Right click the start button> properties> customize> advanced> scroll down and check "run command" and "search"> ok. See if that retores the run feature.

0

Nope, still doesn't show up.

0

See if this scanner will run. Please download Deckard’s Syatem Scanner (dss): Copy the following bolded address into your browser. http://www.techsupportforum.com/sec... Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

0

I got Run up (hadn't actually gone was just invisible) but I got "This application has failed to start because the application configiration is incorrect. Reinstalling the application may fix this problem" error for all three, as well as for the dss.exe.

0

One more try. Please download Navilog1 by IL-MAFIOSO: http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip Extract its contents to the desktop. Double click on navilog1.exe to install it on your computer. When the installation is complete, the tool will start automatically. If it doesn't start automatically, please double click on Navilog1 shortcut on your desktop to run it. Press E for English from the language Menu. Type 1 in the next Menu to select Search and press Enter. Wait for the Scan to finish (It may take a reasonable amount of time) Press any key as requested . A new document will be produced: fixnavi.txt. Please copy/paste the contents of this report in your next reply. The report is also saved in the root of the directory, "%SystemDrive%\fixnavi.txt". (usually C:\fixnavi.txt)

0

Nope, nothing :-( The same error as before, that I get with 90% of anything I try to open. My brother is coming round tomorrow to have a look at it, but failing that, is there anything else I can do? I've had it suggested that I copy all my documents and things I need to a different disc drive, and then format my C drive.

0

Maybe a little maunual work will help. It is a good idea to save "My Documents". Go to start> control panel> administrative tools> services> scroll down to "Microsoft cache control" may be called "MSControlService " and double click it. Click the blue drop down arrow to the far right of "startup type"> click disable> apply> ok. Exit administrative tools. Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked": F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\rxjddnvj.exe, O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Program Files\iMesh\iMesh5\iMeshBHO.dll O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {D21A69D5-2487-415A-99B6-5859E4FA774B} - C:\WINDOWS\system32\vturp.dll (file missing) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: (no name) - {E180F496-8A4B-44E2-9FE0-0364E345DB7F} - C:\WINDOWS\system32\gebbxvv.dll (file missing) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file) O2 - BHO: (no name) - {ef697142-1dd1-11b2-946d-ef1f7a5c3666} - C:\WINDOWS\uvwjcngx.dll O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-ABCD-7DD20B8622FF} - C:\Program Files\Helper\1202660781.dll (file missing) O4 - HKLM\..\Run: [ldpnleysu] c:\windows\system32\ldpnleysu.exe ldpnleysu O4 - HKLM\..\Run: [qnwdmpif] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\qnwdmpif.dll" O4 - HKLM\..\Run: [drmsrv32] C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\452c4a4hpc4a4b.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing) O20 - Winlogon Notify: gebbxvv - gebbxvv.dll (file missing) O21 - SSODL: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll (file missing) O22 - SharedTaskScheduler: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll (file missing) O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing) Exit Hijack This. Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Set up the computer to view hidden files: To show hidden files do the following: Click Start > My Computer On the Tools menu, click Folder Options. Click the View tab. Uncheck Hide file extensions for known file types. Uncheck Hide protected operating system files. Under the Hidden files folder, locate and check Show hidden files and folders. If you see a warning message, click Yes. Click Apply > OK. From safe mode navigate to and delete these files if found: C:\WINDOWS\system32\rxjddnvj.exe C:\WINDOWS\system32\vturp.dll C:\WINDOWS\system32\gebbxvv.dll C:\WINDOWS\uvwjcngx.dll C:\Program Files\Helper\1202660781.dll c:\windows\system32\ldpnleysu.exe C:\Documents and Settings\All Users\Application Data\qnwdmpif.dll C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\452c4a4hpc4a4b.exe C:\WINDOWS\system32\tazth.dll Restart the computer and try to run Navifix.

0

I still can't get into "Services" Can I do the HiJack This thing without doing that first bit?

0

Yes, try without going into services.

0

Still nothing. There are a couple more things in HiJack This with "Files missing"....were they missed on purpose or wouldn't it help to get rid of those as well

0

Formatted C Drive and re-installed Windows. Working fine now but haven't put E drive back in....anything I can do to stop the virus coming back again if it was somewhere on my E Drive? (Which I don't think it was, I only copied my documents over from C to E)

0

Your java is out of date and can be exploited. Download the latest version of java from this link Java Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

Thanks a lot. And thanks for all the help trying to sort my comp out, even if it didn't work, I appriciate it.

