Hello out there, Having troubles with my internet... i can't access some sites, like hotmail and yahoo, but i can get to google, but it won't let me search. Anytime i try to do get to these sites, it just says loading, and doesn't actually load. Anybody know how to fix this? baffled-cat

Go start > run type cmd and press enter or ok. type ipconfig /flushdns (The space between g and / is needed) Then press Enter, type Exit, press Enter again Please download Malwarebytes' Anti-Malware from one of these sites: MalwareBytes1 MalwareBytes2 1. Double Click mbam-setup.exe to install the application. 2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. 3. If an update is found, it will download and install the latest version. 4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. 5. When the scan is complete, click OK, then Show Results to view the results. 6. Make sure that everything found is checked, and click Remove Selected. 7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. 8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. 9. Copy&Paste the entire report in your next reply. Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This 1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Do the following if you still can't get onto the internet to run Malwarebytes and Hijack This. Please then reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select "Safemode with Networking", then press "Enter". Choose your usual account. Then try to do online, download Malwarebytes, updtae it and run it being sure to follow yhe directions in Step 6.

Malwarebytes' Anti-Malware 1.28 Database version: 1190 Windows 5.1.2600 Service Pack 2 9/21/08 10:15:22 PM mbam-log-2008-09-21 (22-15-22).txt Scan type: Quick Scan Objects scanned: 48180 Time elapsed: 11 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 12 Registry Values Infected: 3 Registry Data Items Infected: 2 Folders Infected: 3 Files Infected: 22 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4cafaf0c-c38f-43c1-8080-390e776254de} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ssqoibuv (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4cafaf0c-c38f-43c1-8080-390e776254de} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm291d2a3d (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2a2e19a1 (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Host Process (Worm.IRCBot) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\efcbrqha baffled-cat

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:26:51 PM, on 9/21/08 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe C:\Program Files\Shaw Secure\Common\FSMA32.exe C:\Program Files\Shaw Secure\Anti-Virus\FSGK32.exe C:\Program Files\Shaw Secure\Common\FSMB32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Shaw Secure\Common\FCH32.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Shaw Secure\Common\FAMEH32.exe C:\Program Files\Shaw Secure\Anti-Virus\fsqh.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.exe C:\Program Files\Shaw Secure\Common\FSM32.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Shaw Secure\FSGUI\fsguidll.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe C:\Program Files\EZ-DUB\EZ-DUB.exe C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe C:\Program Files\Shaw Secure\Anti-Virus\fssm32.exe C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe C:\Program Files\Shaw Secure\FSAUA\program\fsus.exe C:\WINDOWS\ie7\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Shaw Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\James A. Skierka\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca/news/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.cbc.ca/news/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by SHAW Internet O2 - BHO: (no name) - {69B7E8D1-3244-4E36-B38D-BE2A81B32611} - C:\WINDOWS\system32\efcBrQHA.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [shawnotify] c:\progra~1\shaw\update\siuloader.exe /notify O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Shaw Secure\Common\FSM32.exe" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Shaw Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe /P30 "EPSON Stylus Photo R220 Series" /M "Stylus Photo R220" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.exe (User 'Default user') O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: PowerReg Scheduler.exe O4 - Global Startup: PowerReg SchedulerV2.exe O4 - Global Startup: PowerReg Scheduler V3.exe O4 - Global Startup: EZ-DUB Finder.lnk = C:\Program Files\EZ-DUB\EZ-DUB.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: Win32 Classes - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win... nt/wuweb_site.cab?1219696076409 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ,lb.shawcable.net,cg.shawcable.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ,lb.shawcable.net,cg.shawcable.net O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ,lb.shawcable.net,cg.shawcable.net O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Shaw Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\Shaw Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Shaw Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Shaw Secure\Common\FSMA32.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7013 bytes baffled-cat

