Dr Watson Messages and Blue Screen/Computer freezes

Question

I keep getting Dr Watson popup alerts, and increasingly my computer freezes or goes blue screen on me.  I have been dealing with this issue on and off for at least a year, finally someone pointed me here (should have gone here first!)  Any help would be appreciated.   Have loaded updated HIJACKTHIS, here is my log:   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:48:52 PM, on 8/22/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\ehome\ehtray.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Picasa\PicasaMediaDetector.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\slpservice.exe C:\WINDOWS\system32\slpmonx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400 R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - (no file) O2 - BHO: (no name) - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - (no file) O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ZoneAlarm Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SurfXccelerator\surfx.exe/250 O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SurfXccelerator\surfx.exe/227 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cab O20 - Winlogon Notify: pmkhg - pmkhg.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 9852 bytes

Bugbatter · Answer

Welcome

It looks as if you had an incomplete removal of infection. I'm not sure how you removed it, so I do not know if any legitimate files were removed in that process, but I'll try my best to get you on the right track.

First, it is important that you disable TeaTimer until we are completely finished. It can interfere with the tools that we use (and is probably why you had an incomplete removal the first time around).
To disable TeaTimer:
Go to Start>Run. Type Msconfig > OK. On the next window that opens > Startup tab UNcheck the entry for TeaTimer until this is over...
1. Open Spybot
2. Click Mode -> Advanced Mode
3. Click Yes
4. Click Tools (located in the bottom left corner) -> Resident
5. Uncheck 'Resident "TeaTimer" (Protection of over-all system settings) active'
6. Then close Spybot.
Reboot.
Verify that Teatimer is not running.
After ALL cleaning of your system has been completed and we have confirmed that your computer is clean, reverse these steps and re-enable the protection applets for TeaTimer.

Please download Combofix from here: http://download.bleepingcomputer.com/sUBs/combofix.exe
Or
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the links are case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new HijackThis log.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run ComboFix.

