My HijackThis log

Question

Well i decided to download a pack for a small game on limewire. Instead I got a virus. My antivirus is constantly poppin up sayin it got rid of trojans, and trojan horses. Ive scanned with it to but there still there. Adds constantly pop up and when i hit ctrl alt del and hit processes theres a bunch of little programs running that i dont know what they are. My computer is really messed up so please help me out. Anyways thanks     Logfile of HijackThis v1.99.1 Scan saved at 11:14:20 AM, on 07/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe C:\Program Files\Windows Media Connect 2\WMCCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\qwerty12.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Michael Rendon\My Documents\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {0d6ed790-a13a-4dc1-abe0-a9754450e87a} - C:\WINDOWS\system32\d3ddlv.dll O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32	mpB.tmp.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe O4 - HKLM\..\Run: [Windows Media Connect 2] 'C:\Program Files\Windows Media Connect 2\WMCCFG.exe' /StartQuiet O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Steam] 'C:\Program Files\Valve\Steam\Steam.exe' -silent O4 - HKCU\..\Run: [DW4] 'C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163654940968 O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4800/mcfscan.cab O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll O20 - Winlogon Notify: d3ddlv - C:\WINDOWS\SYSTEM32\d3ddlv.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Bugbatter · Answer

Welcome :) Yes, I see some issues in your log. Please note that the infections that we need to clean need to be fixed in a specific order or they will return. Therefore, following these steps as written is important.

Please download Combofix from here: http://download.bleepingcomputer.com/sUBs/combofix.exe
Or
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the links are case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run combofix.

Please delete your outdated copy of HijackThis and please download the new version. That will show us even more about what we are dealing with.

Please download HJT Installer from Here to your desktop.
If not available use this alternate link: Here

Click the Download button.
When the Trend Micro HJT install box appears, double click on the HJTInstall.exe.
Click on Install.

It will be installed by default here: C:\Program Files\Trend Micro\HijackThis

A shortcut to the application will also be placed on your Desktop.

The program will open automatically after installation.

You can double-click the icon that was placed on the Desktop to run subsequent HijackThis scans or you can use the icon inside the folder.
The folder HijackThis is where you will find the HJT logs that you save. When you use the application to remove anything, you will also find the backup copies made by HJT inside this folder.

Click on " Do a system scan and save logfile" When the log pops up in Notepad, copy and paste that file along with the log from ComboFix and post both in your next reply here.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

Before closing HJT, please click on the AnalyzeThis button. Close the web page that appears and then close the program HJT.

If the forum software will not take all the text from both logs, just use several posts by replying to yourself until all text is posted.