We need to turn of notepads "word wrap" so the logs don't get double spaced. Go to start> run> type on notepad then press emter. Click format> uncheck "word wrap" then exit notepad. Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {69B7E8D1-3244-4E36-B38D-BE2A81B32611}-C:\WINDOWS\system32\efcBrQHA.dll (file missing) O4 - Global Startup: PowerReg Scheduler.exe O4 - Global Startup: PowerReg SchedulerV2.exe O4 - Global Startup: PowerReg Scheduler V3.exe Exit Hijack this Your java is out of date and has been exploited. Download the latest version of java from this link Java Click on the JRE 6 Update 7 download button. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version. Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your Shaw Secure antivirus, and any antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

ComboFix 08-09-22.06 - James A. Skierka 2008-09-23 18:47:53.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.528 [GMT -7:00] Running from: C:\Documents and Settings\James A. Skierka\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Rb3D500.dll C:\Documents and Settings\All Users\Application Data\rbap500.dll C:\Documents and Settings\All Users\Application Data\RBInternetEncodings500.dll C:\Documents and Settings\All Users\Application Data\RBJagToolbarItem500.dll C:\Documents and Settings\All Users\Application Data\rbqt500.DLL C:\Documents and Settings\All Users\Application Data\RBRegEx500.dll C:\Documents and Settings\All Users\Application Data\RBScript500.dll C:\Documents and Settings\All Users\Application Data\RBShell500.dll C:\Documents and Settings\All Users\Application Data\RBSpriteSurface500.dll C:\Documents and Settings\All Users\Application Data\RBSSLSocket500.dll C:\Documents and Settings\James A. Skierka\Application Data\Rb3D500.dll C:\Documents and Settings\James A. Skierka\Application Data\rbap500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBInternetEncodings500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBJagToolbarItem500.dll C:\Documents and Settings\James A. Skierka\Application Data\rbqt500.DLL C:\Documents and Settings\James A. Skierka\Application Data\RBRegEx500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBScript500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBShell500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBSpriteSurface500.dll C:\Documents and Settings\James A. Skierka\Application Data\RBSSLSocket500.dll C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\test.txt C:\WINDOWS\Fonts\a.zip C:\WINDOWS\start.exe C:\WINDOWS\system32\AHQrBcfe.ini C:\WINDOWS\SYSTEM32\lcfcjawj.ini C:\WINDOWS\system32\llgpsrkt.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\yfwocbfu.dll C:\WINDOWS\Web\default.htt . ((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 ))))))))))))))))))))))))))))))) . 2008-09-23 18:39 . 2008-09-23 18:39 <DIR> d-------- C:\Program Files\Sun 2008-09-23 18:38 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2008-09-23 18:06 . 2008-09-23 18:06 <DIR> d-------- C:\Documents and Settings\James A. Skierka\.SunDownloadManager 2008-09-21 22:00 . 2008-09-21 22:00 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-21 22:00 . 2008-09-21 22:00 <DIR> d-------- C:\Documents and Settings\James A. Skierka\Application Data\Malwarebytes 2008-09-21 22:00 . 2008-09-21 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-21 22:00 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys 2008-09-21 22:00 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys 2008-09-21 13:24 . 2008-09-21 13:54 51,072 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\fsdfw.sys 2008-09-21 13:24 . 2008-09-21 13:54 30,016 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\fsndis5.sys 2008-09-18 14:46 . 2008-09-18 14:46 <DIR> d-------- C:\WINDOWS\SYSTEM32\CatRoot_bak 2008-09-18 14:45 . 2008-06-13 06:10 272,128 --------- C:\WINDOWS\SYSTEM32\DRIVERS\bthport.sys 2008-09-18 14:45 . 2008-06-13 06:10 272,128 --------- C:\WINDOWS\SYSTEM32\dllcache\bthport.sys 2008-09-18 13:12 . 2008-09-18 13:12 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-09-18 12:30 . 2008-09-18 12:30 <DIR> d-------- C:\temp\Shaw 2008-09-18 11:17 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll 2008-09-18 11:17 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\SYSTEM32\muweb.dll 2008-09-18 11:17 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll.mui 2008-09-15 21:19 . 2008-09-15 21:20 1,160 --a------ C:\WINDOWS\mozver.dat 2008-09-15 21:07 . 2008-09-15 21:07 0 --a------ C:\WINDOWS\nsreg.dat 2008-09-14 22:21 . 2008-09-14 22:21 303,104 --a------ C:\WINDOWS\SYSTEM32\ppoevogd.exe 2008-09-13 17:34 . 