgcmd.exe"
1851392 Nov 18 2005 "C:\Program Files\Support.com\bin\bak\tgcmd.exe"
26636 Oct 18 2007 "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
728176 Apr 19 2006 "C:\Program Files\The Weather Channel FW\Desktop Weather\bak\DesktopWeather.exe"
26636 Oct 18 2007 "C:\Program Files\WildTangent\Apps\GameChannel.exe"
184784 Apr 30 2003 "C:\Program Files\WildTangent\Apps\bak\GameChannel.exe"
26636 Oct 18 2007 "C:\Program Files\Yahoo!\Messenger\ypager.exe"
2498560 May 21 2004 "C:\Program Files\Yahoo!\Messenger\bak\ypager.exe"
26636 Oct 18 2007 "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe"
307200 Nov 22 2004 "C:\Program Files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe"
90112 Sep 20 2002 "C:\WINDOWS\system32\LVComS.exe"
102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe"
90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe"
26636 Oct 18 2007 "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE"
127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\bak\LVCOMS.EXE"
26636 Oct 18 2007 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
50688 Sep 13 2003 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe"
28672 Jul 24 2002 "C:\Program Files\Online Services\MSN80\MSN\pictureit\PIP\Common\MSShared\WkShared\WkUFind.exe"
26636 Oct 18 2007 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
180269 Jun 15 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
26636 Oct 18 2007 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"
69632 Jun 22 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
26636 Oct 18 2007 "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
132496 Jul 12 2007 "C:\Program Files\Java\jre1.6.0_02\bin\bak\jusched.exe"
26636 Oct 18 2007 "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
282624 Aug 12 2003 "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\bak\LYRAHD2TrayApp.exe"
26636 Oct 18 2007 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
188416 May 21 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"

end of report

Report Offensive Follow Up For Removal

Response Number 3

Name: jabuck
Date: November 27, 2007 at 19:01:52 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 2 then Enter to restore files from bak folders
A text file opens called: files.txt
Click below the line and paste the following list of files to be restored:

"C:\WINDOWS\bak\SM1BG.EXE"
"C:\Program Files\iTunes\bak\iTunesHelper.exe"
"C:\Program Files\Microsoft ActiveSync\bak\WCESCOMM.EXE"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\WINDOWS\SMINST\bak\RECGUARD.EXE"
"C:\WINDOWS\system\bak\hpsysdrv.DAT"
"C:\WINDOWS\system\bak\hpsysdrv.exe"
"C:\WINDOWS\system32\bak\ctfmon.exe"
"C:\WINDOWS\system32\bak\hkcmd.exe"
"C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
"C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
"C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
"C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
"C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
69632 Apr 17 2002 "C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe"
"C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mimboot.exe"
"C:\Program Files\Support.com\bin\bak\tgcmd.exe"
"C:\Program Files\The Weather Channel FW\Desktop Weather\bak\DesktopWeather.exe"
"C:\Program Files\WildTangent\Apps\bak\GameChannel.exe"
"C:\Program Files\Yahoo!\Messenger\bak\ypager.exe"
"C:\Program Files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe"
"C:\Program Files\Common Files\Logitech\QCDriver3\bak\LVCOMS.EXE"
"C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
"C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe"
"C:\Program Files\Java\jre1.6.0_02\bin\bak\jusched.exe"
"C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\bak\LYRAHD2TrayApp.exe"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"

Next, close and click Yes to save the changes.
Once files.txt is saved, FindAWF does the following:
-It attempts to terminate the process represented by each filename on the list, if running
-Deletes the rogue file from the parent folder, if present
-Copies the original file to the parent folder
When done with the above, it automatically runs a new scan and opens a new log.
Please provide the new FindAWF log in your reply.