Message Edited by Bugbatter on 07-10-2007 01:28 PM

screekrunner · Answer

Thanks you for helping me out and here are the two logs you asked for. So far everything worked the way your directions said the would.     'Michael Rendon' - 2007-07-10 14:19:21 - ComboFix 07-07-10.1 - Service Pack 2  ((((((((((((((((((((((((((((((((((((((((((((   V Log   ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\jkhfcda.dll C:\WINDOWS\system32\ssqrsro.dll * * *  POST RUN FILES/FOLDERS  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\MICHAE~1\APPLIC~1	mp11.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp12.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp14.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp27.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp28.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp29.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp32.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp424.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp42B.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp42F.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp431.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp432.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp8F7.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp8F8.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp8FB.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp9.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp934.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp935.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp936.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp946.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp948.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp949.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp965.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp966.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mpA.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mpB.tmp.exe C:\Program Files\Common Files\pppatc~1 C:\WINDOWS\system32\bang-006.ico C:\WINDOWS\system32\msnav32.ax C:\WINDOWS\system32	mp12.tmp.dll C:\WINDOWS\system32	mp28.tmp.dll C:\WINDOWS\system32	mp424.tmp.dll C:\WINDOWS\system32	mp431.tmp.dll C:\WINDOWS\system32	mp8F8.tmp.dll C:\WINDOWS\system32	mp935.tmp.dll C:\WINDOWS\system32	mp948.tmp.dll C:\WINDOWS\system32	mp966.tmp.dll C:\WINDOWS\system32	mpB.tmp.dll C:\WINDOWS\system32\zxdnt3d.cfg C:\WINDOWS\uninst2.htm C:\WINDOWS\unist1.htm (((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CMDSERVICE -------\LEGACY_DOMAINSERVICE -------\LEGACY_NETWORK_MONITOR -------\DomainService (((((((((((((((((((((((((   Files Created from 2007-06-10 to 2007-07-10  ))))))))))))))))))))))))))))))) 2007-07-10 14:20   d-------- C:\Program Files\Trend Micro 2007-07-10 14:18 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-07-09 19:51 55,235 --a------ C:\WINDOWS\system32\qwerty12.exe 2007-07-08 19:58 92,726 --a------ C:\WINDOWS\system32\d3ddlv.dll 2007-07-08 19:58 138,398 --a------ C:\WINDOWS\system32\dn2c07bc1e.dat 2007-07-08 19:43   d-------- C:\Program Files\Pocket Tanks Deluxe ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-10 18:27:13 -------- d-----w C:\Program Files\Symantec AntiVirus 2007-06-27 15:26:44 1,324 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-06-26 03:50:02 -------- d-----w C:\DOCUME~1\MICHAE~1\APPLIC~1\Azureus 2007-06-04 19:37:26 -------- d-----w C:\Program Files\Azureus 2007-06-04 19:37:02 -------- d-----w C:\Program Files\AIM6 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2006-03-19 20:58:37 56 --sh--r C:\WINDOWS\system32\4B22DF3795.sys 2006-03-19 20:58:42 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0d6ed790-a13a-4dc1-abe0-a9754450e87a}] 2007-07-08 19:58 92726 --a------ C:\WINDOWS\system32\d3ddlv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe' [2006-05-03 02:56] 'HostManager'='C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe' [2006-05-09 20:24] 'Windows Media Connect 2'='C:\Program Files\Windows Media Connect 2\WMCCFG.exe' [2005-10-06 19:12] 'iTunesHelper'='C:\Program Files\iTunes\iTunesHelper.exe' [2006-09-25 15:54] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-12-05 17:34] 'NvCplDaemon'='C:\WINDOWS\system32\NvCpl.dll' [2005-07-20 21:07] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 12:24] 'Steam'='C:\Program Files\Valve\Steam\Steam.exe' [2007-06-29 19:35] 'Aim6'='' [] 'DW4'='C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' [2006-04-19 09:30] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 07:00] [HKEY_USERS\.default\software\microsoft\windows\currentversionun] 'MySpaceIM'=C:\Program Files\MySpace\IM\MySpaceIM.exe 'DWQueuedReporting'='C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\d3ddlv] d3ddlv.dll 2007-07-08 19:58 92726 C:\WINDOWS\system32\d3ddlv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 'appinit_dlls'=c:\windows\system32\ssqrsro.dll Contents of the 'Scheduled Tasks' folder 2007-07-06 15:54:00  C:\WINDOWS	asks\AppleSoftwareUpdate.job 2007-07-06 22:30:00  C:\WINDOWS	asks\McAfee.com Scan for Viruses - My Computer (D9J4V191-Michael Rendon).job 2007-07-10 18:30:01  C:\WINDOWS	asks\User_Feed_Synchronization-{0B07D1DA-5A61-4854-BE9D-D73CF9DE28BA}.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-10 14:28:16 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-10 14:31:41 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-10 14:31 C:\ComboFix2.txt ... 2006-12-18 19:24 C:\ComboFix3.txt ... 2006-12-15 17:52  --- E O F ---             Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:36:18 PM, on 07/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe C:\Program Files\Windows Media Connect 2\WMCCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32
otepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {0d6ed790-a13a-4dc1-abe0-a9754450e87a} - C:\WINDOWS\system32\d3ddlv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe O4 - HKLM\..\Run: [Windows Media Connect 2] 'C:\Program Files\Windows Media Connect 2\WMCCFG.exe' /StartQuiet O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Steam] 'C:\Program Files\Valve\Steam\Steam.exe' -silent O4 - HKCU\..\Run: [DW4] 'C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163654940968 O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4800/mcfscan.cab O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll O20 - Winlogon Notify: d3ddlv - C:\WINDOWS\SYSTEM32\d3ddlv.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6319 bytes

Bugbatter · Answer

We're getting there, but we have more work to do... Please run ComboFix once more, following the same instructions above, and post a new log from that as well as a fresh HijackThis log.

