Help Please- Redirects, slow internet and system restore not working

Question

Hello, I have posted the (Hijack This) log below. Recently I have been having problems with redirects when surfing the net and slower uploads. I just want to make sure I catch anything that make have made its way into my system if any thing. I do have Windows Defender and SpyWareBot that run regulary. Another thing I have noticed on my System Restore I cannot change the Months on the Calendar, there are no bold dates either.   Any help will be greatly appreciated !!!  Thanks in advance !   Rwp7727          Logfile of HijackThis v1.99.1Scan saved at 9:18:27 PM, on 2/26/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\ehome\mcrdsvc.exeC:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\WINDOWS\stsystra.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Windows Defender\MSASCui.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\WinSecureDisc\app.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Program Files\SpywareBot\SpywareBot.exeC:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exeC:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exeC:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.ev1.net/O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {408C4B0D-075D-4779-8646-8804893D7866} - c:\windows\system32\cmpbk32v.dllO2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: PeoplePC ScamGuard - {7E3659A6-4BC5-4d93-B3FD-8B5ACC2FEDED} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dllO2 - BHO: (no name) - {B446B552-3BF8-458E-8753-7EC078FBE565} - C:\WINDOWS\system32\dmconfigk.dllO2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dllO3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe'O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [IAAnotif] 'C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe'O4 - HKLM\..\Run: [ATIPTA] 'C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe'O4 - HKLM\..\Run: [IntelMeM] 'C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe'O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [Bart Station] 'C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe' -STATIONO4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [WinSecureDisc] 'C:\Program Files\WinSecureDisc\app.exe'O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKCU\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -bootO4 - HKCU\..\Run: [DellTransferAgent] 'C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe'O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeO8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228'O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227'O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {6E4052AD-00D3-5248-7DCF-21F54F1D4333} - http://85.255.115.229/1/gdnUS1440.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{2D56AF6B-83E5-4A6B-8900-B90D0282606C}: NameServer = 209.244.0.3 209.244.0.4O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO20 - Winlogon Notify: yegyvrfm - C:\WINDOWS\SYSTEM32\cmpbk32v.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

bamajim · Answer

Rwp7727

Please download Combofix and save to your desktop:

Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Rwp7727 · Answer

bamajim, Thanks for the reply. I will work on this now and post tonight.    Rwp7727

Rwp7727 · Answer

bamajim,

Ok here is the log that was saved from Combofix as requested......

ComboFix 08-02-25.3 - Ryan Potter 2008-02-27 18:49:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.108 [GMT -6:00]
Running from: C:\Documents and Settings\Ryan Potter\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\cmpbk32v.dll
C:\WINDOWS\system32\dmconfigk.dll
C:\WINDOWS\system32\drivers\adjbzmft.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_GPHMNRGU
-------\LEGACY_QETMBPCD
-------\gphmnrgu
-------\qetmbpcd

((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-28 )))))))))))))))))))))))))))))))
.

2008-01-29 21:22 . 2008-01-29 21:22

d-------- C:\Documents and Settings\All Users\Application Data\Dell

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 04:24 --------- d-----w C:\Program Files\WinSecureDisc
2008-01-19 06:16 --------- d-----w C:\Program Files\BearShare Applications
2008-01-19 06:15 --------- d-----w C:\Documents and Settings\Ryan Potter\Application Data\SpywareBot
2008-01-19 05:55 --------- d-----w C:\Program Files\SpywareBot
2006-03-30 01:44 0 ---ha-w C:\Documents and Settings\All Users\Application Data\gwseh.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208]
"WinSecureDisc"="C:\Program Files\WinSecureDisc\app.exe" [2006-09-16 18:25 1110016]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09 460784]
"SpywareBot"="C:\Program Files\SpywareBot\SpywareBot.exe" [2008-01-17 14:00 6362352]
"DellTransferAgent"="C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" [2007-11-13 15:46 135168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01 67584]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48 32881]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 339968 C:\WINDOWS\stsystra.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 07:56 139264]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 344064]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12 221184]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05 127035]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44 81920]
"Bart Station"="C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe" [2006-03-21 20:40 20480]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 17:20 866584]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2005-08-31 11:06 106496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-15 11:39 98304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2003-07-15 04:53 34880]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-04-09 12:54:54 54776]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2006-02-15 11:45 168448 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gwiz]
C:\Documents and Settings\Ryan Potter\Application Data\43829.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-02-15 11:39 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2006-02-15 11:39 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]
appsecdll REG_EXPAND_SZ C:\WINDOWS\system32\AppCert\wsil32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=

