It may be because it can't be updated. Run it again and do not check the box to update or run automatically. Just check the box to allow a desktop icon then install it. Minimize the window and start Malwarebytes with the desktop icon.

0

Thanks...I tried to download to desktop and run it, but still get the same runtime errors I mentioned in a previous post. Also I copied it to my hard drive to try to run it but I get the same errors....Thanks for working on this with me/for me! ekelly

0

Lets try a different tool. Download SDFix.exe and save it to your Desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Remember to re-enable the protection again afterwards before connecting to the Internet. 1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. 2. Open the c:\SDFix folder and double click RunThis.cmd to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. 3. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. 4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt

0

Here's the sdfix report: [b]SDFix: Version 1.227 [/b] Run by Administrator on Sun 09/21/2008 at 04:23 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Rootkit Found : C:\WINDOWS\system32\drivers\tdssserv.sys - Rootkit.Win32.Agent.cku [b]Name [/b]: tdssserv [b]Path [/b]: \systemroot\system32\drivers\TDSSserv.sys tdssserv - Deleted AUTOEXEC.NT Restored from backups Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\drivers\tdssserv.sys - Deleted C:\WINDOWS\system32\tdssinit.dll - Deleted C:\WINDOWS\system32\tdssservers.dat - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 16:47:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 23 Apr 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 23 Apr 2004 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv15.bak" Wed 12 Mar 2008 26,624 ...H. --- "C:\Documents and Settings\Eileen\My Documents\~WRL1403.tmp" Wed 12 Mar 2008 26,624 ...H. --- "C:\Documents and Settings\Eileen\My Documents\~WRL2679.tmp" Wed 10 Sep 2008 7,808,576 A..H. --- "C:\Program Files\Google\Picasa3\setup.exe" Sat 26 Jul 2008 6,104,632 A..H. --- "C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1628\A0257754.exe" Sun 22 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Sat 16 Feb 2008 50,688 ...H. --- "C:\Documents and Settings\Eileen\Local Settings\Temp\~WRL0005.tmp" Sat 16 Feb 2008 52,736 ...H. --- "C:\Documents and Settings\Eileen\Local Settings\Temp\~WRL1741.tmp" Fri 19 Sep 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch1\lock.tmp" Fri 19 Sep 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch2\lock.tmp" Fri 19 Sep 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch3\lock.tmp" Fri 19 Sep 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch4\lock.tmp" Sat 20 Sep 2008 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\Microsoft\OC\Channels\ch5\lock.tmp" Sat 19 Jul 2008 2,533,376 A..H. --- "C:\Documents and Settings\Eileen\Local Settings\Temp\dotnetfx3521022.08\1033\dotnetfx20\BIT7FD9.tmp" Fri 20 Apr 2007 8 A..H. --- "C:\Documents and Settings\Eileen\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Fri 20 Apr 2007 8 A..H. --- "C:\Documents and Settings\Eileen\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" Fri 20 Apr 2007 8 A..H. --- "C:\Documents and Settings\Eileen\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp" Fri 20 Apr 2007 8 A..H. --- "C:\Documents and Settings\Eileen\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp" [b]Finished![/b] ekelly

0

Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

0

hijackthis logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:06:51 PM, on 9/21/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\WINDOWS\Explorer.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\Yahoo!\browser\ycommon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\SYSTEM32\notepad.exe C:\WINDOWS\system32\taskmgr.exe C:\Documents and Settings\Eileen\My Documents\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Error Expert] C:\Program Files\Error Expert\ErrorExpert.exe /scan O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" -quiet O4 - HKCU\..\Run: [HijackThis startup scan] C:\Program Files\Trend Micro\HijackThis\HijackThis.exe /startupscan O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolba... O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re... O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe -- End of file - 7026 bytes ekelly

0

We need to get an antivirus installed on your system before we continue. Get the free version of AVG, that is what I use, you can download it at this link: AVG Free Antivirus Update it once you get it installed. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your AVG antivirus, Spybot and any other antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