screekrunner · Answer

'Michael Rendon' - 2007-07-10 23:43:04 - ComboFix 07-07-10.1 - Service Pack 2  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\MICHAE~1\APPLIC~1	mp11.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp62.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp64.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp66.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp84.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp85.tmp.exe C:\DOCUME~1\MICHAE~1\APPLIC~1	mp86.tmp.exe C:\WINDOWS\system32	mp11.tmp.dll C:\WINDOWS\system32	mp66.tmp.dll C:\WINDOWS\system32	mp86.tmp.dll (((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE -------\DomainService (((((((((((((((((((((((((   Files Created from 2007-06-11 to 2007-07-11  ))))))))))))))))))))))))))))))) 2007-07-10 14:20   d-------- C:\Program Files\Trend Micro 2007-07-10 14:18 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-07-09 19:51 55,235 --a------ C:\WINDOWS\system32\qwerty12.exe 2007-07-08 19:58 92,726 --a------ C:\WINDOWS\system32\d3ddlv.dll 2007-07-08 19:58 138,905 --a------ C:\WINDOWS\system32\dn2c07bc1e.dat 2007-07-08 19:43   d-------- C:\Program Files\Pocket Tanks Deluxe ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-11 03:48:29 -------- d-----w C:\Program Files\Symantec AntiVirus 2007-06-27 15:26:44 1,324 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-06-26 03:50:02 -------- d-----w C:\DOCUME~1\MICHAE~1\APPLIC~1\Azureus 2007-06-04 19:37:26 -------- d-----w C:\Program Files\Azureus 2007-06-04 19:37:02 -------- d-----w C:\Program Files\AIM6 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2006-03-19 20:58:37 56 --sh--r C:\WINDOWS\system32\4B22DF3795.sys 2006-03-19 20:58:42 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0d6ed790-a13a-4dc1-abe0-a9754450e87a}] 2007-07-08 19:58 92726 --a------ C:\WINDOWS\system32\d3ddlv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{938A8A03-A938-4019-B764-03FF8D167D79}]    C:\WINDOWS\system32	mp86.tmp.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe' [2006-05-03 02:56] 'HostManager'='C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe' [2006-05-09 20:24] 'Windows Media Connect 2'='C:\Program Files\Windows Media Connect 2\WMCCFG.exe' [2005-10-06 19:12] 'iTunesHelper'='C:\Program Files\iTunes\iTunesHelper.exe' [2006-09-25 15:54] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-12-05 17:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 12:24] 'Steam'='C:\Program Files\Valve\Steam\Steam.exe' [2007-06-29 19:35] 'Aim6'='' [] 'DW4'='C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' [2006-04-19 09:30] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 07:00] [HKEY_USERS\.default\software\microsoft\windows\currentversionun] 'MySpaceIM'=C:\Program Files\MySpace\IM\MySpaceIM.exe 'DWQueuedReporting'='C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\d3ddlv] d3ddlv.dll 2007-07-08 19:58 92726 C:\WINDOWS\system32\d3ddlv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 'appinit_dlls'=c:\windows\system32\ssqrsro.dll Contents of the 'Scheduled Tasks' folder 2007-07-06 15:54:00  C:\WINDOWS	asks\AppleSoftwareUpdate.job 2007-07-06 22:30:00  C:\WINDOWS	asks\McAfee.com Scan for Viruses - My Computer (D9J4V191-Michael Rendon).job 2007-07-11 03:50:00  C:\WINDOWS	asks\User_Feed_Synchronization-{0B07D1DA-5A61-4854-BE9D-D73CF9DE28BA}.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-10 23:48:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-10 23:51:31 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-10 23:51 C:\ComboFix2.txt ... 2007-07-10 14:31 C:\ComboFix3.txt ... 2006-12-18 19:24  --- E O F ---   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:54:31 PM, on 07/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe C:\Program Files\Windows Media Connect 2\WMCCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Valve\Steam\Steam.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32
otepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {0d6ed790-a13a-4dc1-abe0-a9754450e87a} - C:\WINDOWS\system32\d3ddlv.dll O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32	mp86.tmp.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe O4 - HKLM\..\Run: [Windows Media Connect 2] 'C:\Program Files\Windows Media Connect 2\WMCCFG.exe' /StartQuiet O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Steam] 'C:\Program Files\Valve\Steam\Steam.exe' -silent O4 - HKCU\..\Run: [DW4] 'C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163654940968 O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4800/mcfscan.cab O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll O20 - Winlogon Notify: d3ddlv - C:\WINDOWS\SYSTEM32\d3ddlv.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6426 bytes