0

Thanks for the follow-up Stephaniec uk.

0

Hi jabuck, Im having red cross infront of my C drive.I went through the procedures which you said.I ran Vundo.Removed all teh files. Then ran HijackThis.Please see the log file of teh same ********************** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:41:22 PM, on 2/20/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\nilabh\Desktop\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://localhost:9100/proxy.pac O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {12e8c553-ea9a-4455-8a68-81aded89160a} - C:\WINDOWS\system32\tvsvevs.dll O2 - BHO: RabioBHO - {1C2E5D27-A17C-4D89-85DD-3553C189380D} - C:\Program Files\RABCO\RABCO.dll O2 - BHO: {e9806956-02e2-4e88-a5f4-641093924e92} - {29e42939-0146-4f5a-88e4-2e206596089e} - C:\WINDOWS\system32\oigwrupf.dll (file missing) O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll O2 - BHO: (no name) - {6FB539C7-D6A0-4DB3-9A5F-31164B482A73} - C:\Program Files\NetMeeting\komexo89104.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {E0EA1F31-B58F-47E8-A185-20C52DF9F168} - C:\WINDOWS\system32\ljjjjjk.dll O2 - BHO: (no name) - {EA51BCB9-9DEF-4AEF-B8A5-4CA52897BFA2} - C:\WINDOWS\system32\geedd.dll (file missing) O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [SifyBB] C:\Program Files\Sify Broadband\BBImpSec.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - Global Startup: NetScreen-Remote.lnk = C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{E471CFB5-48C7-4719-8178-9EB238CC8132}: NameServer = 202.144.13.50,202.144.66.6 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 7327 bytes *********************************** Then I ran combofix.Please see teh logfile for the same ************************ ComboFix 08-02-20.2 - nilabh 2008-02-20 14:47:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.198 [GMT 5.5:30] Running from: C:\Documents and Settings\nilabh\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\NetMeeting\komexo89104.dll C:\Program Files\Temporary C:\Program Files\Temporary\kernInst.exe C:\Program Files\web buying C:\Program Files\web buying\v1.8.8\wbuninst.exe C:\Program Files\web buying\v1.8.8\webbuying.exe C:\Temp\1cb C:\Temp\1cb\syscheck.log C:\Temp\isgTi19 C:\Temp\isgTi19\lPig.log C:\temp\tn3 C:\WINDOWS\b122.exe C:\WINDOWS\Fonts\a.zip C:\WINDOWS\mrofinu1188.exe C:\WINDOWS\system32\ac1 C:\WINDOWS\system32\ac1\liamdll2.exe C:\WINDOWS\system32\atmtd.dll.tmp C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\ljjjjjk.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\nGpxx18 C:\WINDOWS\system32\nGpxx18\nGpxx182328.exe C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\tvsvevs.dll C:\WINDOWS\Fonts\' . ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-20 14:15 . 2008-02-20 14:37 <DIR> d-------- C:\VundoFix Backups 2008-02-15 06:39 . 2008-02-16 16:13 1,235,581 ---hs---- C:\WINDOWS\system32\uqbiexbx.ini 2008-02-13 00:33 . 2008-02-15 06:37 1,235,401 ---hs---- C:\WINDOWS\system32\htwtbfpy.ini 2008-02-12 08:30 . 2008-01-12 18:32 23,904 --a------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-02-12 08:30 . 2008-01-15 09:54 10,537 --a------ C:\WINDOWS\system32\drivers\COH_Mon.cat 2008-02-12 08:30 . 2008-01-15 05:28 706 --a------ C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-02-10 13:19 . 2008-02-10 13:20 <DIR> d-------- C:\Program Files\MB Free Janam Kundali 2008-02-10 13:19 . 2000-07-17 09:20 185,856 --a------ C:\WINDOWS\system32\Bmp2Jpeg.dll 2008-02-10 13:19 . 1999-05-07 00:00 140,288 --a------ C:\WINDOWS\system32\Comdlg32.ocx 2008-02-09 21:30 . 2008-02-12 00:24 1,221,730 ---hs---- C:\WINDOWS\system32\drebldkw.ini 2008-02-09 02:39 . 2008-02-09 02:39 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-02-09 02:39 . 2008-02-09 02:39 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-02-09 02:15 . 2008-02-09 02:16 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-02-09 01:51 . 2008-02-09 01:51 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-02-09 01:51 . 2008-02-09 02:04 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-02-09 01:49 . 2008-02-09 01:58 <DIR> d-------- C:\bb4b4773182ee03a3ba88dae 2008-02-08 21:21 . 