0

I tried to install AVG from 3 different sites including from your link...once "installed" I am told that "the application has failed to start because the application configuration is incorrect. Reinstalling might correct the problem." I even tried reinstalling AVG and checked the "repair installation" box, but still won't install. Here's a new combofix log: ComboFix 08-09-20.05 - Eileen 2008-09-21 18:36:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.698 [GMT -4:00] Running from: C:\Documents and Settings\Eileen\My Documents\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\coltea.dll . ((((((((((((((((((((((((( Files Created from 2008-08-21 to 2008-09-21 ))))))))))))))))))))))))))))))) . 2008-09-21 17:58 . 2008-09-21 17:58 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg 2008-09-21 17:58 . 2008-09-21 17:58 97,928 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys 2008-09-21 17:58 . 2008-09-21 17:58 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll 2008-09-21 17:56 . 2008-09-21 17:56 <DIR> d-------- C:\Program Files\AVG 2008-09-21 17:56 . 2008-09-21 18:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-09-21 16:19 . 2008-09-21 16:20 <DIR> d-------- C:\WINDOWS\ERUNT 2008-09-21 16:19 . 2001-08-18 13:00 1,688 --a------ C:\WINDOWS\SYSTEM32\AUTOEXEC.NT 2008-09-21 16:11 . 2008-09-21 16:51 <DIR> d-------- C:\SDFix 2008-09-21 13:34 . 2008-09-21 13:36 <DIR> d-------- C:\Program Files\mbam 2008-09-21 13:32 . 2008-09-21 13:32 <DIR> d-------- C:\Program Files\Languages 2008-09-20 10:27 . 2008-09-20 10:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\CatRoot_bak 2008-09-19 22:53 . 2007-03-29 08:56 409,600 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\qmgr.dll 2008-09-19 22:53 . 2007-03-29 08:56 8,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx2.dll 2008-09-19 22:53 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx4.dll 2008-09-19 22:53 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bitsprx3.dll 2008-09-19 22:53 . 2007-03-29 08:56 7,168 --------- C:\WINDOWS\SYSTEM32\bitsprx4.dll 2008-09-19 21:47 . 2008-09-19 21:48 <DIR> d-------- C:\Program Files\Security Task Manager 2008-09-19 21:47 . 2008-09-20 00:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan 2008-09-19 21:01 . 2008-09-19 21:04 <DIR> d-------- C:\Program Files\Error Expert 2008-09-19 19:32 . 2008-09-19 19:32 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-09-19 19:14 . 2004-03-06 04:21 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic 2008-09-19 19:14 . 2004-03-06 04:25 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc 2008-09-19 19:14 . 2008-09-21 17:58 <DIR> d-------- C:\Documents and Settings\Administrator 2008-09-19 17:28 . 2008-09-19 17:28 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-18 23:02 . 2008-09-18 23:02 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-09-10 20:58 . 2008-09-10 20:58 <DIR> d-------- C:\WINDOWS\SYSTEM32\IOSUBSYS 2008-09-10 00:14 . 2008-09-10 00:15 <DIR> d-------- C:\Program Files\iTunes 2008-09-10 00:14 . 2008-09-10 00:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-10 00:13 . 2008-09-10 00:13 <DIR> d-------- C:\Program Files\Bonjour 2008-09-10 00:11 . 2008-09-10 00:12 <DIR> d-------- C:\Program Files\QuickTime 2008-09-09 23:03 . 2008-09-10 02:08 <DIR> d-------- C:\Program Files\Apple Software Update 2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ C:\WINDOWS\SYSTEM32\QuickTimeVR.qtx 2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ C:\WINDOWS\SYSTEM32\QuickTime.qts 2008-08-31 17:02 . 2008-08-31 17:08 <DIR> d-------- C:\Program Files\Virtual Earth 3D 2008-08-29 13:18 . 2008-08-29 13:18 2,302,017 --a------ C:\WINDOWS\SYSTEM32\GPhotos.scr 2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ C:\WINDOWS\SYSTEM32\dns-sd.exe 2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ C:\WINDOWS\SYSTEM32\dnssd.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-21 19:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-09-21 00:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-21 00:15 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-09-20 06:09 --------- d-----w C:\Documents and Settings\Eileen\Application Data\Apple Computer 2008-09-20 00:35 --------- d-----w C:\Program Files\Windows Live Safety Center 2008-09-20 00:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-09-19 23:01 --------- d-----w C:\Documents and Settings\Eileen\Application Data\skypePM 2008-09-19 20:37 --------- d-----w C:\Program Files\Java 2008-09-11 00:58 --------- d-----w C:\Program Files\Google 2008-09-10 04:14 --------- d-----w C:\Program Files\iPod 2008-09-10 04:12 --------- d-----w C:\Program Files\Common Files\Apple 2008-09-10 03:52 10,835 ----a-w C:\Program Files\changes.rtf 2008-08-19 17:21 4,117 ----a-w