Shash1213 · Answer

Bugbatter - Thank you for the assistance!   I have to admit that this has been an ongoing problem for me, and I attempted a full fix probably a year ago on this machine, but not with any directions from this forum.  Did not know this site existed, or I would have come here first!!  And gotten fixed properly first time around.   Here is my log file from Combofix:   ComboFix 07-08-25.2 - 'Shawna' 2007-08-26 14:16:13.1 - NTFSx86 Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.587 [GMT -5:00]  * Created a new restore point (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Shawna\APPLIC~1\install.dat C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\ssttq.dll (((((((((((((((((((((((((   Files Created from 2007-07-26 to 2007-08-26  ))))))))))))))))))))))))))))))) 2007-08-26 14:15 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-26 14:08   d-------- C:\WINDOWS\pss 2007-08-22 17:46   d-------- C:\Program Files\Trend Micro 2007-08-21 21:06   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intenium 2007-08-21 19:24   d-------- C:\Program Files\Neptunia 2007-08-19 12:18   d-------- C:\Hijack This 2007-08-17 22:35   d-------- C:\Program Files\Lavasoft 2007-08-17 22:35   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-17 22:35   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-08-15 13:12   d-------- C:\DOCUME~1\Shawna\APPLIC~1\RetroRecords 2007-08-11 15:04   d-------- C:\DOCUME~1\Shawna\APPLIC~1\Magus 2007-08-09 15:37   d-------- C:\DOCUME~1\Shawna\Saved Games 2007-08-09 15:37   d-------- C:\DOCUME~1\Shawna\APPLIC~1\FloodLightGames 2007-08-09 15:37   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FloodLightGames 2007-07-29 21:05   d-------- C:\Program Files\Emerald Tale 2007-07-29 19:57   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Friday's games 2007-07-29 18:46   d-------- C:\DOCUME~1\Shawna\APPLIC~1\Costco Photo Viewer US ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-26 14:20 337796 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-26 14:20 28741664 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-25 16:12 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-08-17 22:21 --------- d-------- C:\Program Files\Mystery Case Files - Huntsville 2007-07-31 21:22 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\AdobeUM 2007-07-31 21:22 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\AdobeUM 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\PlayFirst 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\PlayFirst 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst 2007-07-24 21:12 --------- d-------- C:\Program Files\The Cameron Files 2007-07-22 18:25 --------- d-------- C:\Program Files\Diamonds in the Rough Demo 2007-07-21 22:08 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\7Wonders2 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\iolo 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\iolo 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo 2007-07-14 22:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FireGlow 2007-07-14 22:07 --------- d-------- C:\Program Files\Nancy Drew 2007-07-14 21:54 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-13 19:17 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Big Fish Games 2007-07-13 19:17 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Big Fish Games 2007-07-12 20:33 --------- d-------- C:\Program Files\XviD 2007-07-12 20:33 --------- d-------- C:\Program Files\Scavenger Hunter Official Demo v1.51 2007-07-05 19:46 --------- d-------- C:\Program Files\Sony 2007-06-27 18:51 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\gemsweeperextractedgfx 2007-06-27 18:51 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\gemsweeperextractedgfx 2007-06-27 18:35 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\My Games 2007-06-27 18:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache 2007-06-27 18:22 --------- d-------- C:\Program Files\bfgclient 2007-06-27 15:33 75932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-06-27 15:33 74396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-06-27 15:33 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier 2007-06-25 19:08 --------- d-------- C:\Program Files\Common Files\L&H 2007-06-25 19:05 --------- d-------- C:\Program Files\Microsoft ActiveSync 2007-06-21 21:54 75248 --a------ C:\WINDOWS\zllsputility.exe 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll 2006-03-15 23:43 774144 --a------ C:\Program Files\RngInterstitial.dll 2006-02-19 03:28 12288 --a------ C:\WINDOWS\Fonts.\RandFont.dll 2005-07-01 22:37 251 --a------ C:\Program Files\wt3d.ini 2004-07-17 19:39 4354084 --------- C:\DOCUME~1\Shawna\spybotsd13.exe 2004-07-17 19:16 2247855 --------- C:\DOCUME~1\Shawna\spywareblastersetup.exe 2003-10-12 22:46 441088 --------- C:\DOCUME~1\Shawna\GoogleToolbarInstaller.exe 2002-10-15 22:27 3362961 --------- C:\DOCUME~1\Shawna\mh.exe (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ehTray'='C:\WINDOWS\ehome\ehtray.exe' [2004-08-10 05:04] 'IAAnotif'='C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe' [2004-03-23 13:16] 'ATIPTA'='C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe' [2004-08-25 13:52] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 21:12] 'CTSysVol'='C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe' [2003-09-17 11:43] 'P17Helper'='P17.dll' [2004-06-10 12:51 C:\WINDOWS\SYSTEM32\P17.dll] 'UpdReg'='C:\WINDOWS\UpdReg.EXE' [2000-05-11 02:00] 'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2004-10-12 17:54] 'UpdateManager'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2004-01-07 02:01] 'MMTray'='C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe' [2004-09-14 09:50] 'mmtask'='C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe' [2004-09-14 09:50] 'RealTray'='C:\Program Files\Real\RealPlayer\RealPlay.exe' [2005-03-04 04:19] 'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2004-12-06 02:05] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2005-04-10 18:36] 'LifeScape Media Detector'='C:\Program Files\Picasa\PicasaMediaDetector.exe' [2005-04-26 19:01] 'HP Software Update'='C:\Program Files\HP\HP Software Update\HPWuSchd2.exe' [2006-02-19 02:41] 'ZoneAlarm Client'='C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' [2007-06-21 21:54] 'AVG7_CC'='C:\PROGRA~1\Grisoft\AVG7\avgcc.exe' [2007-08-17 22:05] 'MSConfig'='C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe' [2004-08-10 06:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-10 06:00] C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] C:\DOCUME~1\Scott\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] C:\DOCUME~1\Shawna\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 'InstallVisualStyle'=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles 'InstallTheme'=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\pmkhg] pmkhg.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS	ansgt.sys R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys S3 BCMModem;BCM V.90 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMDM.sys Contents of the 'Scheduled Tasks' folder 2007-08-26 19:22:01 C:\WINDOWS\Tasks\McAfee.com Update Check (CHERIE-Shawna).job - C:\PROGRA~1\mcafee.com\agent\mcupdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-26 14:21:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-26 14:23:43 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-26 14:23  --- E O F ---