R2 winsecuredisc;winsecuredisc;C:\Program Files\WinSecureDisc\drv\xpdriver.sys [2006-09-16 18:25]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-27 03:11:12 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-02-28 00:56:10 C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job"
- C:\Program Files\SpywareBot\SpywareBot.ex
- C:\Program Files\SpywareBot
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 18:56:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exe
.
**************************************************************************
.
Completion time: 2008-02-27 18:57:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-28 00:57:45
.
2008-02-27 03:07:15 --- E O F ---

Rwp7727 · Answer

bamajim, One question, since I ran the Combofix my Corel Photo Downloader no longer works when I plug in my camera photo card to download images from it, is this reversable ?   Thanks !

bamajim · Answer

Rwp7727

Making progress, but we still have some work to do here.

One question, since I ran the Combofix my Corel Photo Downloader no longer works when I plug in my camera photo card to download images from it, is this reversable ?

It shouldn't have affected that program, the files removed had nothing to do with Corel. However I would recommend that you not attach any removable storage devices to the PC until we are finished cleaning the infection.

1. Open NotePad (not wordpad). Copy and paste the following into Notepad

File::
C:\WINDOWS\system32\AppCert\wsil32.dll
C:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job

Folder::
C:\Documents and Settings\Ryan Potter\Application Data\SpywareBot
C:\Program Files\SpywareBot