C:\Program Files\license.txt 2008-08-18 23:41 --------- d-----w C:\Program Files\Microsoft Office2 2008-08-09 14:56 --------- d-----w C:\Program Files\Sun 2008-07-27 17:47 --------- d-----w C:\Program Files\Norton AntiVirus 2008-07-27 17:47 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-07-27 17:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-07-27 07:00 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-07-24 03:22 --------- d-----w C:\Program Files\STK017_V2.01 2008-07-24 02:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-24 02:31 --------- d-----w C:\Program Files\Lavasoft 2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll 2008-07-19 02:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll 2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe 2008-07-19 02:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe 2008-07-19 02:10 45,768 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll 2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll 2008-07-19 02:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll 2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll 2008-07-19 02:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll 2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll 2008-07-19 02:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll 2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll 2008-07-19 02:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll 2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll 2008-07-19 02:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll 2008-07-19 02:07 270,880 ----a-w C:\WINDOWS\SYSTEM32\mucltui.dll 2008-07-19 02:07 210,976 ----a-w C:\WINDOWS\SYSTEM32\muweb.dll 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\es.dll 2008-06-24 22:12 295,936 ------w C:\WINDOWS\SYSTEM32\wmpeffects.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll 2008-06-24 16:23 74,240 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mscms.dll 2008-06-24 14:57 3,592,192 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll 2008-06-23 09:20 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe 2008-06-23 09:20 625,664 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll 2008-01-27 02:44 9,527,552 ----a-w C:\Program Files\CFP_Setup_3.0.15.277_XP_Vista_x32.exe 2006-04-20 00:15 491,768 -c--a-w C:\Program Files\ie6setup.exe 2005-12-28 04:47 7,554 -c--a-w C:\Program Files\music5c27sallaround.xspf 2005-10-22 00:54 4,878,136 -c--a-w C:\Program Files\Firefox Setup 1.0.7.exe 2005-07-24 02:29 2,855,080 -c--a-w C:\Program Files\aawsepersonal.exe 2005-07-02 03:38 534,104 -c--a-w C:\Program Files\psa2011_ytb01_DLM_enu_full.exe 2005-02-22 00:55 4,354,084 -c--a-w C:\Program Files\spybotsd13.exe 2005-01-21 14:43 295,120 -c--a-w C:\Program Files\NSSetup.exe 2004-11-21 05:42 456,808 -c--a-w C:\Program Files\GoogleDesktopSearchSetup.exe 2004-03-14 19:45 9,143,000 -c--a-w C:\Program Files\AdbeRdr60_enu.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-07 4670968] "HijackThis startup scan"="C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" [2008-09-19 396288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-22 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-22 126976] "PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2003-08-26 204800] "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 129536] "Motive SmartBridge"="C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-08 289576] "Error Expert"="C:\Program Files\Error Expert\ErrorExpert.exe" [2008-01-09 2087592] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-21 1235736] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 C:\WINDOWS\BCMSMMSG.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ AT&T Self Support Tool.lnk - C:\Program Files\SBC Self Support Tool\bin\matcli.exe [2007-08-07 217088] Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2006-08-06 124912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-21 97928] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-21 231704] S3 DCamUSBSTK017;STK017 Camera;C:\WINDOWS\system32\DRIVERS\STK017W2.sys [2003-11-17 99476] . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{E0D8FD38-6F36-4C9F-AE43-EDFA2BB266BA} - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Eileen\Application Data\Mozilla\Firefox\Profiles\5yr07ekb.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 18:39:54 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\TEMP\TMP00000069CF807D634244E5F9 524288 bytes executable ************************************************************************** . Completion time: 2008-09-21 18:43:09 ComboFix-quarantined-files.txt 2008-09-21 22:42:06 Pre-Run: 37,084,897,280 bytes free Post-Run: 38,106,681,344 bytes free 171 --- E O F --- 2008-09-21 19:44:20 ekelly