Bugbatter · Answer

Thanks. We're not done yet. Those critters are not leaving easily. Open Notepad. Copy/paste the following bold text below into it: File::C:\WINDOWS\system32\qwerty12.exeC:\WINDOWS\system32\d3ddlv.dllc:\windows\system32\ssqrsro.dllC:\WINDOWS\system32\dn2c07bc1e.datRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0d6ed790-a13a-4dc1-abe0-a9754450e87a}][-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\d3ddlv][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]'appinit_dlls'='' Save as CFScript.txt Referring to the picture above, drag CFScript into ComboFix.exe You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced here: C:\ComboFix.txt Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and let me know how things are running. Message Edited by Bugbatter on 08-27-2007 03:07 PM

screekrunner · Answer

Thanks again for helpin me. But ya things seem better now. Heres the logs though.   'Michael Rendon' - 2007-07-11 22:10:14 - ComboFix 07-07-10.1 - Service Pack 2  Command switches used ::  C:\Documents and Settings\Michael Rendon\Desktop\CFScript.txt (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\MICHAE~1\APPLIC~1	mpD.tmp.exe C:\WINDOWS\system32\d3ddlv.dll C:\WINDOWS\system32\dn2c07bc1e.dat C:\WINDOWS\system32\qwerty12.exe (((((((((((((((((((((((((   Files Created from 2007-06-12 to 2007-07-12  ))))))))))))))))))))))))))))))) 2007-07-10 14:20   d-------- C:\Program Files\Trend Micro 2007-07-10 14:18 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-07-08 19:43   d-------- C:\Program Files\Pocket Tanks Deluxe ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-12 02:15:15 -------- d-----w C:\Program Files\Symantec AntiVirus 2007-06-27 15:26:44 1,324 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-06-26 03:50:02 -------- d-----w C:\DOCUME~1\MICHAE~1\APPLIC~1\Azureus 2007-06-04 19:37:26 -------- d-----w C:\Program Files\Azureus 2007-06-04 19:37:02 -------- d-----w C:\Program Files\AIM6 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-17 02:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-17 02:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-17 02:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-17 02:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-17 02:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-17 02:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-17 02:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-17 02:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-17 02:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-17 02:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2006-03-19 20:58:37 56 --sh--r C:\WINDOWS\system32\4B22DF3795.sys 2006-03-19 20:58:42 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{938A8A03-A938-4019-B764-03FF8D167D79}]    C:\WINDOWS\system32	mp86.tmp.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe' [2006-05-03 02:56] 'HostManager'='C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe' [2006-05-09 20:24] 'Windows Media Connect 2'='C:\Program Files\Windows Media Connect 2\WMCCFG.exe' [2005-10-06 19:12] 'iTunesHelper'='C:\Program Files\iTunes\iTunesHelper.exe' [2006-09-25 15:54] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-12-05 17:34] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 12:24] 'Steam'='C:\Program Files\Valve\Steam\Steam.exe' [2007-06-29 19:35] 'Aim6'='' [] 'DW4'='C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' [2006-04-19 09:30] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 07:00] [HKEY_USERS\.default\software\microsoft\windows\currentversionun] 'MySpaceIM'=C:\Program Files\MySpace\IM\MySpaceIM.exe 'DWQueuedReporting'='C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 'appinit_dlls'=c:\windows\system32\ssqrsro.dll Contents of the 'Scheduled Tasks' folder 2007-07-06 15:54:00  C:\WINDOWS	asks\AppleSoftwareUpdate.job 2007-07-06 22:30:00  C:\WINDOWS	asks\McAfee.com Scan for Viruses - My Computer (D9J4V191-Michael Rendon).job 2007-07-12 02:10:00  C:\WINDOWS	asks\User_Feed_Synchronization-{0B07D1DA-5A61-4854-BE9D-D73CF9DE28BA}.job ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-11 22:15:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-11 22:18:04 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-11 22:17 C:\ComboFix2.txt ... 2007-07-10 23:51 C:\ComboFix3.txt ... 2007-07-10 14:31  --- E O F ---     Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:22:52 PM, on 07/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe C:\Program Files\Windows Media Connect 2\WMCCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32	mp86.tmp.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe O4 - HKLM\..\Run: [Windows Media Connect 2] 'C:\Program Files\Windows Media Connect 2\WMCCFG.exe' /StartQuiet O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Steam] 'C:\Program Files\Valve\Steam\Steam.exe' -silent O4 - HKCU\..\Run: [DW4] 'C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163654940968 O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4800/mcfscan.cab O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6155 bytes

Bugbatter · Answer

We're making progress, but we have one that doesn't want to leave.
Please print these instructions so you can follow them easily. This is a powerful tool, so we need to be very careful.

