ComboFix 08-02.05.3 - James t Mott 2008-02-07 21:58:22.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.550 [GMT -5:00] Running from: C:\Documents and Settings\James t Mott\My Documents\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\ScreenSaver\Images\[u]0[/u]03F75AA.urr C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\MyWebSearch\bar\Settings\setting2.htm C:\Program Files\MyWebSearch\bar\Settings\settings.dat ----- BITS: Possible infected sites ----- hxxp://www.download.windowsupdate.com . ((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 ))))))))))))))))))))))))))))))) . 2008-02-07 20:53 . 2008-02-07 21:37 2,266 --a------ C:\WINDOWS\system32\tmp.reg 2008-02-07 20:38 . 2008-02-07 20:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-07 20:38 . 2008-02-07 20:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-07 20:38 . 2008-02-07 20:38 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-07 20:38 . 2008-02-07 20:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-07 20:38 . 2008-02-07 20:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-02-07 19:02 . 2008-02-07 19:03 <DIR> d-------- C:\Program Files\XoftSpySE 2008-02-06 12:03 . 2008-02-06 12:03 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Webroot 2008-02-01 20:38 . 2008-02-01 20:40 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ErrorSmart 2008-02-01 20:37 . 2008-02-04 20:50 <DIR> d-------- C:\Program Files\ErrorSmart 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Program Files\Uniblue 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Uniblue 2008-02-01 19:00 . 2008-02-01 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix 2008-02-01 18:54 . 2008-02-01 18:54 61,480 --a------ C:\Documents and Settings\James t Mott\GoToAssistDownloadHelper.exe 2008-02-01 18:47 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\McAfee 2008-02-01 12:31 . 2008-02-04 21:41 <DIR> d-------- C:\Program Files\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 12:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 18:30 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-04 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-07 22:02 6,823 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-01 12:29 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-01 12:27 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-01 12:27 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-01 12:27 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-01 12:27 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-01 10:10 . 2007-01-02 18:16 86,848 --a------ C:\WINDOWS\system32\drivers\WscNetDr.sys 2008-02-01 10:09 . 2008-02-01 10:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-01 10:08 . 2008-02-07 12:24 <DIR> d-------- C:\Program Files\McAfee 2008-02-01 10:08 . 2008-02-01 12:27 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-02-01 10:08 . 2008-02-01 10:08 2 --a------ C:\WINDOWS\msoffice.ini 2008-02-01 10:02 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-02-01 09:08 . 2008-02-01 11:23 <DIR> d-------- C:\Program Files\NoAdware5.0 2008-01-31 14:48 . 2008-01-31 14:48 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ICAClient 2008-01-30 20:51 . 2008-01-30 20:51 <DIR> d-------- C:\WINDOWS\system32\bak 2008-01-30 20:51 . 2008-01-30 20:51 <DIR> d-------- C:\WINDOWS\bak 2008-01-30 16:39 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-01-30 10:48 . 2008-01-31 14:56 <DIR> d-------- C:\Program Files\Elements 2008-01-25 10:05 . 2008-01-30 16:14 <DIR> d-------- C:\Program Files\SpongeBob Atlantis SquareOff 2008-01-25 08:51 . 2008-01-25 09:27 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\CaribbeanHideaway 2008-01-23 10:48 . 2008-01-23 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2008-01-13 13:48 . 2008-01-14 14:36 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\BloodTies 2008-01-13 13:42 . 2008-01-13 13:43 <DIR> d-------- C:\Program Files\Blood Ties 2008-01-11 20:08 . 2008-01-11 20:08 <DIR> d-------- C:\WINDOWS\Volvo Wheel Loader L220E dir 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Valusoft 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Valusoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-08 00:00 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\MSN6 2008-02-05 01:50 --------- d-----w C:\Program Files\Microsoft Location Finder 2008-02-05 01:50 --------- d-----w C:\Program Files\DellSupport 2008-02-04 23:39 --------- d-----w C:\Program Files\Zune 2008-02-04 23:38 --------- d-----w C:\Program Files\Dl_cats 2008-02-04 23:36 --------- d-----w C:\Program Files\Verizon 2008-02-04 23:23 --------- d-----w C:\Program Files\Dell Photo AIO Printer 924 2008-02-01 17:03 --------- d-----w C:\Program Files\MSN Messenger 2008-02-01 16:55 454 ----a-w C:\Program Files\Shortcut to Kudos.lnk 2008-02-01 16:27 --------- d-----w C:\Program Files\WildTangent 2008-02-01 16:24 --------- d-----w C:\Program Files\QuickTime 2008-02-01 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-02-01 16:23 --------- d-----w C:\Program Files\NetWaiting 2008-02-01 16:21 --------- d-----w C:\Program Files\MUSICMATCH 2008-02-01 16:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-02-01 15:09 --------- d-----w C:\Program Files\Common Files\AOL 2008-02-01 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-01-30 15:48 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-15 16:12 --------- d-----w C:\Program Files\Oberon Media 2008-01-15 16:11 --------- d-----w C:\Program Files\Verizon Online 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Big Fish Games 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Big Fish Games 2008-01-12 01:08 12,288 ----a-w C:\WINDOWS\impborl.dll 2008-01-12 00:40 --------- d-----w C:\Program Files\Mystery Case Files - Madame Fate 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\PlayFirst 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-01-07 15:09 --------- d-----w C:\Program Files\Fatal Hearts 2008-01-06 20:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\EA 2008-01-04 15:25 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Teggo 2008-01-03 19:27 --------- d-----w C:\Program Files\Fairway Solitaire 2008-01-03 19:03 --------- d-----w C:\Program Files\Google 2008-01-03 15:18 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Bloom 2007-12-25 14:25 --------- d-----w C:\Program Files\Linkit - A Christmas Carol 2007-12-25 14:25 --------- d-----w C:\Program Files\Home Sweet Home 2007-12-25 14:25 --------- d-----w C:\Program Files\Aquitania 2007-12-25 14:24 --------- d-----w C:\Program Files\Super Granny 4 2007-12-25 14:24 --------- d-----w C:\Program Files\Dream Day First Home 2007-12-20 15:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2007-12-18 19:39 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Home Sweet Home 2007-12-17 19:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Awem 2007-12-12 22:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Gogii 2007-11-03 00:11 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-11-04 18:23 251 -c--a-w C:\Program Files\wt3d.ini 2006-12-02 17:04 88 -csh--r C:\WINDOWS\system32\6A3897255A.sys 2006-12-02 17:04 3,766 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 135,168 2007-11-13 21:46:00 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\bak\TransferAgent.