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareBot"=-

Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop

Using the Image as a reference, drag CFScript into ComboFix.exe

user posted image

You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply

2. Rerun Hijackthis and post a fresh Hijackthis log as well

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Rwp7727 · Answer

will do, will post both shortly Message Edited by Rwp7727 on 02-27-2008 09:03 PM

Rwp7727 · Answer

bamajim,Here are the log files as requested..........   ComboFix 08-02-25.3 - Ryan Potter 2008-02-27 21:04:45.2 - NTFSx86Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.154 [GMT -6:00]Running from: C:\Documents and Settings\Ryan Potter\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\Ryan Potter\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE ::C:\WINDOWS\system32\AppCert\wsil32.dllC:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). C:\Documents and Settings\Ryan Potter\Application Data\SpywareBotC:\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Log\2008 Feb 27 - 06_56_09 PM_437.logC:\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Log\2008 Feb 27 - 07_55_39 PM_750.logC:\Documents and Settings\Ryan Potter\Application Data\SpywareBots.datC:\Program Files\SpywareBotC:\Program Files\SpywareBot\AddOns\PostQuarantine.pieC:\Program Files\SpywareBot\DataBase.refC:\Program Files\SpywareBot\Launcher.exeC:\Program Files\SpywareBot\SpyCleaner.dllC:\Program Files\SpywareBot\SpywareBot.exeC:\Program Files\SpywareBot\SpywareBot.urlC:\Program Files\SpywareBot\TCL.dllC:\Program Files\SpywareBot\vistaCPtasks.xmlC:\Program Files\SpywareBot\zlib.dllC:\WINDOWS\system32\AppCert\wsil32.dllC:\WINDOWS\Tasks\SpywareBot Scheduled Scan.job .(((((((((((((((((((((((((   Files Created from 2008-01-28 to 2008-02-28  ))))))))))))))))))))))))))))))). 2008-01-29 21:22 . 2008-01-29 21:22   d-------- C:\Documents and Settings\All Users\Application Data\Dell .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-01-25 04:24 --------- d-----w C:\Program Files\WinSecureDisc2008-01-19 06:16 --------- d-----w C:\Program Files\BearShare Applications2006-03-30 01:44 0 ---ha-w C:\Documents and Settings\All Users\Application Data\gwseh.dat. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 10:24 1694208]'WinSecureDisc'='C:\Program Files\WinSecureDisc\app.exe' [2006-09-16 18:25 1110016]'DellSupport'='C:\Program Files\DellSupport\DSAgnt.exe' [2007-03-15 10:09 460784]'DellTransferAgent'='C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe' [2007-11-13 15:46 135168] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ehTray'='C:\WINDOWS\ehome\ehtray.exe' [2005-09-29 14:01 67584]'SunJavaUpdateSched'='C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe' [2003-11-19 17:48 32881]'SigmatelSysTrayApp'='stsystra.exe' [2005-03-23 00:20 339968 C:\WINDOWS\stsystra.exe]'IAAnotif'='C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe' [2005-06-17 07:56 139264]'ATIPTA'='C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe' [2005-08-05 21:05 344064]'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 20:12 221184]'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2005-02-23 16:19 53248]'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2004-12-06 01:05 127035]'ISUSPM Startup'='C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' [2005-06-10 10:44 249856]'ISUSScheduler'='C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' [2005-06-10 10:44 81920]'Bart Station'='C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe' [2006-03-21 20:40 20480]'Windows Defender'='C:\Program Files\Windows Defender\MSASCui.exe' [2006-11-03 17:20 866584]'Corel Photo Downloader'='C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe' [2005-08-31 11:06 106496]'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-02-15 11:39 98304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'DWQueuedReporting'='C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' [2003-07-15 04:53 34880] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2007-04-09 12:54:54 54776] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]'InstallVisualStyle'= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles'InstallTheme'= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]'AppInit_DLLs'=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnkbackup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]--a------ 2006-02-15 11:45 168448 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gwiz]C:\Documents and Settings\Ryan Potter\Application Data\43829.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]--a------ 2006-02-15 11:39 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]--a------ 2006-02-15 11:39 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]appsecdll REG_EXPAND_SZ   C:\WINDOWS\system32\AppCert\wsil32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\Common Files\AOL\ACS\AOLDial.exe'='C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe'='C:\Program Files\Messenger\msmsgs.exe'='C:\Program Files\America Online 9.0\waol.exe'='C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe'= R2 winsecuredisc;winsecuredisc;C:\Program Files\WinSecureDisc\drv\xpdriver.sys [2006-09-16 18:25] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]\Shell\AutoRun\command - E:\setup.exe .Contents of the 'Scheduled Tasks' folder'2008-02-28 01:57:13 C:\WINDOWS\Tasks\MP Scheduled Scan.job'- C:\Program Files\Windows Defender\MpCmdRun.exe.************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-02-27 21:39:10Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 **************************************************************************.------------------------ Other Running Processes ------------------------.C:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeC:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeC:\WINDOWS\ehome\mcrdsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exeC:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exe.**************************************************************************.Completion time: 2008-02-27 21:42:21 - machine was rebootedComboFix-quarantined-files.txt  2008-02-28 03:42:18ComboFix2.txt  2008-02-28 00:57:49.2008-02-27 03:07:15 --- E O F ---      Logfile of HijackThis v1.99.1Scan saved at 9:42:55 PM, on 2/27/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeC:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\WINDOWS\stsystra.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exeC:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\WinSecureDisc\app.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exeC:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeC:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32
otepad.exeC:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.ev1.net/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: PeoplePC ScamGuard - {7E3659A6-4BC5-4d93-B3FD-8B5ACC2FEDED} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dllO2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dllO3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe'O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [IAAnotif] 'C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe'O4 - HKLM\..\Run: [ATIPTA] 'C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe'O4 - HKLM\..\Run: [IntelMeM] 'C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe'O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [Bart Station] 'C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe' -STATIONO4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [WinSecureDisc] 'C:\Program Files\WinSecureDisc\app.exe'O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKCU\..\Run: [DellTransferAgent] 'C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe'O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeO8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228'O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227'O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {6E4052AD-00D3-5248-7DCF-21F54F1D4333} - http://85.255.115.229/1/gdnUS1440.exeO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

bamajim · Answer

Rwp7727

Looking good so far

1. Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu.

This will remove all files from the items that are checked so if you have some cookies you'd like to save. please move them to a different directory first

2. Run an online virus scan called Kaspersky from HERE.

1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. When the scan is complete Select "Save error report as"
Then in the file name just type in kaspersky
Under "save as type" select text .txt
Save it to your Desktop.

Copy and post the results of the Kaspersky Online scan

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Rwp7727 · Answer

bamajim,

I have downloaded and run the ATFcleaner. I attempted to run the Kaspersky Online Scanner but once it was finished I recieved a error message stating (unable to complete due to not having the admin rights to the machine and/or security settings need to be set to Medium). I have admin rights and the security was set to Med, I tried 3 times to run so im not sure why it wouldnt complete. ??

bamajim · Answer

Rwp7727

Sometimes the onlines can be finicky, let's just use another one.

Please perform an Ewido Online Malware Scan

When a dialog box appears asking you if you would like to download and install the ewido anti-spyware online scanner please click Yes to allow the download.
Click on Start Scan.
after the scan completes it will produce a log for you, copy and paste the results of that scan as a reply to this thread
If any infections are found, (After you save the logfile), Click on Remove Infections.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Rwp7727 · Answer

Hello bamajim,

Here is the log from Ewido as requested.