Report Offensive Follow Up For Removal

Response Number 4

Name: lchiv
Date: November 27, 2007 at 19:52:54 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Thanks again for your help.
Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully
The current date is: Tue 11/27/2007
The current time is: 19:37:29.17

bak folders found
~~~~~~~~~~~

Directory of C:\WINDOWS\BAK
08/27/2003 02:20 PM 94,208 SM1BG.EXE
1 File(s) 94,208 bytes
Directory of C:\PROGRA~1\ITUNES\BAK
10/30/2006 09:36 AM 256,576 iTunesHelper.exe
1 File(s) 256,576 bytes
Directory of C:\PROGRA~1\MICROS~2\BAK
09/01/2003 05:52 PM 376,912 WCESCOMM.EXE
1 File(s) 376,912 bytes
Directory of C:\PROGRA~1\QUICKT~1\BAK
10/25/2006 06:58 PM 282,624 qttask.exe
1 File(s) 282,624 bytes
Directory of C:\WINDOWS\SMINST\BAK
09/13/2002 10:42 PM 212,992 RECGUARD.EXE
1 File(s) 212,992 bytes
Directory of C:\WINDOWS\SYSTEM\BAK
11/26/2007 08:26 PM 181 hpsysdrv.DAT
05/07/1998 05:04 PM 52,736 hpsysdrv.exe
2 File(s) 52,917 bytes
Directory of C:\WINDOWS\SYSTEM32\BAK
08/04/2004 01:56 AM 15,360 ctfmon.exe
03/11/2003 06:11 PM 114,688 hkcmd.exe
2 File(s) 130,048 bytes
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK
10/14/2006 05:11 AM 190,464 GoogleDesktop.exe
1 File(s) 190,464 bytes
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~3\BAK
06/26/2007 10:54 AM 68,856 GoogleToolbarNotifier.exe
1 File(s) 68,856 bytes
Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK
09/14/2007 02:21 AM 421,888 avgcc.exe
1 File(s) 421,888 bytes
Directory of C:\PROGRA~1\HEWLET~1\HPSHAR~1\BAK
04/17/2002 06:42 PM 69,632 hpgs2wnd.exe
1 File(s) 69,632 bytes
Directory of C:\PROGRA~1\HEWLET~1\HPSOFT~1\BAK
02/19/2006 02:41 AM 49,152 HPWuSchd2.exe
1 File(s) 49,152 bytes
Directory of C:\PROGRA~1\IPEVO\FREE-1~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK
12/10/2004 07:44 PM 11,776 mimboot.exe
1 File(s) 11,776 bytes
Directory of C:\PROGRA~1\SKYPE\PHONE\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\SUPPORT.COM\BIN\BAK
11/18/2005 10:33 PM 1,851,392 tgcmd.exe
1 File(s) 1,851,392 bytes
Directory of C:\PROGRA~1\THEWEA~1\DESKTO~1\BAK
04/19/2006 08:30 AM 728,176 DesktopWeather.exe
1 File(s) 728,176 bytes
Directory of C:\PROGRA~1\WILDTA~1\APPS\BAK
04/30/2003 04:21 PM 184,784 GameChannel.exe
1 File(s) 184,784 bytes
Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK
05/21/2004 11:49 AM 2,498,560 ypager.exe
1 File(s) 2,498,560 bytes
Directory of C:\WINDOWS\SYSTEM32\P2PNET~1\BAK
0 File(s) 0 bytes
Directory of C:\PROGRA~1\ADOBE\ACROBA~3.0\READER\BAK
11/22/2004 08:18 AM 307,200 AdobeUpdateManager.exe
1 File(s) 307,200 bytes
Directory of C:\PROGRA~1\COMMON~1\LOGITECH\QCDRIV~2\BAK
12/10/2002 04:54 PM 127,022 LVCOMS.EXE
1 File(s) 127,022 bytes
Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK
09/13/2003 08:36 PM 50,688 WkUFind.exe
1 File(s) 50,688 bytes
Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK
06/15/2006 08:10 AM 180,269 realsched.exe
1 File(s) 180,269 bytes
Directory of C:\PROGRA~1\HEWLET~1\DIGITA~1\UNLOAD\BAK
06/22/2002 08:27 AM 69,632 hpqcmon.exe
1 File(s) 69,632 bytes
Directory of C:\PROGRA~1\JAVA\JRE16~2.0_0\BIN\BAK
07/12/2007 04:00 AM 132,496 jusched.exe
1 File(s) 132,496 bytes
Directory of C:\PROGRA~1\THOMSON\LYRAJU~1\LYRAHD~1\BAK
08/12/2003 07:24 AM 282,624 LYRAHD2TrayApp.exe
1 File(s) 282,624 bytes
Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK
05/21/2002 11:28 PM 188,416 hpztsb05.exe
1 File(s) 188,416 bytes

Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
94208 Aug 27 2003 "C:\WINDOWS\SM1BG.EXE"
94208 Aug 27 2003 "C:\WINDOWS\bak\SM1BG.EXE"
94208 Aug 27 2003 "C:\WINDOWS\DRIVERS\SM1\SM1bg.exe"
256576 Oct 30 2006 "C:\Program Files\iTunes\iTunesHelper.exe"
256576 Oct 30 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe"
102400 Dec 18 2006 "C:\WINDOWS\Installer\{446DBFFA-4088-48E3-8932-74316BA4CAE4}\iTunesIco.exe"
108096 Oct 30 2006 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.0.2.16\iTunesSetupAdmin.exe"
376912 Sep 1 2003 "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
376912 Sep 1 2003 "C:\Program Files\Microsoft ActiveSync\bak\WCESCOMM.EXE"