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe ----a-w 81,920 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe ----a-w 249,856 2005-06-10 15:44:02 C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe ----a-w 50,688 2003-09-14 01:36:52 C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe ----a-w 185,896 2006-12-02 22:52:48 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe ----a-w 430,080 2005-10-21 00:40:26 C:\Program Files\Dell Photo AIO Printer 924\bak\dlccmon.exe ----a-w 460,784 2007-03-15 15:09:36 C:\Program Files\DellSupport\bak\DSAgnt.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\DellSupport\DSAgnt.exe ----a-w 18,244,856 2007-10-25 20:11:24 C:\Program Files\ErrorSmart\bak\ErrorSmart.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\ErrorSmart\ErrorSmart.exe ----a-w 602,182 2005-12-28 16:56:16 C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe ----a-w 667,718 2005-12-28 16:55:40 C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe ----a-w 132,496 2007-09-25 06:11:35 C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe ----a-w 20,480 2007-01-08 16:22:46 C:\Program Files\McAfee\MBK\bak\LogOnHook.exe ----a-w 20,480 2007-01-08 16:22:46 C:\Program Files\McAfee\MBK\LogonHook.exe ----a-w 4,838,952 2007-01-16 18:59:50 C:\Program Files\McAfee\MBK\bak\McAfeeDataBackup.exe ----a-w 4,838,952 2007-01-16 18:59:50 C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe ----a-w 1,160,480 2007-07-23 01:29:58 C:\Program Files\McAfee\MHN\bak\McENUI.exe ----a-w 1,160,480 2007-07-23 01:29:58 C:\Program Files\McAfee\MHN\McENUI.exe ----a-w 206,184 2007-07-28 14:32:50 C:\Program Files\McAfee\MWL\bak\MWLGuiSt.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\McAfee\MWL\MWLGuiSt.exe ----a-w 582,992 2007-08-04 03:33:14 C:\Program Files\McAfee.com\Agent\bak\mcagent.exe ----a-w 582,992 2007-08-04 03:33:14 C:\Program Files\McAfee.com\Agent\mcagent.exe ----a-w 101,080 2005-08-24 22:25:00 C:\Program Files\Microsoft Location Finder\bak\LocationFinder.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\Microsoft Location Finder\LocationFinder.exe ----a-w 20,480 2003-09-10 07:24:00 C:\Program Files\NetWaiting\bak\netWaiting.exe ----a-w 282,624 2006-10-25 23:58:18 C:\Program Files\QuickTime\bak\qttask.exe ----a-w 36,640 2007-08-24 21:57:48 C:\Program Files\SiteAdvisor\6253\bak\SiteAdv.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\SiteAdvisor\6253\SiteAdv.exe ----a-w 761,947 2006-03-08 16:48:02 C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe ----a-w 823,362 2005-08-30 14:47:38 C:\Program Files\Trend Micro\Internet Security 12\bak\pccguide.exe ----a-w 176,201 2006-04-11 23:39:22 C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\bak\TMAS_OEMon.exe ----a-w 1,885,464 2007-12-05 20:51:10 C:\Program Files\Uniblue\RegistryBooster 2\bak\RegistryBooster.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe ----a-w 936,960 2007-06-06 23:52:16 C:\Program Files\Verizon\bak\McciTrayApp.exe ----a-w 4,670,968 2007-03-01 22:11:26 C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.exe ----a-w 14,860 2008-02-05 01:48:16 C:\Program Files\Yahoo!\Messenger\YAHOOM~1.exe ----a-w 166,304 2007-11-16 02:51:56 C:\Program Files\Zune\bak\ZuneLauncher.exe ----a-w 262,144 2006-11-29 20:28:54 C:\WINDOWS\bak\tsnpstd3.exe ----a-w 843,776 2006-09-18 18:12:12 C:\WINDOWS\bak\vsnpstd3.exe ----a-w 67,584 2005-09-29 19:01:14 C:\WINDOWS\ehome\bak\ehtray.exe ----a-w 15,360 2004-08-10 10:00:00 C:\WINDOWS\system32\bak\ctfmon.exe ----a-w 15,360 2004-08-10 10:00:00 C:\WINDOWS\system32\ctfmon.exe ----a-w 77,824 2005-12-13 21:41:08 C:\WINDOWS\system32\bak\hkcmd.exe ----a-w 118,784 2005-12-13 21:45:00 C:\WINDOWS\system32\bak\igfxpers.exe ----a-w 98,304 2005-12-13 21:44:18 C:\WINDOWS\system32\bak\igfxtray.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00 15360] "Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2008-02-04 20:48 14860] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2008-02-04 20:48 14860] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2008-02-04 20:48 14860] "DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2008-02-04 20:48 14860] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2008-02-04 20:48 14860] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe] "DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 17:50 73728] "MWLExe"="C:\PROGRA~1\Mcafee\MWL\MWLGuiSt.exe" [2008-02-04 20:48 14860] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2008-02-04 20:48 14860] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-07-22 20:29 1160480] "ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [2008-02-04 20:48 14860] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480] C:\Documents and Settings\Tracy Mott\Start Menu\Programs\Startup\ VZAccess Manager.lnk - C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2006-08-28 18:42:25 1273856] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 21:38] R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2007-11-15 21:51] R3 NWADI;NWADI Bus Enumerator;C:\WINDOWS\system32\DRIVERS\NWADIenum.sys [2006-01-06 10:16] S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2007-11-15 21:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe . Contents of the 'Scheduled Tasks' folder "2008-02-02 01:38:12 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job" - C:\Program Files\ErrorSmart\ErrorSmart.ex - C:\Program Files\ErrorSmart "2008-02-01 15:09:53 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2008-02-01 15:09:51 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-02-08 03:03:27 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-02-08 00:02:28 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-07 22:04:13 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Mcafee\MWL\MwlGui.exe C:\Program Files\Mcafee\MWL\MwlSvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Internet Explorer\IEXPLORE.exe . ************************************************************************** . Completion time: 2008-02-07 22:09:34 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-08 03:09:29 . 2008-02-01 02:07:14 --- E O F ---