Shash1213 · Answer

Here is my  Hijack this log, after running ComboFix:  The Combofix log will be in next message (can't post to same message, too many characters).   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:44:30 PM, on 8/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\WINDOWS\system32\slpservice.exe C:\WINDOWS\system32\slpmonx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Picasa\PicasaMediaDetector.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\eHome\ehmsas.exe C:\PROGRA~1\Grisoft\AVG7\avgw.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400 R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - (no file) O2 - BHO: (no name) - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - (no file) O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ZoneAlarm Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SurfXccelerator\surfx.exe/250 O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SurfXccelerator\surfx.exe/227 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cab O20 - Winlogon Notify: pmkhg - pmkhg.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 9570 bytes

Shash1213 · Answer

Here is my Combofix log, prior to running Hijack this.  Thank you again for helping me with this problem!   Here is my log file from Combofix:   ComboFix 07-08-25.2 - 'Shawna' 2007-08-26 14:16:13.1 - NTFSx86 Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.587 [GMT -5:00]  * Created a new restore point (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Shawna\APPLIC~1\install.dat C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\ssttq.dll (((((((((((((((((((((((((   Files Created from 2007-07-26 to 2007-08-26  ))))))))))))))))))))))))))))))) 2007-08-26 14:15 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-26 14:08   d-------- C:\WINDOWS\pss 2007-08-22 17:46   d-------- C:\Program Files\Trend Micro 2007-08-21 21:06   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intenium 2007-08-21 19:24   d-------- C:\Program Files\Neptunia 2007-08-19 12:18   d-------- C:\Hijack This 2007-08-17 22:35   d-------- C:\Program Files\Lavasoft 2007-08-17 22:35   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-17 22:35   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-08-15 13:12   d-------- C:\DOCUME~1\Shawna\APPLIC~1\RetroRecords 2007-08-11 15:04   d-------- C:\DOCUME~1\Shawna\APPLIC~1\Magus 2007-08-09 15:37   d-------- C:\DOCUME~1\Shawna\Saved Games 2007-08-09 15:37   d-------- C:\DOCUME~1\Shawna\APPLIC~1\FloodLightGames 2007-08-09 15:37   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FloodLightGames 2007-07-29 21:05   d-------- C:\Program Files\Emerald Tale 2007-07-29 19:57   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Friday's games 2007-07-29 18:46   d-------- C:\DOCUME~1\Shawna\APPLIC~1\Costco Photo Viewer US ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-26 14:20 337796 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-26 14:20 28741664 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-25 16:12 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-08-17 22:21 --------- d-------- C:\Program Files\Mystery Case Files - Huntsville 2007-07-31 21:22 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\AdobeUM 2007-07-31 21:22 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\AdobeUM 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\PlayFirst 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\PlayFirst 2007-07-29 20:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst 2007-07-24 21:12 --------- d-------- C:\Program Files\The Cameron Files 2007-07-22 18:25 --------- d-------- C:\Program Files\Diamonds in the Rough Demo 2007-07-21 22:08 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\7Wonders2 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\iolo 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\iolo 2007-07-19 19:15 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo 2007-07-14 22:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FireGlow 2007-07-14 22:07 --------- d-------- C:\Program Files\Nancy Drew 2007-07-14 21:54 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-13 19:17 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Big Fish Games 2007-07-13 19:17 