282624 Oct 25 2006 "C:\Program Files\QuickTime\qttask.exe"
282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe"
212992 Sep 13 2002 "C:\WINDOWS\SMINST\RECGUARD.EXE"
212992 Sep 13 2002 "C:\WINDOWS\SMINST\bak\RECGUARD.EXE"
181 Nov 26 2007 "C:\WINDOWS\system\hpsysdrv.DAT"
181 Nov 26 2007 "C:\WINDOWS\system\bak\hpsysdrv.DAT"
52736 May 7 1998 "C:\WINDOWS\system\hpsysdrv.exe"
52736 May 7 1998 "C:\WINDOWS\system\bak\hpsysdrv.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\ctfmon.exe"
15360 Aug 4 2004 "C:\WINDOWS\system32\bak\ctfmon.exe"
114688 Mar 11 2003 "C:\WINDOWS\system32\hkcmd.exe"
114688 Mar 11 2003 "C:\WINDOWS\system32\bak\hkcmd.exe"
114688 Mar 11 2003 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\hkcmd.exe"
52272 Feb 9 2007 "C:\Program Files\Google\googletoolbar4user.exe"
458820 Nov 17 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe"
2132280 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
559784 Jun 15 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe"
138168 Feb 9 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
190464 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
52272 Feb 9 2007 "C:\Program Files\Google\googletoolbar4user.exe"
458820 Nov 17 2005 "C:\Program Files\Google\Google Earth\GoogleEarth.exe"
2132280 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
559784 Jun 15 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe"
138168 Feb 9 2007 "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
190464 Oct 14 2006 "C:\Program Files\Google\Google Desktop Search\bak\GoogleDesktop.exe"
68856 Jun 26 2007 "C:\Program Files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe"
421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\avgcc.exe"
421888 Sep 14 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe"
26636 Oct 18 2007 "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
69632 Apr 17 2002 "C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak\hpgs2wnd.exe"
49152 Feb 19 2006 "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
49152 Feb 19 2006 "C:\Program Files\Hewlett-Packard\HP Software Update\bak\HPWuSchd2.exe"
11776 Dec 10 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mimboot.exe"
11776 Dec 10 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak\mimboot.exe"
11776 Dec 24 2004 "C:\Program Files\MUSICMATCH\MUSICMATCH Update\MMJB\mimboot.exe"
1851392 Nov 18 2005 "C:\Program Files\Support.com\bin\tgcmd.exe"
1851392 Nov 18 2005 "C:\Program Files\Support.com\bin\bak\tgcmd.exe"
728176 Apr 19 2006 "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
728176 Apr 19 2006 "C:\Program Files\The Weather Channel FW\Desktop Weather\bak\DesktopWeather.exe"
184784 Apr 30 2003 "C:\Program Files\WildTangent\Apps\GameChannel.exe"
184784 Apr 30 2003 "C:\Program Files\WildTangent\Apps\bak\GameChannel.exe"
2498560 May 21 2004 "C:\Program Files\Yahoo!\Messenger\ypager.exe"
2498560 May 21 2004 "C:\Program Files\Yahoo!\Messenger\bak\ypager.exe"
307200 Nov 22 2004 "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe"
307200 Nov 22 2004 "C:\Program Files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe"
90112 Sep 20 2002 "C:\WINDOWS\system32\LVComS.exe"
102400 Jun 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe"
90112 Sep 20 2002 "C:\Program Files\Common Files\Logitech\QCDriver2\LVComS.exe"
127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE"
127022 Dec 10 2002 "C:\Program Files\Common Files\Logitech\QCDriver3\bak\LVCOMS.EXE"
26636 Oct 18 2007 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe"
50688 Sep 13 2003 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe"
28672 Jul 24 2002 "C:\Program Files\Online Services\MSN80\MSN\pictureit\PIP\Common\MSShared\WkShared\WkUFind.exe"
180269 Jun 15 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
180269 Jun 15 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe"
69632 Jun 22 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe"
69632 Jun 22 2002 "C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak\hpqcmon.exe"
36975 Nov 10 2005 "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