0

Looks better. Combofix exposed another baddie. Please download FindAWF from the following link: http://noahdfear.geekstogo.com/FindAWF.exe Double-click on the FindAWF.exe file to run it. It will open a command prompt and ask you to "Press any key to continue". You will be presented with a Menu. 1. Press 1 then Enter to scan for bak folders 2. Press 2 then Enter to restore files from bak folders 3. Press 3 then Enter to remove bak folders 4. Press 4 then Enter to reset domain zones 5. Press E then Enter to EXIT Press 1 then press Enter. Copy and paste the contents of the AWF.txt file in your next reply.

0

Find AWF report by noahdfear ©2006 Version 1.40 The current date is: Thu 02/07/2008 The current time is: 22:37:35.28 bak folders found ~~~~~~~~~~~ Directory of C:\WINDOWS\BAK 11/29/2006 03:28 PM 262,144 tsnpstd3.exe 09/18/2006 01:12 PM 843,776 vsnpstd3.exe 2 File(s) 1,105,920 bytes Directory of C:\PROGRA~1\DELLPH~1\BAK 10/20/2005 07:40 PM 430,080 dlccmon.exe 1 File(s) 430,080 bytes Directory of C:\PROGRA~1\DELLSU~1\BAK 03/15/2007 10:09 AM 460,784 DSAgnt.exe 1 File(s) 460,784 bytes Directory of C:\PROGRA~1\ERRORS~1\BAK 10/25/2007 03:11 PM 18,244,856 ErrorSmart.exe 1 File(s) 18,244,856 bytes Directory of C:\PROGRA~1\MI0A1E~1\BAK 08/24/2005 05:25 PM 101,080 LocationFinder.exe 1 File(s) 101,080 bytes Directory of C:\PROGRA~1\NETWAI~1\BAK 09/10/2003 02:24 AM 20,480 netWaiting.exe 1 File(s) 20,480 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 06:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\VERIZON\BAK 06/06/2007 06:52 PM 936,960 McciTrayApp.exe 1 File(s) 936,960 bytes Directory of C:\PROGRA~1\ZUNE\BAK 11/15/2007 09:51 PM 166,304 ZuneLauncher.exe 1 File(s) 166,304 bytes Directory of C:\WINDOWS\EHOME\BAK 09/29/2005 02:01 PM 67,584 ehtray.exe 1 File(s) 67,584 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/10/2004 05:00 AM 15,360 ctfmon.exe 12/13/2005 04:41 PM 77,824 hkcmd.exe 12/13/2005 04:45 PM 118,784 igfxpers.exe 12/13/2005 04:44 PM 98,304 igfxtray.exe 4 File(s) 310,272 bytes Directory of C:\PROGRA~1\MCAFEE\MBK\BAK 01/08/2007 11:22 AM 20,480 LogOnHook.exe 01/16/2007 01:59 PM 4,838,952 McAfeeDataBackup.exe 2 File(s) 4,859,432 bytes Directory of C:\PROGRA~1\MCAFEE\MHN\BAK 07/22/2007 08:29 PM 1,160,480 McENUI.exe 1 File(s) 1,160,480 bytes Directory of C:\PROGRA~1\MCAFEE\MWL\BAK 07/28/2007 09:32 AM 206,184 MWLGuiSt.exe 1 File(s) 206,184 bytes Directory of C:\PROGRA~1\MCAFEE.COM\AGENT\BAK 08/03/2007 10:33 PM 582,992 mcagent.exe 1 File(s) 582,992 bytes Directory of C:\PROGRA~1\SITEAD~1\6253\BAK 08/24/2007 04:57 PM 36,640 SiteAdv.exe 1 File(s) 36,640 bytes Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK 03/08/2006 11:48 AM 761,947 SynTPEnh.exe 1 File(s) 761,947 bytes Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\BAK 08/30/2005 09:47 AM 823,362 pccguide.exe 1 File(s) 823,362 bytes Directory of C:\PROGRA~1\UNIBLUE\REGIST~1\BAK 12/05/2007 03:51 PM 1,885,464 RegistryBooster.exe 1 File(s) 1,885,464 bytes Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK 03/01/2007 05:11 PM 4,670,968 YAHOOM~1.exe 1 File(s) 4,670,968 bytes Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK 06/10/2005 10:44 AM 81,920 issch.exe 06/10/2005 10:44 AM 249,856 isuspm.exe 2 File(s) 331,776 bytes Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK 09/13/2003 08:36 PM 50,688 WkUFind.exe 1 File(s) 50,688 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 12/02/2006 05:52 PM 185,896 realsched.exe 1 File(s) 185,896 bytes Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK 12/28/2005 11:56 AM 602,182 ifrmewrk.exe 12/28/2005 11:55 AM 667,718 ZCfgSvc.exe 2 File(s) 1,269,900 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 09/25/2007 01:11 AM 132,496 jusched.exe 1 File(s) 132,496 bytes Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\TMAS_OE\BAK 04/11/2006 06:39 PM 176,201 TMAS_OEMon.exe 1 File(s) 176,201 bytes Directory of C:\DOCUME~1\ALLUSE~1\APPLIC~1\DELL\TRANSF~1\BAK 11/13/2007 04:46 PM 135,168 TransferAgent.exe 1 File(s) 135,168 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 262144 Nov 29 2006 "C:\WINDOWS\bak\tsnpstd3.exe" 262144 Nov 29 2006 "C:\Program Files\Common Files\EZVGACam\tsnpstd3.exe" 843776 Sep 18 2006 "C:\WINDOWS\bak\vsnpstd3.exe" 843776 Sep 18 2006 "C:\Program Files\Common Files\EZVGACam\vsnpstd3.exe" 430080 Oct 20 2005 "C:\Program Files\Dell Photo AIO Printer 924\bak\dlccmon.exe" 14860 Feb 4 2008 "C:\Program Files\DellSupport\DSAgnt.exe" 460784 Mar 15 2007 "C:\Program Files\DellSupport\bak\DSAgnt.exe" 14860 Feb 4 2008 "C:\Program Files\ErrorSmart\ErrorSmart.exe" 18244856 Oct 25 2007 "C:\Program Files\ErrorSmart\bak\ErrorSmart.exe" 14860 Feb 4 2008 "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" 101080 Aug 24 2005 "C:\Program Files\Microsoft Location Finder\bak\LocationFinder.exe" 20480 Sep 10 2003 "C:\Program Files\NetWaiting\bak\netWaiting.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 936960 Jun 6 2007 "C:\Program Files\Verizon\bak\McciTrayApp.exe" 166304 Nov 15 2007 "C:\Program Files\Zune\bak\ZuneLauncher.exe" 59392 Aug 10 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe" 64512 Aug 5 2005 "C:\WINDOWS\$NtUninstallKB908246$\ehtray.exe" 67584 Sep 29 2005 "C:\WINDOWS\ehome\bak\ehtray.exe" 15360 Aug 10 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 10 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 77824 Dec 13 2005 "C:\drivers\video\onboard\hkcmd.exe" 77824 Dec 13 2005 "C:\WINDOWS\system32\bak\hkcmd.exe" 118784 Dec 13 2005 "C:\drivers\video\onboard\igfxpers.exe" 118784 Dec 13 2005 "C:\WINDOWS\system32\bak\igfxpers.exe" 98304 Dec 13 2005 "C:\drivers\video\onboard\igfxtray.exe" 98304 Dec 13 2005 "C:\WINDOWS\system32\bak\igfxtray.exe" 20480 Jan 8 2007 "C:\Program Files\McAfee\MBK\LogonHook.exe" 20480 Jan 8 2007 "C:\Program Files\McAfee\MBK\bak\LogOnHook.exe" 4838952 Jan 16 2007 "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" 4838952 Jan 16 2007 "C:\Program Files\McAfee\MBK\bak\McAfeeDataBackup.exe" 1160480 Jul 22 2007 "C:\Program Files\McAfee\MHN\McENUI.exe" 1160480 Jul 22 2007 "C:\Program Files\McAfee\MHN\bak\McENUI.exe" 14860 Feb 4 2008 "C:\Program Files\McAfee\MWL\MWLGuiSt.exe" 206184 Jul 28 2007 "C:\Program Files\McAfee\MWL\bak\MWLGuiSt.exe" 582992 Aug 3 2007 "C:\Program Files\McAfee.com\Agent\mcagent.exe" 582992 Aug 3 2007 "C:\Program Files\McAfee.com\Agent\bak\mcagent.exe" 14860 Feb 4 2008 "C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" 36640 Aug 24 2007 "C:\Program Files\SiteAdvisor\6253\bak\SiteAdv.exe" 761947 Mar 8 2006 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe" 823362 Aug 30 2005 "C:\Program Files\Trend Micro\Internet Security 12\bak\pccguide.exe" 77824 Aug 10 2004 "C:\WINDOWS\ehome\RegisterMCEApp.exe" 14860 Feb 4 2008 "C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" 1885464 Dec 5 2007 "C:\Program Files\Uniblue\RegistryBooster 2\bak\RegistryBooster.exe" 14860 Feb 4 2008 "C:\Program Files\Yahoo!\Messenger\YAHOOM~1.exe" 4670968 Mar 1 2007 "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.exe" 81920 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe" 249856 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe" 50688 Sep 13 2003 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe" 185896 Dec 2 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 602182 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe" 667718 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe" 32881 Nov 19 2003 "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" 132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe" 176201 Apr 11 2006 "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\bak\TMAS_OEMon.exe" 14860 Feb 4 2008 "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" 135168 Nov 13 2007 "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\bak\TransferAgent.exe" 327437 Jan 23 2008 "C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\CIP\TransferAgentSetup.exe" end of report

0

Your java is out of date and can be exploited. Download the latest version of java from this link Java Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option: Press 2 then Enter to restore files from bak folders A text file opens called: files.txt Copy/paste the following list of bolded files to be restored: "C:\WINDOWS\bak\tsnpstd3.exe" "C:\WINDOWS\bak\vsnpstd3.exe" "C:\Program Files\Dell Photo AIO Printer 924\bak\dlccmon.exe" "C:\Program Files\DellSupport\bak\DSAgnt.exe" "C:\Program Files\ErrorSmart\bak\ErrorSmart.exe" "C:\Program Files\Microsoft Location Finder\bak\LocationFinder.exe" "C:\Program Files\NetWaiting\bak\netWaiting.exe" "C:\Program Files\QuickTime\bak\qttask.exe" "C:\Program Files\Verizon\bak\McciTrayApp.exe" "C:\Program Files\Zune\bak\ZuneLauncher.exe" "C:\WINDOWS\ehome\bak\ehtray.exe" "C:\WINDOWS\system32\bak\ctfmon.exe" "C:\WINDOWS\system32\bak\hkcmd.exe" "C:\WINDOWS\system32\bak\igfxpers.exe" "C:\WINDOWS\system32\bak\igfxtray.exe" "C:\Program Files\McAfee\MBK\bak\LogOnHook.exe" "C:\Program Files\McAfee\MBK\bak\McAfeeDataBackup.exe" "C:\Program Files\McAfee\MHN\bak\McENUI.exe" "C:\Program Files\McAfee\MWL\bak\MWLGuiSt.exe" "C:\Program Files\McAfee.com\Agent\bak\mcagent.exe" "C:\Program Files\SiteAdvisor\6253\bak\SiteAdv.exe" "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe" "C:\Program Files\Trend Micro\Internet Security 12\bak\pccguide.exe" "C:\Program Files\Uniblue\RegistryBooster 2\bak\RegistryBooster.exe" "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.exe" "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe" "C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe" "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe" "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe" "C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe" "C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe" "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\bak\TMAS_OEMon.exe" "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\bak\TransferAgent.exe" Next, close and click Yes to save the changes. Once files.txt is saved, FindAWF does the following: -It attempts to terminate the process represented by each filename on the list, if running -Deletes the rogue file from the parent folder, if present -Copies the original file to the parent folder When done with the above, it automatically runs a new scan and opens a new log. Please provide the new FindAWF log in your reply.