0

Download the free version of Avast antivirus from this link: Avast Free Antivirus Once you get Avast downloaded to your desktop go to start> control panel> add/remove programs and uninstall AVG then install Avast and update it. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply.

0

Wow it took almost 2 hours ...here's the kaspersky report- --------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, September 21, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, September 22, 2008 00:52:42 Records in database: 1248741 ---------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 72543 Threat name: 4 Infected objects: 6 Suspicious objects: 0 Duration of the scan: 01:54:24 File name / Threat name / Threats count C:\Documents and Settings\Eileen\Application Data\Sun\Java\Deployment\cache\6.0\36\710cee4-1ca895e1 Infected: Trojan-Downloader.Java.OpenConnection.ar 1 C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(2).exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.cb 1 C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(3).exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.cb 1 C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.cb 1 C:\Program Files\STK017_V2.01\STK017M.exe Infected: not-a-virus:AdWare.Win32.Cres 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\coltea.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.ba 1 The selected area was scanned. ekelly

0

Go to start> control panel> java> general> settings> delete files. ok. Go to start> control panel> add/remove programs and uninstall this program if found if it is not a program you want to keep: STK017_V2.01 Then navigate to and delete this folder if found: C:\Program Files\STK017_V2.01 Next go to start> run> type in combofix /u (note the space after Combofix) then press enter. This will uninstall Combofix and the C:\Qoobox folder. The following 3 files are said to be safe but I personally do not trust anything from mywebsearch but it is up to you if you want to delete them or not as they are deemed non-destructive adware: C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(2).exe C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(3).exe C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000.exe Your computer should be clean now, how is it operating?

0

I could not delete the STK017_V2.01 program from Add/Remove...any ideas? How do I find the files to delete? I looked in Explore and couldn't find. C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(2).exe C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000(3).exe C:\Documents and Settings\Eileen\My Documents\MyFunCardsSetup2.2.60.11-2.ZUfox000.exe Otherwise, it is working great! THANK YOU!!!!! You are amazing. ekelly

0

And by the way, how do I prevent this from happening again? ekelly

0

They may be hidden. Set up the computer to view hidden files: To show hidden files do the following: Click Start > My Computer On the Tools menu, click Folder Options. Click the View tab. Uncheck Hide file extensions for known file types. Uncheck Hide protected operating system files. Under the Hidden files folder, locate and check Show hidden files and folders. If you see a warning message, click Yes. Click Apply > OK. Then look for the funcard files. Just navigate to and delete this folder if found: C:\Program Files\STK017_V2.01 I didn't see the version of java you have running but it should be version 6 update 7. Go to the java applet again in control panel > click java> view. You should see what version you are running, if not 6u7 then follow the direction to update. Download the latest version of java from this link Java Click on the JRE 6 Update 7 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

I've got java 6u7 thanks. I am running AVG now as you advised earlier and I will download Spywareblaster. Wow, what a great job, thank you so much....you spent the whole weekend on this! I sure hope someone is paying you a lot of money! Eileen ekelly

0

Glad we could help.

0