2008-09-13 17:34 <DIR> d-------- C:\Documents and Settings\James A. Skierka\Application Data\F-Secure 2008-09-13 17:34 . 2008-09-13 17:34 128 --a------ C:\Documents and Settings\James A. Skierka\index.exe 2008-09-13 17:27 . 2008-09-13 17:27 <DIR> d-------- C:\Program Files\Shaw Secure 2008-09-13 17:27 . 2008-09-13 17:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure 2008-09-13 17:26 . 2008-09-13 17:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\fssg 2008-09-13 16:57 . 2008-09-14 23:45 568,972 --ahs---- C:\WINDOWS\SYSTEM32\AHQrBcfe.ini2 2008-09-13 16:55 . 2008-09-13 16:55 147,456 --a------ C:\WINDOWS\SYSTEM32\vbzip10.dll 2008-09-13 16:51 . 2008-09-13 16:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\utc 2008-09-13 16:51 . 2008-09-13 16:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\mC02 2008-09-13 16:51 . 2008-09-13 16:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\gd2 2008-09-13 16:51 . 2008-09-13 16:51 <DIR> d-------- C:\WINDOWS\SYSTEM32\eaz 2008-09-13 16:51 . 2008-09-13 16:51 <DIR> d-------- C:\temp\mtc2 2008-09-13 16:51 . 2008-09-13 16:51 34,816 --------- C:\WINDOWS\SYSTEM32\ssqOIBuv.0ll 2008-09-13 16:51 . 2008-09-13 16:51 34,816 --a------ C:\WINDOWS\SYSTEM32\nnnoPGYo.0ll 2008-09-13 16:46 . 2008-09-13 16:46 <DIR> d-------- C:\Program Files\Incomplete 2008-09-12 07:48 . 2008-09-12 07:48 244 --ah----- C:\sqmnoopt03.sqm 2008-09-12 07:48 . 2008-09-12 07:48 232 --ah----- C:\sqmdata03.sqm 2008-09-09 20:49 . 2008-09-09 20:49 244 --ah----- C:\sqmnoopt02.sqm 2008-09-09 20:49 . 2008-09-09 20:49 232 --ah----- C:\sqmdata02.sqm 2008-09-02 21:56 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe 2008-09-01 18:43 . 2008-09-01 18:43 <DIR> d-------- C:\Program Files\iTunes 2008-09-01 18:39 . 2008-09-01 18:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-01 18:39 . 2008-09-01 18:39 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-01 18:38 . 2008-09-01 18:38 <DIR> d-------- C:\Program Files\Apple Software Update 2008-09-01 18:38 . 2008-07-22 20:32 32,000 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys 2008-09-01 18:37 . 2008-09-01 18:37 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-09-01 18:37 . 2008-09-01 18:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-08-29 21:15 . 2008-08-29 21:15 <DIR> d-------- C:\6692eb5e52cf65a3d033b3c0a9da1c 2008-08-25 14:23 . 2008-08-25 14:23 <DIR> d-------- C:\temp 2008-08-25 13:59 . 2008-08-25 13:59 268 --ah----- C:\sqmdata01.sqm 2008-08-25 13:59 . 2008-08-25 13:59 244 --ah----- C:\sqmnoopt01.sqm 2008-08-25 13:52 . 2008-08-25 13:52 <DIR> d-------- C:\Program Files\Java 2008-08-25 13:52 . 2008-08-25 13:52 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-25 13:47 . 2008-08-25 13:47 268 --ah----- C:\sqmdata00.sqm 2008-08-25 13:47 . 2008-08-25 13:47 244 --ah----- C:\sqmnoopt00.sqm 2008-08-25 13:33 . 2008-08-25 13:33 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRVSTORE 2008-08-25 13:33 . 2008-08-25 13:33 <DIR> d-------- C:\Documents and Settings\James A. Skierka\Contacts 2008-08-25 13:30 . 2008-08-25 13:30 <DIR> d-------- C:\Program Files\Windows Live 2008-08-25 13:30 . 2008-08-25 13:30 <DIR> d--hs---- C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-25 13:29 . 2008-08-25 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-25 13:29 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\SYSTEM32\wups2.dll 2008-08-25 13:29 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll.mui 2008-08-25 13:29 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\SYSTEM32\wuaucpl.cpl.mui 2008-08-25 13:29 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll.mui 2008-08-25 13:29 . 2008-07-18 22:08 20,680 --a------ C:\WINDOWS\SYSTEM32\wuaueng.dll.mui 2008-08-25 13:28 . 2008-08-25 13:28 <DIR> d-------- C:\Program Files\shaw 2008-08-25 12:32 . 2008-08-25 12:32 <DIR> d--hs---- C:\Documents and Settings\James A. Skierka\UserData 2008-08-25 11:42 . 2008-08-25 11:42 81,260 --a------ C:\AnalysisLog.zip 2008-08-25 10:36 . 2008-08-25 10:43 6,767 --a------ C:\WINDOWS\Active Setup Log.BAK . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-14 00:15 48,568 ----a-w C:\Documents and Settings\James A. Skierka\Application Data\GDIPFONTCACHEV1.DAT 2008-08-16 22:11 107,888 ----a-w C:\WINDOWS\SYSTEM32\CmdLineExt.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\dllcache\cdm.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\wups.dll 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wuweb.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\es.dll 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\SYSTEM32\dllcache\es.dll 2008-06-24 17:57 3,592,192 ------w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\mscms.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\SYSTEM32\dllcache\mscms.dll 2004-06-22 03:05 860,192 ---ha-r C:\Documents and Settings\James A. Skierka\USER.DAT 2004-06-22 03:00 860,192 ---ha-r C:\Documents and Settings\All Users\USER.DAT 2003-10-10 01:20 266 --sh--w C:\Program Files\desktop.ini 2003-10-10 01:20 11,079 ---h--w C:\Program Files\folder.htt 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\atskpa.