0

Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: Fri 02/08/2008 The current time is: 11:23:29.32 bak folders found ~~~~~~~~~~~ Directory of C:\WINDOWS\BAK 11/29/2006 03:28 PM 262,144 tsnpstd3.exe 09/18/2006 01:12 PM 843,776 vsnpstd3.exe 2 File(s) 1,105,920 bytes Directory of C:\PROGRA~1\DELLPH~1\BAK 10/20/2005 07:40 PM 430,080 dlccmon.exe 1 File(s) 430,080 bytes Directory of C:\PROGRA~1\DELLSU~1\BAK 03/15/2007 10:09 AM 460,784 DSAgnt.exe 1 File(s) 460,784 bytes Directory of C:\PROGRA~1\ERRORS~1\BAK 10/25/2007 03:11 PM 18,244,856 ErrorSmart.exe 1 File(s) 18,244,856 bytes Directory of C:\PROGRA~1\MI0A1E~1\BAK 08/24/2005 05:25 PM 101,080 LocationFinder.exe 1 File(s) 101,080 bytes Directory of C:\PROGRA~1\NETWAI~1\BAK 09/10/2003 02:24 AM 20,480 netWaiting.exe 1 File(s) 20,480 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 06:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Directory of C:\PROGRA~1\VERIZON\BAK 06/06/2007 06:52 PM 936,960 McciTrayApp.exe 1 File(s) 936,960 bytes Directory of C:\PROGRA~1\ZUNE\BAK 11/15/2007 09:51 PM 166,304 ZuneLauncher.exe 1 File(s) 166,304 bytes Directory of C:\WINDOWS\EHOME\BAK 09/29/2005 02:01 PM 67,584 ehtray.exe 1 File(s) 67,584 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 08/10/2004 05:00 AM 15,360 ctfmon.exe 12/13/2005 04:41 PM 77,824 hkcmd.exe 12/13/2005 04:45 PM 118,784 igfxpers.exe 12/13/2005 04:44 PM 98,304 igfxtray.exe 4 File(s) 310,272 bytes Directory of C:\PROGRA~1\MCAFEE\MBK\BAK 01/08/2007 11:22 AM 20,480 LogOnHook.exe 01/16/2007 01:59 PM 4,838,952 McAfeeDataBackup.exe 2 File(s) 4,859,432 bytes Directory of C:\PROGRA~1\MCAFEE\MHN\BAK 07/22/2007 08:29 PM 1,160,480 McENUI.exe 1 File(s) 1,160,480 bytes Directory of C:\PROGRA~1\MCAFEE\MWL\BAK 07/28/2007 09:32 AM 206,184 MWLGuiSt.exe 1 File(s) 206,184 bytes Directory of C:\PROGRA~1\MCAFEE.COM\AGENT\BAK 08/03/2007 10:33 PM 582,992 mcagent.exe 1 File(s) 582,992 bytes Directory of C:\PROGRA~1\SITEAD~1\6253\BAK 08/24/2007 04:57 PM 36,640 SiteAdv.exe 1 File(s) 36,640 bytes Directory of C:\PROGRA~1\SYNAPT~1\SYNTP\BAK 03/08/2006 11:48 AM 761,947 SynTPEnh.exe 1 File(s) 761,947 bytes Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\BAK 08/30/2005 09:47 AM 823,362 pccguide.exe 1 File(s) 823,362 bytes Directory of C:\PROGRA~1\UNIBLUE\REGIST~1\BAK 12/05/2007 03:51 PM 1,885,464 RegistryBooster.exe 1 File(s) 1,885,464 bytes Directory of C:\PROGRA~1\YAHOO!\MESSEN~1\BAK 03/01/2007 05:11 PM 4,670,968 YAHOOM~1.exe 1 File(s) 4,670,968 bytes Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK 06/10/2005 10:44 AM 81,920 issch.exe 06/10/2005 10:44 AM 249,856 isuspm.exe 2 File(s) 331,776 bytes Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK 09/13/2003 08:36 PM 50,688 WkUFind.exe 1 File(s) 50,688 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 12/02/2006 05:52 PM 185,896 realsched.exe 1 File(s) 185,896 bytes Directory of C:\PROGRA~1\INTEL\WIRELESS\BIN\BAK 12/28/2005 11:56 AM 602,182 ifrmewrk.exe 12/28/2005 11:55 AM 667,718 ZCfgSvc.exe 2 File(s) 1,269,900 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 09/25/2007 01:11 AM 132,496 jusched.exe 1 File(s) 132,496 bytes Directory of C:\PROGRA~1\TRENDM~1\INTERN~1\TMAS_OE\BAK 04/11/2006 06:39 PM 176,201 TMAS_OEMon.exe 1 File(s) 176,201 bytes Directory of C:\DOCUME~1\ALLUSE~1\APPLIC~1\DELL\TRANSF~1\BAK 11/13/2007 04:46 PM 135,168 TransferAgent.exe 1 File(s) 135,168 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 262144 Nov 29 2006 "C:\WINDOWS\tsnpstd3.exe" 262144 Nov 29 2006 "C:\WINDOWS\bak\tsnpstd3.exe" 262144 Nov 29 2006 "C:\Program Files\Common Files\EZVGACam\tsnpstd3.exe" 843776 Sep 18 2006 "C:\WINDOWS\vsnpstd3.exe" 843776 Sep 18 2006 "C:\WINDOWS\bak\vsnpstd3.exe" 843776 Sep 18 2006 "C:\Program Files\Common Files\EZVGACam\vsnpstd3.exe" 430080 Oct 20 2005 "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" 430080 Oct 20 2005 "C:\Program Files\Dell Photo AIO Printer 924\bak\dlccmon.exe" 460784 Mar 15 2007 "C:\Program Files\DellSupport\DSAgnt.exe" 460784 Mar 15 2007 "C:\Program Files\DellSupport\bak\DSAgnt.exe" 18244856 Oct 25 2007 "C:\Program Files\ErrorSmart\ErrorSmart.exe" 18244856 Oct 25 2007 "C:\Program Files\ErrorSmart\bak\ErrorSmart.exe" 101080 Aug 24 2005 "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" 101080 Aug 24 2005 "C:\Program Files\Microsoft Location Finder\bak\LocationFinder.exe" 20480 Sep 10 2003 "C:\Program Files\NetWaiting\netWaiting.exe" 20480 Sep 10 2003 "C:\Program Files\NetWaiting\bak\netWaiting.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\qttask.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 936960 Jun 6 2007 "C:\Program Files\Verizon\McciTrayApp.exe" 936960 Jun 6 2007 "C:\Program Files\Verizon\bak\McciTrayApp.exe" 166304 Nov 15 2007 "C:\Program Files\Zune\ZuneLauncher.exe" 166304 Nov 15 2007 "C:\Program Files\Zune\bak\ZuneLauncher.exe" 59392 Aug 10 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe" 64512 Aug 5 2005 "C:\WINDOWS\$NtUninstallKB908246$\ehtray.exe" 67584 Sep 29 2005 "C:\WINDOWS\ehome\ehtray.exe" 67584 Sep 29 2005 "C:\WINDOWS\ehome\bak\ehtray.exe" 15360 Aug 10 2004 "C:\WINDOWS\system32\ctfmon.exe" 15360 Aug 10 2004 "C:\WINDOWS\system32\bak\ctfmon.exe" 77824 Dec 13 2005 "C:\WINDOWS\system32\hkcmd.exe" 77824 Dec 13 2005 "C:\drivers\video\onboard\hkcmd.exe" 77824 Dec 13 2005 "C:\WINDOWS\system32\bak\hkcmd.exe" 118784 Dec 13 2005 "C:\WINDOWS\system32\igfxpers.exe" 118784 Dec 13 2005 "C:\drivers\video\onboard\igfxpers.exe" 118784 Dec 13 2005 "C:\WINDOWS\system32\bak\igfxpers.exe" 98304 Dec 13 2005 "C:\WINDOWS\system32\igfxtray.exe" 98304 Dec 13 2005 "C:\drivers\video\onboard\igfxtray.exe" 98304 Dec 13 2005 "C:\WINDOWS\system32\bak\igfxtray.exe" 20480 Jan 8 2007 "C:\Program Files\McAfee\MBK\LogOnHook.exe" 20480 Jan 8 2007 "C:\Program Files\McAfee\MBK\bak\LogOnHook.exe" 4838952 Jan 16 2007 "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" 4838952 Jan 16 2007 "C:\Program Files\McAfee\MBK\bak\McAfeeDataBackup.exe" 1160480 Jul 22 2007 "C:\Program Files\McAfee\MHN\McENUI.exe" 1160480 Jul 22 2007 "C:\Program Files\McAfee\MHN\bak\McENUI.exe" 206184 Jul 28 2007 "C:\Program Files\McAfee\MWL\MWLGuiSt.exe" 206184 Jul 28 2007 "C:\Program Files\McAfee\MWL\bak\MWLGuiSt.exe" 582992 Aug 3 2007 "C:\Program Files\McAfee.com\Agent\mcagent.exe" 582992 Aug 3 2007 "C:\Program Files\McAfee.com\Agent\bak\mcagent.exe" 36640 Aug 24 2007 "C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" 36640 Aug 24 2007 "C:\Program Files\SiteAdvisor\6253\bak\SiteAdv.exe" 761947 Mar 8 2006 "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" 761947 Mar 8 2006 "C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe" 823362 Aug 30 2005 "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" 823362 Aug 30 2005 "C:\Program Files\Trend Micro\Internet Security 12\bak\pccguide.exe" 77824 Aug 10 2004 "C:\WINDOWS\ehome\RegisterMCEApp.exe" 1885464 Dec 5 2007 "C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" 1885464 Dec 5 2007 "C:\Program Files\Uniblue\RegistryBooster 2\bak\RegistryBooster.exe" 4670968 Mar 1 2007 "C:\Program Files\Yahoo!\Messenger\YAHOOM~1.exe" 4670968 Mar 1 2007 "C:\Program Files\Yahoo!\Messenger\bak\YAHOOM~1.exe" 81920 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" 81920 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\issch.exe" 249856 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" 249856 Jun 10 2005 "C:\Program Files\Common Files\InstallShield\UpdateService\bak\isuspm.exe" 50688 Sep 13 2003 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" 50688 Sep 13 2003 "C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak\WkUFind.exe" 185896 Dec 2 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 185896 Dec 2 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 602182 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" 602182 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\bak\ifrmewrk.exe" 667718 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe" 667718 Dec 28 2005 "C:\Program Files\Intel\Wireless\Bin\bak\ZCfgSvc.exe" 132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" 144784 Dec 14 2007 "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" 132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe" 176201 Apr 11 2006 "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" 176201 Apr 11 2006 "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\bak\TMAS_OEMon.exe" 135168 Nov 13 2007 "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" 135168 Nov 13 2007 "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\bak\TransferAgent.exe" 327437 Jan 23 2008 "C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\CIP\TransferAgentSetup.exe" end of report