__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________

Name: TrackingCookie.Advertising
Path: C:\Documents and Settings\Ryan Potter\Cookies\ryan potter@advertising[1].txt
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\Documents and Settings\Ryan Potter\Cookies\ryan potter@doubleclick[1].txt
Risk: Medium

Name: TrackingCookie.Netflame
Path: C:\Documents and Settings\Ryan Potter\Cookies\ryan potter@ssl-hints.netflame[2].txt
Risk: Medium

Name: TrackingCookie.Trafficmp
Path: C:\Documents and Settings\Ryan Potter\Cookies\ryan potter@trafficmp[1].txt
Risk: Medium

Name: TrackingCookie.Yieldmanager
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\0.qit.vir
Risk: Medium

Name: TrackingCookie.Euroclick
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\1.qit.vir
Risk: Medium

Name: TrackingCookie.Realmedia
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\10.qit.vir
Risk: Medium

Name: TrackingCookie.Trafficmp
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\12.qit.vir
Risk: Medium

Name: TrackingCookie.Advertising
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\3.qit.vir
Risk: Medium

Name: TrackingCookie.Atdmt
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\4.qit.vir
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\5.qit.vir
Risk: Medium

Name: TrackingCookie.Fastclick
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\6.qit.vir
Risk: Medium

Name: TrackingCookie.Mediaplex
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\7.qit.vir
Risk: Medium

Name: TrackingCookie.Overture
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\8.qit.vir
Risk: Medium

Name: TrackingCookie.Overture
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\25-02-2008-20-16-46\9.qit.vir
Risk: Medium

Name: TrackingCookie.Atdmt
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\26-02-2008-22-35-25\0.qit.vir
Risk: Medium

Name: TrackingCookie.Doubleclick
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\26-02-2008-22-35-25\1.qit.vir
Risk: Medium

Name: TrackingCookie.Fastclick
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\26-02-2008-22-35-25\2.qit.vir
Risk: Medium

Name: TrackingCookie.Trafficmp
Path: C:\QooBox\Quarantine\C\Documents and Settings\Ryan Potter\Application Data\SpywareBot\Quarantine\26-02-2008-22-35-25\4.qit.vir
Risk: Medium

bamajim · Answer

Rwp7727   Nice. Post one more fresh Hiajckthis log :smileyhappy:     Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

Rwp7727 · Answer

bamajim, Here is the fresh Hijack log as requested...   Logfile of HijackThis v1.99.1Scan saved at 10:01:43 PM, on 2/29/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeC:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\ehome\ehtray.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\WINDOWS\stsystra.exeC:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\PeoplePC\ISP6300\Browser\Bartshel.exeC:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\WinSecureDisc\app.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exeC:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeC:\PROGRA~1\PeoplePC\ISP6300\Browser\PPShared.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Outlook Express\msimn.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.ev1.net/O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: PeoplePC ScamGuard - {7E3659A6-4BC5-4d93-B3FD-8B5ACC2FEDED} - C:\Program Files\PeoplePC\Toolbar\ScamGrd.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dllO2 - BHO: GoogleAFE - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dllO3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe'O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exeO4 - HKLM\..\Run: [IAAnotif] 'C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe'O4 - HKLM\..\Run: [ATIPTA] 'C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe'O4 - HKLM\..\Run: [IntelMeM] 'C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe'O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startupO4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -startO4 - HKLM\..\Run: [Bart Station] 'C:\Program Files\PeoplePC\ISP6300\BIN\PPCOLink.exe' -STATIONO4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [WinSecureDisc] 'C:\Program Files\WinSecureDisc\app.exe'O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKCU\..\Run: [DellTransferAgent] 'C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe'O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exeO8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228'O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227'O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cabO16 - DPF: {6E4052AD-00D3-5248-7DCF-21F54F1D4333} - http://85.255.115.229/1/gdnUS1440.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{2D56AF6B-83E5-4A6B-8900-B90D0282606C}: NameServer = 209.244.0.3 209.244.0.4O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLLO20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dllO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dllO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

bamajim · Answer

Rwp7727

You have a suspicious file I'd like to have a look at.

Please go HERE

Put Your Name, and Dell HJT forum

and In the file to submit box, click Browse.Using Windows Explorer

(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)

Locate the file

C:\Program Files\WinSecureDisc\app.exe

In the comments tell them that I asked you to upload the file
Then Select Send File.

When you have uploaded the file, please respond. Thanks

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Rwp7727 · Answer

bamjim,

When tring to send file you requested I recieved the following response from uploadmalware.com......................

Your file (WinSecureDisc) was 0 bytes and could not be uploaded. Please try disabling any anti-virus software and trying the upload again.Your file () was 0 bytes and could not be uploaded. Please try disabling any anti-virus software and trying the upload again.

Virus & Spyware

Help Please- Redirects, slow internet and system restore not working

Was this post helpful?