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Big Fish Games 2007-07-12 20:33 --------- d-------- C:\Program Files\XviD 2007-07-12 20:33 --------- d-------- C:\Program Files\Scavenger Hunter Official Demo v1.51 2007-07-05 19:46 --------- d-------- C:\Program Files\Sony 2007-06-27 18:51 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\gemsweeperextractedgfx 2007-06-27 18:51 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\gemsweeperextractedgfx 2007-06-27 18:35 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\My Games 2007-06-27 18:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\BigFishGamesCache 2007-06-27 18:22 --------- d-------- C:\Program Files\bfgclient 2007-06-27 15:33 75932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-06-27 15:33 74396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-06-27 15:33 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier 2007-06-25 19:08 --------- d-------- C:\Program Files\Common Files\L&H 2007-06-25 19:05 --------- d-------- C:\Program Files\Microsoft ActiveSync 2007-06-21 21:54 75248 --a------ C:\WINDOWS\zllsputility.exe 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll 2006-03-15 23:43 774144 --a------ C:\Program Files\RngInterstitial.dll 2006-02-19 03:28 12288 --a------ C:\WINDOWS\Fonts.\RandFont.dll 2005-07-01 22:37 251 --a------ C:\Program Files\wt3d.ini 2004-07-17 19:39 4354084 --------- C:\DOCUME~1\Shawna\spybotsd13.exe 2004-07-17 19:16 2247855 --------- C:\DOCUME~1\Shawna\spywareblastersetup.exe 2003-10-12 22:46 441088 --------- C:\DOCUME~1\Shawna\GoogleToolbarInstaller.exe 2002-10-15 22:27 3362961 --------- C:\DOCUME~1\Shawna\mh.exe (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ehTray'='C:\WINDOWS\ehome\ehtray.exe' [2004-08-10 05:04] 'IAAnotif'='C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe' [2004-03-23 13:16] 'ATIPTA'='C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe' [2004-08-25 13:52] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 21:12] 'CTSysVol'='C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe' [2003-09-17 11:43] 'P17Helper'='P17.dll' [2004-06-10 12:51 C:\WINDOWS\SYSTEM32\P17.dll] 'UpdReg'='C:\WINDOWS\UpdReg.EXE' [2000-05-11 02:00] 'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2004-10-12 17:54] 'UpdateManager'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2004-01-07 02:01] 'MMTray'='C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe' [2004-09-14 09:50] 'mmtask'='C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe' [2004-09-14 09:50] 'RealTray'='C:\Program Files\Real\RealPlayer\RealPlay.exe' [2005-03-04 04:19] 'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2004-12-06 02:05] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2005-04-10 18:36] 'LifeScape Media Detector'='C:\Program Files\Picasa\PicasaMediaDetector.exe' [2005-04-26 19:01] 'HP Software Update'='C:\Program Files\HP\HP Software Update\HPWuSchd2.exe' [2006-02-19 02:41] 'ZoneAlarm Client'='C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' [2007-06-21 21:54] 'AVG7_CC'='C:\PROGRA~1\Grisoft\AVG7\avgcc.exe' [2007-08-17 22:05] 'MSConfig'='C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe' [2004-08-10 06:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-10 06:00] C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] C:\DOCUME~1\Scott\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] C:\DOCUME~1\Shawna\STARTM~1\Programs\Startup\ DESKTOP.INI [2004-08-19 17:07:20] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 'InstallVisualStyle'=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles 'InstallTheme'=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\pmkhg] pmkhg.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS	ansgt.sys R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys S3 BCMModem;BCM V.90 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMDM.sys Contents of the 'Scheduled Tasks' folder 2007-08-26 19:22:01 C:\WINDOWS\Tasks\McAfee.com Update Check (CHERIE-Shawna).job - C:\PROGRA~1\mcafee.com\agent\mcupdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-26 14:21:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-26 14:23:43 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-26 14:23  --- E O F ---