0

Option 3: Double-click the FindAWF icon once again If a Security Alert shows, allow the program to run. As instructed, press any key to continue. Use the following option: Press 3 then Enter to remove bak folders A text file opens called: folders.txt Copy /paste the following list of bolded folders to be removed: C:\WINDOWS\bak C:\Program Files\Dell Photo AIO Printer 924\bak C:\Program Files\DellSupport\bak C:\Program Files\ErrorSmart\bak C:\Program Files\Microsoft Location Finder\bak C:\Program Files\NetWaiting\bak :\Program Files\QuickTime\bak C:\Program Files\Verizon\bak C:\Program Files\Zune\bak C:\WINDOWS\ehome\bak C:\WINDOWS\system32\bak C:\Program Files\McAfee\MBK\bak C:\Program Files\McAfee\MHN\bak C:\Program Files\McAfee\MWL\bak C:\Program Files\McAfee.com\Agent\bak C:\Program Files\SiteAdvisor\6253\bak C:\Program Files\Synaptics\SynTP\bak C:\Program Files\Trend Micro\Internet Security 12\bak C:\Program Files\Uniblue\RegistryBooster 2\bak C:\Program Files\Yahoo!\Messenger\bak C:\Program Files\Common Files\InstallShield\UpdateService\bak C:\Program Files\Common Files\Microsoft Shared\Works Shared\bak C:\Program Files\Common Files\Real\Update_OB\bak C:\Program Files\Intel\Wireless\Bin\bak C:\Program Files\Java\jre1.6.0_03\bin\bak C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\bak C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\bak Next, close and click Yes to save the changes. Once folders.txt is saved, FindAWF does the following: -It deletes the contents of the bak folders -Removes the bak folders When done with the above, it automatically runs a new scan and opens a new log. Please provide the new FindAWF log in your reply.

0

Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Fri 02/08/2008 The current time is: 17:41:22.50 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\QUICKT~1\BAK 10/25/2006 06:58 PM 282,624 qttask.exe 1 File(s) 282,624 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 282624 Oct 25 2006 "C:\Program Files\QuickTime\qttask.exe" 282624 Oct 25 2006 "C:\Program Files\QuickTime\bak\qttask.exe" end of report

0

QuickTime is still infected. Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\Program Files\QuickTime\bak\qttask.exe C:\Program Files\QuickTime\qttask.exe Folder:: C:\Program Files\QuickTime XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Combofix log. You will need to reinstall Quicktime if you use it. If you have AOL it will reinstall itself once you run AOL. If no AOL just do a google search for "download Quicktime" and you should be able to find a free download easily enough. Let us know how the computer is operating please.