1. Please download The Avenger by Swandog46
from here: http://swandog46.geekstogo.com/avenger.zip
Download it to your Desktop.

* Click on Avenger.zip to open the file
* Extract avenger.exe to your desktop

2. Copy all the text between the dotted lines below to your Clipboard (Do not copy the dotted lines -- just the text.):

-----------------

Files to delete:

c:\windows\system32\ssqrsro.dll

----------------

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

* Under "Script file to execute" choose "Input Script Manually".
* Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
* Paste the text copied to clipboard into this window
* Click Done
* Now click on the Green Light to begin execution of the script
* Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

* Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
* On reboot, briefly open a black command window on your desktop, this is normal.
* After the restart, create a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
* The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of avenger.txt into your reply along with a fresh HJT log by using Reply.

screekrunner · Answer

Hi sorry i took so long but i was out of town for a few days. Anyways before i start this next step what do you mean by copy this to your clipboard. What is my clipboard?

Bugbatter · Answer

Hi, and welcome back. 'the clipboard': That means to highlight the text and right-click > Copy. (That way it will be copied so you can paste it into the program.)

screekrunner · Answer

When i clicked the green light to start it i clicked yes like you said. But then after that it came up saying Error: selected file does not appear to be a valid script' And it wont start

Bugbatter · Answer

Did you copy all the text between the dotted lines?

screekrunner · Answer

Yes i did. All i did was copy the text

Bugbatter · Answer

Delete Avenger.

Please download KILLBOX, extract it to your desktop.
If not available, here are some alternate links for the download:
http://downloads.subratam.org/KillBox.exe.
http://www.killbox.net/

Note: In the event you already have Killbox, this is a new version that I need you to download
Save it to your Desktop.

Please double-click Killbox.exe to run it.
Select: Delete on Reboot

Click on the Single File button.

Please copy the file path below to the clipboard by highlighting it and pressing CTRL + C (or, after highlighting, right-click and choose copy):

c:\windows\system32\ssqrsro.dll

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button.
Click Yes at the Delete on Reboot prompt.
Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message.).

If your computer does not restart automatically, please restart it manually into normal mode.

[Note: Killbox makes backups of all deleted files & folders in a folder called C:\!killbox ]
If Killbox tells you any files are missing don't worry but make a note and let us know in your next reply.

Also, please post a fresh Hijackthis log and let me know how things are running.

screekrunner · Answer

It seems to be running well   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:58:16 PM, on 07/18/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32
vsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe C:\Program Files\Windows Media Connect 2\WMCCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\iTunes\iTunes.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Internet Explorer\iexplore.exe c:\program files\common files\aol\1152943990\ee\aim6.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32	mp86.tmp.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1152943990\ee\AOLSoftware.exe O4 - HKLM\..\Run: [Windows Media Connect 2] 'C:\Program Files\Windows Media Connect 2\WMCCFG.exe' /StartQuiet O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Steam] 'C:\Program Files\Valve\Steam\Steam.exe' -silent O4 - HKCU\..\Run: [DW4] 'C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe' O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe' -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163654940968 O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4800/mcfscan.cab O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6374 bytes

Bugbatter · Answer

Things are looking much better, but we're not finished.

Please launch HijackThis and place a checkmark next to these if they still exist:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\tmp86.tmp.dll (file missing)
O16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) - http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab
O20 - AppInit_DLLs: c:\windows\system32\ssqrsro.dll

Close all windows except HijackThis and click "Fix Checked". Close Hijackthis.

Let's run CF-do again.
Open Notepad. Copy/paste the following bold text below into it:

File::
c:\windows\system32\ssqrsro.dll

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=""

Save this as CFScript.txt

Photo Sharing and Video Hosting at Photobucket

Referring to the picture above, drag CFScript into ComboFix.exe
You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix.
CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced here: C:\ComboFix.txt

Reboot.

Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and let me know how things are running.

Edit 8/27: Are you still using Limewire?

Message Edited by Bugbatter on 08-27-2007 09:42 AM

Virus & Spyware

My HijackThis log

Was this post helpful?