Bugbatter · Answer

Sorry that I am late in replying. I did not get email notification of your reply. It appears that you disabled some items using msconfig. Do you recall what they were? Were they files that you did not recognize, or where they legitimate programs that were running? Do you know what this file is? mh.exe Located here: C:\DOCUME~1\Shawna\ mh.exe If you do not, please have it scanned at Jotti, and let me know the results in your next reply. http://virusscan.jotti.org/ _________________ You may have to click on Projects (only if the homepage comes up) and then online Malware Scan to access the virus scan page. If you are at a black page with the title 'Online malware scan', you are in the right place. Click 'Browse...' and navigate to the (bad file> show path) Click 'Open' and then 'Submit' It will take a couple seconds and then the results should be lower on the page. Please copy the information from 'File:' down to 'Norman Virus Control' and post it in your next reply. Please launch HijackThis and place a checkmark next to the following: O2 - BHO: (no name) - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - (no file)O2 - BHO: (no name) - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - (no file)O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/70efdf/games/files/606/popcaploader_v6.cabO20 - Winlogon Notify: pmkhg - pmkhg.dll (file missing) Close all windows except HijackThis and click 'Fix Checked'. Close HijackThis. Reboot. Open Notepad and copy/paste the following bold text between the dotted lines into it. Do not copy the dotted lines. ----------------------------------------------------------------------------------------------- Registry::[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\pmkhg] -------------------------------------------------------------------------------------------------------- Save this as CFScript.txt Referring to the picture above, drag CFScript into ComboFix.exe You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced here: C:\ComboFix.txt Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and the results from Jotti. Let me know how things are running. Thanks.

Shash1213 · Answer

Bugbatter -

MH.exe is an old games program that does not run well in XP, and I stopped playing long ago (Moorhund Jag!). I deleted it just to be sure!

The Dr Watson has been an issue for me for some time, really wish I had come here first! I am sure there were some things I changed in msconfig, based on advice from another website, but that was quite a long time ago. I could not tell you what it was I changed or deleted :( Msconfig is where you can change base settings on your computer, right? I may have gone in to default the numblock to be "on" when the computer starts up, among other things.

I HAVE A BIG PROBLEM: I got through your instructions up to running the Combofix. I got a pop up saying that the Combofix I was running had "expired" and to delete and download a new one. I went back through your instructions, and the first link: http://download.bleepingcomputer.com/sUBs/combofix.exe gives me a 404 Not Found. Second link http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
gives me an error message that some files are corrupt! And then shows a screen with this on it:

Extracting Boot.bat

Extracting CF_anti-viking.bat

Extracting Combobatch.bat

Extracting ComboFix.bat

Extracting Comspec.bat

Extracting DelClsid.bat

Extracting Disclaimer.bat

Extracting FIND3M.bat

Extracting FIXLSP.bat

Extracting history.bat

Extracting Lang.bat

Extracting List-C.bat

CRC failed in List-C.bat
Unexpected end of archive
I know just enough of DOS to know this is a problem...Can you direct me to a better link for Combofix?
Someday, I will have a clean computer :) And I will be a good girl and come here to get advice from now on!!

Bugbatter · Answer

Since you disabled some startup programs using the System Configuration Utility (MSConfig) let's try this:

Launch Notepad, (Start > Run, type in: notepad)
Copy/paste all the bold text below to it:

regedit /e look1.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg"
regedit /e look2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder"
type look1.txt >> startup.txt
type look2.txt >> startup.txt
del look*.txt
start notepad startup.txt

In Notepad, go to File (upper menu bar), and select: Save as
In the Save as prompt:
Save in: Desktop
File Name: Look.bat
Save as Type: All files
Click: Save
Exit out of Notepad.

Next, on the Desktop, double click on Look.bat
This creates a file on the Desktop.

Please provide its content in your reply with other logs requested below.

Between the time you d/l ComboFix and when you tried to run it again, it was updated.
Please delete your old copy.
Delete these files if you can find them:
* Windir\ catchme.exe
* Windir\ nircmd.exe
* SysDir\ swreg.exe
* SysDir\ Swxcacls.exe
* SysDir\ Swsc.exe

Reboot so you can start fresh.