0

ComboFix 08-02.05.3 - James t Mott 2008-02-08 18:02:52.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.426 [GMT -5:00] Running from: C:\Documents and Settings\James t Mott\My Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\James t Mott\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\Program Files\QuickTime\bak\qttask.exe C:\Program Files\QuickTime\qttask.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\QuickTime C:\Program Files\QuickTime\bak\qttask.exe C:\Program Files\QuickTime\Plugins\npqtplugin.dll C:\Program Files\QuickTime\Plugins\npqtplugin2.dll C:\Program Files\QuickTime\Plugins\npqtplugin3.dll C:\Program Files\QuickTime\Plugins\npqtplugin4.dll C:\Program Files\QuickTime\Plugins\npqtplugin5.dll C:\Program Files\QuickTime\Plugins\npqtplugin6.dll C:\Program Files\QuickTime\Plugins\npqtplugin7.dll C:\Program Files\QuickTime\QTComponents\psi_v.qtx C:\Program Files\QuickTime\qttask.exe . ((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 ))))))))))))))))))))))))))))))) . 2008-02-08 11:23 . 2006-09-18 13:12 843,776 --a------ C:\WINDOWS\vsnpstd3.exe 2008-02-08 11:23 . 2006-11-29 15:28 262,144 --a------ C:\WINDOWS\tsnpstd3.exe 2008-02-08 11:23 . 2005-12-13 16:45 118,784 --a------ C:\WINDOWS\system32\igfxpers.exe 2008-02-08 11:23 . 2005-12-13 16:44 98,304 --a------ C:\WINDOWS\system32\igfxtray.exe 2008-02-08 11:23 . 2005-12-13 16:41 77,824 --a------ C:\WINDOWS\system32\hkcmd.exe 2008-02-08 11:20 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-08 11:19 . 2008-02-08 11:19 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-07 21:57 . 2004-08-10 05:00 388,608 --a------ C:\kmd.exe 2008-02-07 20:53 . 2008-02-07 21:37 2,266 --a------ C:\WINDOWS\system32\tmp.reg 2008-02-07 20:38 . 2008-02-07 20:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-07 20:38 . 2008-02-07 20:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-07 20:38 . 2008-02-07 20:38 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-07 20:38 . 2008-02-07 20:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-07 20:38 . 2008-02-07 20:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-02-07 19:02 . 2008-02-07 19:03 <DIR> d-------- C:\Program Files\XoftSpySE 2008-02-06 12:03 . 2008-02-06 12:03 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Webroot 2008-02-01 20:38 . 2008-02-01 20:40 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ErrorSmart 2008-02-01 20:37 . 2008-02-08 17:41 <DIR> d-------- C:\Program Files\ErrorSmart 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Program Files\Uniblue 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Uniblue 2008-02-01 19:00 . 2008-02-01 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix 2008-02-01 18:54 . 2008-02-01 18:54 61,480 --a------ C:\Documents and Settings\James t Mott\GoToAssistDownloadHelper.exe 2008-02-01 18:47 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\McAfee 2008-02-01 12:31 . 2008-02-04 21:41 <DIR> d-------- C:\Program Files\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 12:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 18:30 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-04 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-08 18:09 7,557 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-01 12:29 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-01 12:27 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-01 12:27 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-01 12:27 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-01 12:27 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-01 10:10 . 2007-01-02 18:16 86,848 --a------ C:\WINDOWS\system32\drivers\WscNetDr.sys 2008-02-01 10:09 . 2008-02-01 10:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-01 10:08 . 2008-02-07 12:24 <DIR> d-------- C:\Program Files\McAfee 2008-02-01 10:08 . 2008-02-01 12:27 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-02-01 10:08 . 2008-02-01 10:08 2 --a------ C:\WINDOWS\msoffice.ini 2008-02-01 10:02 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-02-01 09:08 . 2008-02-01 11:23 <DIR> d-------- C:\Program Files\NoAdware5.0 2008-01-31 14:48 . 2008-01-31 14:48 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ICAClient 2008-01-30 16:39 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-01-30 10:48 . 2008-01-31 14:56 <DIR> d-------- C:\Program Files\Elements 2008-01-25 10:05 . 2008-01-30 16:14 <DIR> d-------- C:\Program Files\SpongeBob Atlantis SquareOff 2008-01-25 08:51 . 2008-01-25 09:27 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\CaribbeanHideaway 2008-01-23 10:48 . 2008-01-23 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2008-01-13 13:48 . 2008-01-14 14:36 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\BloodTies 2008-01-13 13:42 . 2008-01-13 13:43 <DIR> d-------- C:\Program Files\Blood Ties 2008-01-11 20:08 . 2008-01-11 20:08 <DIR> d-------- C:\WINDOWS\Volvo Wheel Loader L220E dir 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Valusoft 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Valusoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-08 22:41 --------- d-----w C:\Program Files\Zune 2008-02-08 22:41 --------- d-----w C:\Program Files\Verizon 2008-02-08 22:41 --------- d-----w C:\Program Files\NetWaiting 2008-02-08 22:41 --------- d-----w C:\Program Files\Microsoft Location Finder 2008-02-08 22:41 --------- d-----w C:\Program Files\DellSupport 2008-02-08 22:41 --------- d-----w C:\Program Files\Dell Photo AIO Printer 924 2008-02-08 19:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-08 16:20 --------- d-----w C:\Program Files\Java 2008-02-08 00:00 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\MSN6 2008-02-04 23:38 --------- d-----w C:\Program Files\Dl_cats 2008-02-01 17:03 --------- d-----w C:\Program Files\MSN Messenger 2008-02-01 16:55 454 ----a-w C:\Program Files\Shortcut to Kudos.lnk 2008-02-01 16:27 --------- d-----w C:\Program Files\WildTangent 2008-02-01 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-02-01 16:21 --------- d-----w C:\Program Files\MUSICMATCH 2008-02-01 16:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-02-01 15:09 --------- d-----w C:\Program Files\Common Files\AOL 2008-02-01 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-01-15 16:12 --------- d-----w C:\Program Files\Oberon Media 2008-01-15 16:11 --------- d-----w C:\Program Files\Verizon Online 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Big Fish Games 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Big Fish Games 2008-01-12 01:08 12,288 ----a-w C:\WINDOWS\impborl.dll 2008-01-12 00:40 --------- d-----w C:\Program Files\Mystery Case Files - Madame Fate 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\PlayFirst 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-01-07 15:09 --------- d-----w C:\Program Files\Fatal Hearts 2008-01-06 20:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\EA 2008-01-04 15:25 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Teggo 2008-01-03 19:27 --------- d-----w C:\Program Files\Fairway Solitaire 2008-01-03 19:03 --------- d-----w C:\Program Files\Google 2008-01-03 15:18 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Bloom 2007-12-25 14:25 --------- d-----w C:\Program Files\Linkit - A Christmas Carol 2007-12-25 14:25 --------- d-----w C:\Program Files\Home Sweet Home 2007-12-25 14:25 --------- d-----w C:\Program Files\Aquitania 2007-12-25 14:24 --------- d-----w C:\Program Files\Super Granny 4 2007-12-25 14:24 --------- d-----w C:\Program Files\Dream Day First Home 2007-12-20 15:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2007-12-18 19:39 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Home Sweet Home 2007-12-17 19:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Awem 2007-12-12 22:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Gogii 2007-11-03 00:11 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-11-04 18:23 251 -c--a-w C:\Program Files\wt3d.ini 2006-12-02 17:04 88 -csh--r C:\WINDOWS\system32\6A3897255A.sys 2006-12-02 17:04 3,766 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00 15360] "Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 17:25 101080] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-01 17:11 4670968] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09 460784] "DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 16:46 135168] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 15:51 1885464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe] "DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 17:50 73728] "MWLExe"="C:\PROGRA~1\Mcafee\MWL\MWLGuiSt.exe" [2007-07-28 09:32 206184] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 16:57 36640] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-07-22 20:29 1160480] "ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [2007-10-25 15:11 18244856] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] C:\Documents and Settings\Tracy Mott\Start Menu\Programs\Startup\ VZAccess Manager.lnk - C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2006-08-28 18:42:25 1273856] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 21:38] R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2007-11-15 21:51] R3 NWADI;NWADI Bus Enumerator;C:\WINDOWS\system32\DRIVERS\NWADIenum.sys [2006-01-06 10:16] S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2007-11-15 21:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe . Contents of the 'Scheduled Tasks' folder "2008-02-02 01:38:12 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job" - C:\Program Files\ErrorSmart\ErrorSmart.ex - C:\Program Files\ErrorSmart "2008-02-01 15:09:53 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2008-02-01 15:09:51 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-02-08 23:08:09 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-02-08 00:02:28 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-08 18:08:44 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Mcafee\MWL\MwlSvc.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Mcafee\MWL\MwlGui.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-02-08 18:15:10 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-08 23:15:05 ComboFix2.txt 2008-02-08 03:09:34 . 2008-02-01 02:07:14 --- E O F --- Things seem to be ok with the computer...I was just very concerned with getting all those trojans off the computer. Thank you SO much for all your help and patience! Are there any more steps for me to follow or did this do the trick?