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\avixep.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\xepods.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\olegva.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\nietars.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\kdbjpg.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\ndsstd.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\entshare.dll 2008-09-15 05:40 299,008 ----a-w C:\Program Files\internet explorer\plugins\corelan.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\abkacc.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\mgilid.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\dokgi.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\rqcndrb.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\r.dll 2008-09-15 05:41 299,008 ----a-w C:\Program Files\internet explorer\plugins\hbg.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay] @="{7D688A77-C613-11D0-999B-00C04FD655E1}" [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}] 2004-08-04 12:00 8384000 --a------ C:\WINDOWS\SYSTEM32\SHELL32.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-08 98304] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "shawnotify"="c:\progra~1\shaw\update\siuloader.exe" [2007-06-18 370216] "F-Secure Manager"="C:\Program Files\Shaw Secure\Common\FSM32.exe" [2007-04-26 176177] "F-Secure TNB"="C:\Program Files\Shaw Secure\FSGUI\TNBUtil.exe" [2007-04-26 733184] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.exe" [2004-08-04 15360] C:\Documents and Settings\James A. Skierka\Start Menu\Programs\Startup\ Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-03-09 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.VDOM"= vdowave.drv "midi2"= usbmn1x1.dll "midi3"= usbmn1x1.dll "midi4"= usbmn1x1.dll "midi6"= usbmn1x1.dll "midi7"= usbmn1x1.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "SiS KHooker"=C:\WINDOWS\SYSTEM32\KHOOKER.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "CreateCD50"="C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r "AdaptecDirectCD"="C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" "QuickTime Task"="C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime "Omnipage"=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.exe "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot "POINTER"=point32.exe "MediaFace Integration"=C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"= "C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Infogrames Interactive\\Civilization III\\Conquests\\Civ3Conquests.exe"= "C:\\WINDOWS\\System32\\dpnsvr.exe"= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-09-21 51072] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\Shaw Secure\HIPS\fshs.sys [2008-09-21 41184] R1 SSHDRV76;SSHDRV76;C:\WINDOWS\system32\drivers\SSHDRV76.sys [2005-07-23 53760] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\Shaw Secure\Anti-Virus\minifilter\fsgk.sys [2007-04-26 52736] S3 jbridgep;jbridgep;C:\DOCUME~1\JAMESA~1.SKI\LOCALS~1\Temp\jbridgep.sys [ ] S3 USB11LDR;USB Midi 1x1 Loader;C:\WINDOWS\system32\drivers\usb11ldr.sys [2005-06-21 13504] S3 USBMN1X1;USB Midi 1x1;C:\WINDOWS\system32\drivers\usbmn1x1.sys [2005-06-21 22272] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\Shaw Secure\Anti-Virus\Win2K\FSfilter.sys [2007-04-26 33024] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\Shaw Secure\Anti-Virus\Win2K\FSrec.sys [2007-04-26 18432] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\MmoptPreferredAudioDevices] rundll32.exe shell32.dll,Control_RunDLL mmsys.cpl,@0,SUSB\VID_054C&PID_0045&MI_01\1USB&VID_054C&PID_0045&INST_0 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:WIN9X /user /install "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{4CAFAF0C-C38F-43C1-8080-390E776254DE} - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\James A. Skierka\Application Data\Mozilla\Firefox\Profiles\xx0na7ea.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.cbc.ca/news/ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-23 18:51:27 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll . Completion time: 2008-09-23 18:52:25 ComboFix-quarantined-files.txt 2008-09-24 01:52:24 Pre-Run: 1,692,958,720 bytes free Post-Run: 2,017,361,920 bytes free 272 --- E O F --- 2008-09-21 02:44:28 baffled-cat

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: C:\WINDOWS\SYSTEM32\AHQrBcfe.ini2 C:\WINDOWS\SYSTEM32\ssqOIBuv.0ll C:\WINDOWS\SYSTEM32\nnnoPGYo.0ll C:\sqmnoopt03.sqm C:\sqmdata03.sqm C:\sqmnoopt02.sqm C:\sqmdata02.sqm C:\sqmdata01.sqm C:\sqmnoopt01.sqm C:\sqmdata00.sqm C:\sqmnoopt00.sqm Folder:: C:\WINDOWS\SYSTEM32\utc C:\WINDOWS\SYSTEM32\mC02 C:\WINDOWS\SYSTEM32\gd2 C:\WINDOWS\SYSTEM32\eaz C:\temp\mtc2 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Post a new Combofix log following the directions in response # 4.