Download a new ComboFix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the links are case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new HijackThis log.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run ComboFix.

Bugbatter · Answer

Good work! Can you please post a fresh HijackThis log now that you have run CF-script? Let me know how things are running. Thanks. Message Edited by Bugbatter on 09-10-2007 08:24 PM

Shash1213 · Answer

Here is the MSCONFIG log:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpybotSD TeaTimer]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TeaTimer"
"hkey"="HKCU"
"command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe"
"inimapping"="0"

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

I deleted Combofix and listed files, rebooted, and reloaded ComboFix. Here is the updated log:

ComboFix 07-09-10.6 - "Shawna" 2007-09-10 19:00:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.566 [GMT -5:00]
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-08-10 to 2007-09-10 )))))))))))))))))))))))))))))))
.

2007-09-10 18:59 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-02 23:05 d-------- C:\Program Files\Return to Mysterious Island
2007-08-26 19:05 d-------- C:\DOCUME~1\Shawna\APPLIC~1\VeniceMysteryData
2007-08-26 14:08 d-------- C:\WINDOWS\pss
2007-08-22 17:46 d-------- C:\Program Files\Trend Micro
2007-08-21 21:06 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Intenium
2007-08-19 12:18 d-------- C:\Hijack This
2007-08-17 22:35 d-------- C:\Program Files\Lavasoft
2007-08-17 22:35 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-08-17 22:35 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-08-15 13:12 d-------- C:\DOCUME~1\Shawna\APPLIC~1\RetroRecords
2007-08-11 15:04 d-------- C:\DOCUME~1\Shawna\APPLIC~1\Magus

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-07 21:13 382364 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2007-09-07 21:13 32536608 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-04 22:59 --------- d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
2007-09-02 15:34 --------- d-------- C:\Program Files\Mystery Case Files - Huntsville
2007-08-09 15:37 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\FloodLightGames
2007-08-09 15:37 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FloodLightGames
2007-07-31 21:22 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\AdobeUM
2007-07-29 21:05 --------- d-------- C:\Program Files\Emerald Tale
2007-07-29 20:58 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\PlayFirst
2007-07-29 20:58 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PlayFirst
2007-07-29 19:57 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Friday's games
2007-07-29 18:53 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Costco Photo Viewer US
2007-07-24 21:12 --------- d-------- C:\Program Files\The Cameron Files
2007-07-22 18:25 --------- d-------- C:\Program Files\Diamonds in the Rough Demo
2007-07-21 22:08 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\7Wonders2
2007-07-19 19:15 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\iolo
2007-07-19 19:15 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo
2007-07-14 22:14 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FireGlow
2007-07-14 22:07 --------- d-------- C:\Program Files\Nancy Drew
2007-07-14 21:54 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-13 19:17 --------- d-------- C:\DOCUME~1\Shawna\APPLIC~1\Big Fish Games
2007-07-12 20:33 --------- d-------- C:\Program Files\XviD
2007-07-12 20:33 --------- d-------- C:\Program Files\Scavenger Hunter Official Demo v1.51
2007-06-21 21:54 75248 --a------ C:\WINDOWS\zllsputility.exe
2007-06-21 21:54 1086952 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll
2006-03-15 23:43 774144 --a------ C:\Program Files\RngInterstitial.dll
2006-02-19 03:28 12288 --a------ C:\WINDOWS\Fonts\RandFont.dll
2005-07-01 22:37 251 --a------ C:\Program Files\wt3d.ini
2004-07-17 19:39 4354084 --------- C:\DOCUME~1\Shawna\spybotsd13.exe
2004-07-17 19:16 2247855 --------- C:\DOCUME~1\Shawna\spywareblastersetup.exe
2003-10-12 22:46 441088 --------- C:\DOCUME~1\Shawna\GoogleToolbarInstaller.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04]
"IAAnotif"="C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 13:16]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 13:52]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 21:12]
"CTSysVol"="C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43]
"P17Helper"="P17.dll" [2004-06-10 12:51 C:\WINDOWS\SYSTEM32\P17.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 17:54]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2004-09-14 09:50]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-09-14 09:50]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-03-04 04:19]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-10 18:36]
"LifeScape Media Detector"="C:\Program Files\Picasa\PicasaMediaDetector.exe" [2005-04-26 19:01]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-08-17 22:05]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-10 06:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-19 17:07:20]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 07:56:20]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-08-08 15:00:00]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 12:59:36]