0

Looks much better. I see one bad file. Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\6A3897255A.sys Folder:: C:\Qoobox XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Run an online scan with Kaspersky from the following link to double check for baddies: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

0

ComboFix 08-02.05.3 - James t Mott 2008-02-08 18:47:37.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.443 [GMT -5:00] Running from: C:\Documents and Settings\James t Mott\My Documents\ComboFix.exe Command switches used :: C:\Documents and Settings\James t Mott\Desktop\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE C:\WINDOWS\system32\6A3897255A.sys . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Qoobox C:\Qoobox\BackEnv\appdata.folder.dat C:\Qoobox\BackEnv\cache.folder.dat C:\Qoobox\BackEnv\desktop.folder.dat C:\Qoobox\BackEnv\favorites.folder.dat C:\Qoobox\BackEnv\local appdata.folder.dat C:\Qoobox\BackEnv\local settings.folder.dat C:\Qoobox\BackEnv\my pictures.folder.dat C:\Qoobox\BackEnv\personal.folder.dat C:\Qoobox\BackEnv\profiles.folder.dat C:\Qoobox\BackEnv\programs.folder.dat C:\Qoobox\BackEnv\setpath.bat C:\Qoobox\BackEnv\setpath.dat C:\Qoobox\BackEnv\start menu.folder.dat C:\Qoobox\BackEnv\startup.folder.dat C:\Qoobox\BackEnv\templates.folder.dat C:\Qoobox\CFScript_used_2008-02-08@18.02.txt C:\Qoobox\CFScript_used_2008-02-08@18.47.txt C:\Qoobox\ComboFix-quarantined-files.txt C:\Qoobox\ComboFix2.txt C:\Qoobox\ComboFix3.txt C:\Qoobox\snapshot@2008-02-07_22.09.07.07.dat C:\Qoobox\snapshot@2008-02-07_22.09.07.07_B.dat C:\WINDOWS\system32\6A3897255A.sys . ((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 ))))))))))))))))))))))))))))))) . 2008-02-08 18:02 . 2004-08-10 05:00 388,608 --a------ C:\kmd.exe 2008-02-08 11:23 . 2006-09-18 13:12 843,776 --a------ C:\WINDOWS\vsnpstd3.exe 2008-02-08 11:23 . 2006-11-29 15:28 262,144 --a------ C:\WINDOWS\tsnpstd3.exe 2008-02-08 11:23 . 2005-12-13 16:45 118,784 --a------ C:\WINDOWS\system32\igfxpers.exe 2008-02-08 11:23 . 2005-12-13 16:44 98,304 --a------ C:\WINDOWS\system32\igfxtray.exe 2008-02-08 11:23 . 2005-12-13 16:41 77,824 --a------ C:\WINDOWS\system32\hkcmd.exe 2008-02-08 11:20 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-08 11:19 . 2008-02-08 11:19 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-07 20:53 . 2008-02-07 21:37 2,266 --a------ C:\WINDOWS\system32\tmp.reg 2008-02-07 20:38 . 2008-02-07 20:38 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-02-07 20:38 . 2008-02-07 20:38 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-02-07 20:38 . 2008-02-07 20:38 85,504 --a------ C:\WINDOWS\system32\VACFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-02-07 20:38 . 2008-02-07 20:38 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-02-07 20:38 . 2008-02-07 20:38 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-02-07 20:38 . 2008-02-07 20:38 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-02-07 19:02 . 2008-02-07 19:03 <DIR> d-------- C:\Program Files\XoftSpySE 2008-02-06 12:03 . 2008-02-06 12:03 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Webroot 2008-02-01 20:38 . 2008-02-08 18:10 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ErrorSmart 2008-02-01 20:37 . 2008-02-08 18:10 <DIR> d-------- C:\Program Files\ErrorSmart 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Program Files\Uniblue 2008-02-01 20:34 . 2008-02-01 20:34 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Uniblue 2008-02-01 19:00 . 2008-02-01 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix 2008-02-01 18:54 . 2008-02-01 18:54 61,480 --a------ C:\Documents and Settings\James t Mott\GoToAssistDownloadHelper.exe 2008-02-01 18:47 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\McAfee 2008-02-01 12:31 . 2008-02-04 21:41 <DIR> d-------- C:\Program Files\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 12:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-01 18:30 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-04 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2008-02-01 12:31 . 2008-02-08 18:54 7,877 --a------ C:\WINDOWS\system32\Config.MPF 2008-02-01 12:29 . 2006-03-03 11:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll 2008-02-01 12:27 . 2007-07-21 09:08 201,288 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys 2008-02-01 12:27 . 2007-07-13 09:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys 2008-02-01 12:27 . 2007-07-24 07:40 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys 2008-02-01 12:27 . 2007-07-21 09:08 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys 2008-02-01 12:27 . 2007-07-24 12:02 33,800 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys 2008-02-01 10:10 . 2007-01-02 18:16 86,848 --a------ C:\WINDOWS\system32\drivers\WscNetDr.sys 2008-02-01 10:09 . 2008-02-01 10:09 <DIR> d-------- C:\Program Files\McAfee.com 2008-02-01 10:08 . 2008-02-07 12:24 <DIR> d-------- C:\Program Files\McAfee 2008-02-01 10:08 . 2008-02-01 12:27 <DIR> d-------- C:\Program Files\Common Files\McAfee 2008-02-01 10:08 . 2008-02-01 10:08 2 --a------ C:\WINDOWS\msoffice.ini 2008-02-01 10:02 . 2008-02-02 11:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee 2008-02-01 09:08 . 2008-02-01 11:23 <DIR> d-------- C:\Program Files\NoAdware5.0 2008-01-31 14:48 . 2008-01-31 14:48 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\ICAClient 2008-01-30 16:39 . 2007-10-10 18:55 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2008-01-30 10:48 . 2008-01-31 14:56 <DIR> d-------- C:\Program Files\Elements 2008-01-25 10:05 . 2008-01-30 16:14 <DIR> d-------- C:\Program Files\SpongeBob Atlantis SquareOff 2008-01-25 08:51 . 2008-01-25 09:27 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\CaribbeanHideaway 2008-01-23 10:48 . 2008-01-23 10:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Dell 2008-01-13 13:48 . 2008-01-14 14:36 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\BloodTies 2008-01-13 13:42 . 2008-01-13 13:43 <DIR> d-------- C:\Program Files\Blood Ties 2008-01-11 20:08 . 2008-01-11 20:08 <DIR> d-------- C:\WINDOWS\Volvo Wheel Loader L220E dir 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\James t Mott\Application Data\Valusoft 2008-01-10 10:25 . 2008-01-10 10:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Valusoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-08 22:41 --------- d-----w C:\Program Files\Zune 2008-02-08 22:41 --------- d-----w C:\Program Files\Verizon 2008-02-08 22:41 --------- d-----w C:\Program Files\NetWaiting 2008-02-08 22:41 --------- d-----w C:\Program Files\Microsoft Location Finder 2008-02-08 22:41 --------- d-----w C:\Program Files\DellSupport 2008-02-08 22:41 --------- d-----w C:\Program Files\Dell Photo AIO Printer 924 2008-02-08 19:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-02-08 16:20 --------- d-----w C:\Program Files\Java 2008-02-08 00:00 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\MSN6 2008-02-04 23:38 --------- d-----w C:\Program Files\Dl_cats 2008-02-01 17:03 --------- d-----w C:\Program Files\MSN Messenger 2008-02-01 16:55 454 ----a-w C:\Program Files\Shortcut to Kudos.lnk 2008-02-01 16:27 --------- d-----w C:\Program Files\WildTangent 2008-02-01 16:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-02-01 16:21 --------- d-----w C:\Program Files\MUSICMATCH 2008-02-01 16:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom 2008-02-01 15:09 --------- d-----w C:\Program Files\Common Files\AOL 2008-02-01 15:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-01-15 16:12 --------- d-----w C:\Program Files\Oberon Media 2008-01-15 16:11 --------- d-----w C:\Program Files\Verizon Online 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Big Fish Games 2008-01-15 16:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Big Fish Games 2008-01-12 01:08 12,288 ----a-w C:\WINDOWS\impborl.dll 2008-01-12 00:40 --------- d-----w C:\Program Files\Mystery Case Files - Madame Fate 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\PlayFirst 2008-01-08 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-01-07 15:09 --------- d-----w C:\Program Files\Fatal Hearts 2008-01-06 20:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\EA 2008-01-04 15:25 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Teggo 2008-01-03 19:27 --------- d-----w C:\Program Files\Fairway Solitaire 2008-01-03 19:03 --------- d-----w C:\Program Files\Google 2008-01-03 15:18 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Bloom 2007-12-25 14:25 --------- d-----w C:\Program Files\Linkit - A Christmas Carol 2007-12-25 14:25 --------- d-----w C:\Program Files\Home Sweet Home 2007-12-25 14:25 --------- d-----w C:\Program Files\Aquitania 2007-12-25 14:24 --------- d-----w C:\Program Files\Super Granny 4 2007-12-25 14:24 --------- d-----w C:\Program Files\Dream Day First Home 2007-12-20 15:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2007-12-18 19:39 --------- d-----w C:\Documents and Settings\James t Mott\Application Data\Home Sweet Home 2007-12-17 19:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Awem 2007-12-12 22:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Gogii 2007-11-03 00:11 774,144 ----a-w C:\Program Files\RngInterstitial.dll 2006-11-04 18:23 251 -c--a-w C:\Program Files\wt3d.ini 2006-12-02 17:04 3,766 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 05:00 15360] "Microsoft Location Finder"="C:\Program Files\Microsoft Location Finder\LocationFinder.exe" [2005-08-24 17:25 101080] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-03-01 17:11 4670968] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09 460784] "DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 16:46 135168] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 15:51 1885464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 282624 C:\WINDOWS\stsystra.exe] "DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-13 17:50 73728] "MWLExe"="C:\PROGRA~1\Mcafee\MWL\MWLGuiSt.exe" [2007-07-28 09:32 206184] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 22:33 582992] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 16:57 36640] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-07-22 20:29 1160480] "ErrorSmart"="C:\Program Files\ErrorSmart\ErrorSmart.exe" [2007-10-25 15:11 18244856] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] C:\Documents and Settings\Tracy Mott\Start Menu\Programs\Startup\ VZAccess Manager.lnk - C:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2006-08-28 18:42:25 1273856] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 21:38] R2 ZuneBusEnum;Zune Bus Enumerator;c:\WINDOWS\system32\ZuneBusEnum.exe [2007-11-15 21:51] R3 NWADI;NWADI Bus Enumerator;C:\WINDOWS\system32\DRIVERS\NWADIenum.sys [2006-01-06 10:16] S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;c:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2007-11-15 21:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe . Contents of the 'Scheduled Tasks' folder "2008-02-02 01:38:12 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job" - C:\Program Files\ErrorSmart\ErrorSmart.ex - C:\Program Files\ErrorSmart "2008-02-01 15:09:53 C:\WINDOWS\Tasks\McDefragTask.job" - c:\program files\mcafee\mqc\QcConsol.exe' "2008-02-01 15:09:51 C:\WINDOWS\Tasks\McQcTask.job" - c:\program files\mcafee\mqc\QcConsol.exe "2008-02-08 23:53:54 C:\WINDOWS\Tasks\XoftSpySE 2.job" - C:\Program Files\XoftSpySE\XoftSpy.exe "2008-02-08 00:02:28 C:\WINDOWS\Tasks\XoftSpySE.job" - C:\Program Files\XoftSpySE\XoftSpy.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-08 18:54:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . r Running Proce . C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Mcafee\MWL\MwlSvc.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Mcafee\MWL\MwlGui.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe . ************************************************************************** . Completion time: 2008-02-08 19:00:05 - machine was rebooted . 2008-02-01 02:07:14 --- E O F ---