2008-02-09 21:22 1,220,890 ---hs---- C:\WINDOWS\system32\xdbmwkwo.ini 2008-02-08 21:16 . 2008-02-09 23:47 <DIR> d-------- C:\Program Files\Drmupgds 2008-02-08 21:16 . 2008-02-08 21:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio 2008-02-08 21:16 . 2008-02-08 21:16 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-02-08 21:15 . 2008-02-08 21:17 <DIR> d-------- C:\Program Files\RABCO 2008-02-08 21:13 . 2008-02-08 21:13 <DIR> d-------- C:\WINDOWS\system32\za7 2008-02-08 21:13 . 2008-02-08 21:13 <DIR> d-------- C:\WINDOWS\system32\wd11 2008-02-08 21:13 . 2008-02-09 03:06 <DIR> d-------- C:\WINDOWS\system32\mv3 2008-02-08 21:13 . 2008-02-08 21:13 <DIR> d-------- C:\WINDOWS\system32\kp9 2008-02-08 21:06 . 2008-02-08 21:06 <DIR> d-------- C:\Program Files\LimeWire 2008-02-08 20:51 . 2008-02-13 05:40 <DIR> d-------- C:\Documents and Settings\nilabh\.limewire 2008-02-07 22:33 . 2008-02-08 20:27 <DIR> d-------- C:\Program Files\Sify Broadband 2008-02-07 22:21 . 2008-02-18 23:59 <DIR> d-------- C:\Documents and Settings\nilabh\Application Data\Broadband 2008-02-07 22:21 . 2008-02-10 12:19 300 --a------ C:\deb.sbl 2008-02-07 22:19 . 2008-02-07 22:33 108 --a------ C:\bberror1.sbl . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-18 10:20 --------- d-----w C:\Documents and Settings\nilabh\Application Data\Skype 2008-02-18 09:04 3,137,024 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp 2008-02-16 10:59 1,491,968 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp 2008-02-15 02:50 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-02-15 02:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-02-13 13:12 2,886,656 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp 2008-02-12 17:52 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-02-12 02:57 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-02-12 02:57 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-02-12 02:57 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-02-12 02:57 --------- d-----w C:\Program Files\Symantec 2008-02-09 21:03 --------- d-----w C:\Program Files\DivX 2008-02-08 15:46 278,554 ----a-w C:\WINDOWS\Fonts\Setup.exe 2008-01-25 11:15 --------- d-----w C:\Documents and Settings\nilabh\Application Data\webex 2008-01-13 13:30 --------- d-----w C:\Program Files\3GP Player 2008-01-08 07:17 --------- d-----w C:\Program Files\Shutterfly 2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-11-17 16:43 121,344 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2007-11-17 16:43 1,412,096 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2007-11-06 11:54 1,001,984 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2007-10-27 10:47 20,293,623 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_10_27_13_48_12_full.dmp.zip 2007-10-01 08:28 20,266,872 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_10_01_09_41_27_full.dmp.zip 2007-08-10 04:11 17,590,002 ----a-w C:\WINDOWS\Internet Logs\vsmon_on_demand_2007_08_10_09_38_44_full.dmp.zip . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C2E5D27-A17C-4D89-85DD-3553C189380D}] 2008-01-30 14:02 414992 --a------ C:\Program Files\RABCO\RABCO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29e42939-0146-4f5a-88e4-2e206596089e}] C:\WINDOWS\system32\oigwrupf.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA51BCB9-9DEF-4AEF-B8A5-4CA52897BFA2}] C:\WINDOWS\system32\geedd.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SifyBB"="C:\Program Files\Sify Broadband\BBImpSec.exe" [2006-04-21 20:04 127085] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-01 18:11 4670968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-12 14:17 185896] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ NetScreen-Remote.lnk - C:\Program Files\Juniper\NetScreen-Remote\SafeCfg.exe [2007-11-21 22:45:37 73780] Run Google Web Accelerator.lnk - C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe [2007-07-09 22:24:38 1134592] [HKLM\~\startupfolder\C:^Documents and Settings^nilabh^Start Menu^Programs^Startup^RABCO - Auto Update.lnk] path=C:\Documents and Settings\nilabh\Start Menu\Programs\Startup\RABCO - Auto Update.lnk backup=C:\WINDOWS\pss\RABCO - Auto Update.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\90edf268] C:\WINDOWS\system32\dwdcbjfu.