C:\DOCUME~1\ADMINI~1\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-19 17:07:20]

C:\DOCUME~1\Scott\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-19 17:07:20]

C:\DOCUME~1\Shawna\STARTM~1\Programs\Startup\
DESKTOP.INI [2004-08-19 17:07:20]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

R2 litsgt;litsgt;C:\WINDOWS\system32\DRIVERS\litsgt.sys
R2 tansgt;tansgt;C:\WINDOWS\system32\DRIVERS\tansgt.sys
R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys
S3 BCMModem;BCM V.90 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMDM.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-09-11 00:02:00 C:\WINDOWS\Tasks\McAfee.com Update Check (CHERIE-Shawna).job"
- C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 19:04:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-10 19:05:20
C:\ComboFix-quarantined-files.txt ... 2007-09-10 19:05
.
--- E O F ---

Thanks again for all of this help!

Shash1213 · Answer

Bugbatter -   Here is my latest HiJackThis log:   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:55:17 AM, on 9/13/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\slpservice.exe C:\WINDOWS\system32\slpmonx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Picasa\PicasaMediaDetector.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\Grisoft\AVG7\avgw.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400 R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ZoneAlarm Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SurfXccelerator\surfx.exe/250 O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SurfXccelerator\surfx.exe/227 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe -- End of file - 9233 bytes   *************************** The last time I was on my computer (on the 10th), I did get the blue screen again, and it warned that it was doing a physical memory dump.  I did a hard shut down, and have only been able to get back on my computer today (due to time on my part to do so).

Bugbatter · Answer

Your log appears to be clean, but as I mentioned when we started, "It looks as if you had an incomplete removal of infection. I'm not sure how you removed it, so I do not know if any legitimate files were removed in that process, but I'll try my best to get you on the right track."

Download and scan each user profile with CCleaner:
http://www.ccleaner.com/download/builds
** Select to download the BASIC version.
1. Before first use, select Options > Advanced and UNCHECK
" Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the " Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click " OK" and it will scan and clean your system.
6. Click " exit" when done.
REBOOT.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "Java Runtime Environment (JRE) 6u2 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.

After that, please post a fresh Hijackthis log and let me know how things are running.

Shash1213 · Answer

Bugbatter -

Thank you again for all of your assistance with this! I have installed and run CCleaner, and I updated my Java. Here is the latest HIJACK THIS log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:34:52 PM, on 9/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slpservice.exe
C:\WINDOWS\system32\slpmonx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SurfXccelerator\surfx.exe/250
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SurfXccelerator\surfx.exe/227
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

--
End of file - 9422 bytes

I will let you know if I keep getting the blue screen. Dr Watson did stop showing up after the first round of fixes...

Bugbatter · Answer

We're almost finished. :) Your log is not showing any malware. There are some optional entries that you can fix because they use resources and may not be necessary at Startup based on your needs.
Fixing them here will not prevent you from opening them manually as needed.
Place a checkmark next to the ones you would like to fix:

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
(Description: A small program that reminds you to register your Creative Labs product (i.e. sound card, video card). Unnecessary. Removing this will free up a small amount of system resources.)

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
(Description: RealPlayer system tray application. Not necessary. Removing this entry will free up a small amount of system resources.)

O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
(Description: Microsoft Office startup assistant. Not necessary. Removing this entry will free up a significant amount of system resources.)

Please close all windows except HijackThis and click "Fix Checked". Close HijackThis and reboot.

Because the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, along with the folders created by these tools.

Please download the OTMoveIt by OldTimer

Save it to your desktop.
Run the tool by clicking on the icon.
Click the Cleanup button.
The tools that we used as well as this one will be removed from your system.