0

Wow, did that take a long time! --------------------- KASPERSKY ONLINE SCANNER REPORT Friday, February 08, 2008 8:56:35 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 8/02/2008 Kaspersky Anti-Virus database records: 555684 --------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 99214 Number of viruses found: 3 Number of infected objects: 14 Number of suspicious objects: 0 Duration of the scan process: 01:33:38 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\McAfee\EasyNet\MHNData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MPF\data\log.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Events.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\Settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\Logs\{3891C3BC-4E88-42F0-92C2-E7BCB880D503}.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSC\McUsers.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\MSKWMDB.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MSK\settingsdb.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MWL\James t Mott-PrestoGui_2008-02-08.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MWL\SYSTEM-apconfig_2008-02-08.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MWL\SYSTEM-netlib_2008-02-08.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\MWL\SYSTEM-PrestoSvc_2008-02-08.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Data\TFR2.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee\VirusScan\Logs\OAS.Log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\ErrorSmart\Log\2008 Feb 08 - 06_55_49 PM_015.log Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\James t Mott\Application Data\McAfee\MBK\ARBUSFILE.GDB Object is locked skipped C:\Documents and Settings\James t Mott\Cookies\index.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Application Data\ApplicationHistory\McAfeeDataBackup.exe.e548c4c.ini.inuse Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini.inuse Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\History\History.IE5\MSHist012008020820080209\index.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temp\fb_3552.lck Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temp\~DF182A.tmp Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temp\~DFB5C.tmp Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temp\~DFE5B1.tmp Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\James t Mott\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\James t Mott\My Documents\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\James t Mott\My Documents\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\James t Mott\My Documents\SmitfraudFix.zip ZIP: infected - 1 skipped C:\Documents and Settings\James t Mott\NTUSER.DAT Object is locked skipped C:\Documents and Settings\James t Mott\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Blood Ties\BloodTies.exe Infected: not-a-virus:FraudTool.Win32.SpyLocked.i skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1\A0000173.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1\A0000193.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\change.log Object is locked skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000706.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000707.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000708.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000713.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000715.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000716.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000717.exe Infected: Trojan.Win32.KillAV.oh skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP8\A0000718.exe Infected: Trojan.Win32.KillAV.oh skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\ModemLog_Conexant HDA D110 MDC V.92 Modem.txt Object is locked skipped C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{D70A2C8D-AD77-40DF-B84A-9235F724ADE3}.crmlog Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\mcafee_QO4CZtVZQJeYue3 Object is locked skipped C:\WINDOWS\Temp\mcmsc_BB3Sa7jdga8qon0 Object is locked skipped C:\WINDOWS\Temp\mcmsc_HSpPury88U4ZE9c Object is locked skipped C:\WINDOWS\Temp\mcmsc_uIam2fNUQbWNRoK Object is locked skipped C:\WINDOWS\Temp\mcmsc_yRhSprglWXRYcdL Object is locked skipped C:\WINDOWS\Temp\sqlite_6ZqVlNhOUxqKQk7 Object is locked skipped C:\WINDOWS\Temp\sqlite_BM3VsApX8cENVoZ Object is locked skipped C:\WINDOWS\Temp\sqlite_C2X7eFwHmpt36Kn Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP10\change.log Object is locked skipped Scan process completed.

0

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Go to start> run type in Combofix u/ then press ok. That will uninstall Combofix. Then uninstall smitfraud, just drag the folder(s) on your desktop to the recycle been, then do a search for "smitfraud" and delete the folders found. Your logs are clean.

0

I tried the Combofix u/ to uninstall the program but it just ran another scan. What should I do now?

0

Ooops, typo on my part. Go to start> run type in combofix /u (note the space after combofix) then press ok. That will uninstall Combofix. How is the computer operating?

0

Thank you, Thank you, Thank you!!! It is working much better now...not to mention the piece of mind knowing that all those baddies have been removed! You're an angel!

0

Glad we could help.

0