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] -ra------ 2005-10-07 14:13 176128 C:\Program Files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 15:30 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2006-11-01 12:48 1392640 C:\WINDOWS\system32\WLTRAY.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] --a------ 2007-01-09 22:59 115816 C:\Program Files\Common Files\Symantec Shared\ccApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 15:30 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] --a------ 2007-01-02 02:52 3739648 C:\Program Files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-09-13 15:49 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2006-10-18 17:58 696320 C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig] --a------ 2006-10-18 18:04 802816 C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 21:54 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\osCheck] --a------ 2006-09-06 07:52 26248 C:\Program Files\Norton AntiVirus\osCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SifyBB] --a------ 2006-04-21 20:04 127085 C:\Program Files\Sify Broadband\BBImpSec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] --a------ 2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2007-07-12 14:17 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX] --a------ 2006-10-06 10:14 53248 C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying] C:\Program Files\Web Buying\v1.8.8\webbuying.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-03-01 18:11 4670968 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client] --a------ 2007-03-09 01:02 919280 C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "wltrysvc"=2 (0x2) "Symantec Core LC"=3 (0x3) "SSScsiSV"=3 (0x3) "SPTISRV"=3 (0x3) "SonicStage Back-End Service"=3 (0x3) "Pml Driver HPZ12"=2 (0x2) "PACSPTISVR"=3 (0x3) "odserv"=3 (0x3) "MSCSPTISRV"=3 (0x3) R1 IPSECDRV;SafeNet IPSec Plugin;C:\WINDOWS\system32\Drivers\IPSECDRV.sys [2006-02-01 11:38] R2 Crypto;Crypto;C:\WINDOWS\system32\Drivers\Crypto.sys [2005-08-15 08:27] R3 DniVap;SafeNet WAN Miniport (VA);C:\WINDOWS\system32\DRIVERS\vap.sys [2001-12-14 15:26] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d401b0c-8936-11dc-b067-0019b97196a8}] \Shell\Open(&O)\command - RECYCLED\appmgmt.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ee44f4e-4836-11dc-afd8-0019b97196a8}] \Shell\Auto\command - boot.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL boot.exe . Contents of the 'Scheduled Tasks' folder "2008-01-11 14:30:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - nilabh.job" - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 14:53:59 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Juniper\NetScreen-Remote\IPSecMon.exe C:\Program Files\Juniper\NetScreen-Remote\IreIKE.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-02-20 14:55:26 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-20 09:25:22 . 2008-02-16 10:46:50 --- E O F --- *************************** Please help me what should I do now.

0

nilabh, yes you are still infected. But you must start your own thread so that we can find you to respond to your post. And on this forum you can not post any logs until a helper request them. So only state your problem when you start your new thread(post).

0

jabuck, I am not a member here but found the page searching for information on the red X on my C: drive. I had a terrible, multiple element infection about a month ago. Took me 3 wks and get Vundo off my machine and be able to delete the 27,000 posxxx files it had generated. I used multiple scans for SpySweeper and AVG Spyware 7.5 along with McAfee AntiVirus. Had multiple trojans and several other viruses all at once. What a mess. Not sure that some of my drivers aren't ruined etc. Anyway, the pc seems to be working normally now except for the red X - I have HiJackThis and ran a scan once. Have Win XP Home Edition with SP 2 - can you help me make sure all is well and to remove the red X? I appreciate your expertise. skip in delaware PS had my email address hijacked around the same time - very annoying - getting junk mail from myself. Anything that I can do to get the hijacker?

0