OTMoveIt will not delete HijackThis.
Please post a fresh HijackThis log for final review. By then you should have a good idea of how things are running.

Shash1213 · Answer

Final Hijack this file (I hope!!)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:37 PM, on 9/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slpservice.exe
C:\WINDOWS\system32\slpmonx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Picasa\PicasaMediaDetector.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LifeScape Media Detector] C:\Program Files\Picasa\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\SurfXccelerator\surfx.exe/250
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\SurfXccelerator\surfx.exe/227
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

--
End of file - 9120 bytes

I did get another blue screen, I think it was because of the game I was playing though, and nothing serious. I turned teatimer back on.

Bugbatter, thank you so much for your help with this!

Shash1213

Bugbatter · Answer

Excellent!

After something like this it is a good idea to purge the Restore Points and start fresh.
If everything is running well....
To flush the XP System Restore Points:
(Using XP, you must be logged in as Administrator to do this.)
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn Off System Restore.

Reboot. Go back in and turn System Restore ON. A new Restore Point will be created.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

You may have already taken some of these steps:
1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Adjust your security settings for ActiveX:
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

3. Download and install the following free programs:
a. SpywareBlaster: (Not recommended for Vista)
http://www.javacoolsoftware.com/spywareblaster.html
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
b. SpywareGuard:
http://www.javacoolsoftware.com/spywareguard.html
Tutorial here: http://www.bleepingcomputer.com/tutorials/tutorial50.html
Periodically check for updates in both programs.

4. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (Zone Labs) http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads
Sunbelt Kerio has a free version: http://www.kerio.com/kpf_download.html

5. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

6. Install spyware detection and removal programs:
You may also want to consider installing either or both of AdAware (free version) and Spybot S&D (freeware). Use these programs to regularly scan your system for and remove many forms of spyware/malware.

a. Ad-aware: http://www.lavasoft.de/software/adaware/

b. SpyBot S&D: http://safer-networking.org/en/news/2005-05-31.html

I would check for updates in SpyBot once a week or so.
Check for updates in Ad-aware frequently.

7. Before using or purchasing any Spyware/Malware protection/removal program, always check the following Rogue/Suspect Spyware Lists.
http://www.spywarewarrior.com/rogue_anti-spyware.htm
http://www.malwarebytes.org/database.php

8. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

9. If you use Adobe Reader it may need to be updated to be sure that you have a more secure version. If you are using a version prior to v. 6.05, you should update to 6.05, preferably version 8.1.0 or higher.
It would be best to remove prior versions before updating to a new version.
If you need additional assistance, the Adobe forums are here: http://www.adobe.com/support/forums/main.html

10. Make sure you are using the most updated version of Java.
The current version is Java Runtime Environment (JRE) 6u2
You can go here to download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says " Java Runtime Environment (JRE) 6u2 allows end-users to run Java applications".

Click the link to download the Windows (Offline Installation) package: Save it, do not run it. When the download is complete, close the browser.

Remove all prior versions using Add/Remove Programs, and delete the Java folder in Program Files.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.
Official JAVA Installation Instructions if needed.
Reboot.

11. Practice Safe Surfing with with TrendProtect by Trendmicro.
TrendProtect is a browser plugin that assigns a safety rating to domains listed in your search engine. TrendProtect also adds a new button to your browser's toolbar area. The icon and color of the button changes to indicate whether the page currently open is safe, unsafe, trusted, or unrated, or whether it contains unwanted content.

The following color codes are used by TrendProtect to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

12. Here are some helpful articles:
"So how did I get infected in the first place?"
by TonyKlein
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

13. This is an excellent resource for users of all levels. General computer maintenance as well as internet security is covered.
Rootkits for Dummies
(Paperback)
by Larry Stevenson (Author), Nancy Altholz (Author)

Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!

Virus & Spyware

Dr Watson Messages and Blue Screen/Computer freezes

Was this post helpful?