83608 Mar 14 2007 "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
132496 Jul 12 2007 "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
132496 Jul 12 2007 "C:\Program Files\Java\jre1.6.0_02\bin\bak\jusched.exe"
282624 Aug 12 2003 "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
282624 Aug 12 2003 "C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\bak\LYRAHD2TrayApp.exe"
188416 May 21 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe"
188416 May 21 2002 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\hpztsb05.exe"

end of report
Lesley

Report Offensive Follow Up For Removal

Response Number 5

Name: jabuck
Date: November 27, 2007 at 20:31:27 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Option 3:
Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 3 then Enter to remove bak folders
A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\WINDOWS\bak
C:\Program Files\iTunes\bak
C:\Program Files\Microsoft ActiveSync\bak
C:\Program Files\QuickTime\bakC:\WINDOWS\SMINST\bak
C:\WINDOWS\system\bak
C:\WINDOWS\system\bak
C:\WINDOWS\system32\bak
C:\WINDOWS\system32\bak
C:\Program Files\Google\Google Desktop Search\bak
C:\Program Files\Google\GoogleToolbarNotifier\bak
C:\Program Files\Google\Google Desktop Search\bak
C:\Program Files\Grisoft\AVG7\bak
C:\Program Files\Hewlett-Packard\HP Share-to-Web\bak
C:\Program Files\Hewlett-Packard\HP Software Update\bak
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\bak
C:\Program Files\Support.com\bin\bak
C:\Program Files\The Weather Channel FW\Desktop Weather\bak
C:\Program Files\WildTangent\Apps\bak
C:\Program Files\Yahoo!\Messenger\bak
C:\Program Files\Adobe\Acrobat 7.0\Reader\bak
C:\Program Files\Common Files\Logitech\QCDriver3\bak
C:\Program Files\Common Files\Real\Update_OB\bak
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\bak
C:\Program Files\Java\jre1.6.0_02\bin
C:\Program Files\Thomson\Lyra Jukebox\LyraHDTrayApp\bak
C:\WINDOWS\system32\spool\drivers\w32x86\3\bak

Next, close and click Yes to save the changes.
Once folders.txt is saved, FindAWF does the following:
-It deletes the contents of the bak folders
-Removes the bak folders
When done with the above, it automatically runs a new scan and opens a new log.
Please provide the new FindAWF log in your reply.

Next Option 4.

Option 4:
Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 4 then Enter to reset domain zones
This removes all entries from the domain zones.
When the program returns to the main menu, use the following option:
Press E then Enter to EXIT
Next,
Launch Notepad, and copy/paste everything between the X's making "regedit4" the very top line.
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges]
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Then, disconnect from the Internet!
Next,
Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.
Optional if the following programs are in your computer.
Note that since the Domains are deleted SpywareBlaster protection must be re-enabled. Spybot's Immunize feature must be used again, also you have to re-install IE-SpyAd if installed.
Delete the fixme.reg file just created.
Please download ComboFix to the desktop from this link:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Report Offensive Follow Up For Removal

Response Number 6

Name: lchiv
Date: November 27, 2007 at 23:17:02 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Help ! something went wrong. got all the way and ran the combofix. It restarted the computer and all my icons came up (progress)there was a couple of problem boxes came up and then I just sat and sat waiting for the log to be produced and nothing happened. Eventually I gave up after an hour and fired this up.
I did get a FINDAWF log but lost it when the computer rebooted.
What shall I do now, try the whole thing again ?
Thanks for your patience and your help.
Lesley

Report Offensive Follow Up For Removal

Response Number 7

Name: jabuck
Date: November 28, 2007 at 16:12:50 Pacific
Subject: Help removing Zonebac.gen!B please

Reply: (edit)

Post a new H9ijack This log please.

Report Offensive Follow Up For Removal