Able to run executibles now

Question

Computer stayed stable long enough for me to run HiJack Log!!  Here it is:  Thanks in advance Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:00:31 PM, on 11/13/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\CA\PPRT\bin\ITMRTSVC.exeC:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exeC:\Program Files\Dell Support Center\bin\sprtsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\system32\fxssvc.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\WINDOWS\Explorer.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\QuickTime\qttask.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeC:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exeC:\Program Files\support.com\bin	gcmd.exeC:\Program Files\Common Files\AOL\1137705124\ee\AOLSoftware.exeC:\Program Files\Common Files\AOL\1137705124\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Lexmark 7300 Series\lxcimon.exeC:\Program Files\Lexmark 7300 Series\ezprint.exeC:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exeC:\Program Files\Dell Support Center\bin\sprtcmd.exeC:\WINDOWS\Temp\wpv851257179558.exeC:\Program Files\DellSupport\DSAgnt.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\sa23sl.exeC:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntispy.exeC:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Documents and Settings\Thomasestorer32_a.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\AOL\1137705124\ee\aolsoftware.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\lxcicoms.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wscript.exeC:\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywayR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net?cid=110909R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcDODB5xmjBn4d/ine/frlIJBJPmvCicGf/aV6jQY9U7+CQjgwCMiU0/5X0laAz53arucFnIsq671CobBsoxwqkfWXC6DGrJbSoRSiysD4GrMNZG1/YBHDUUCxsw8RsS8VJXr290T2EOlgjXV4FyasNFMcvQlrKEutDbj+wrd4EYVU=R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by ComcastF2 - REG:system.ini: Shell=Explorer.exe rundll32.exe pqrs.tmo printerO2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files\comcasttb\comcastdx.dllO2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO3 - Toolbar: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-53B2A02F39B7} - C:\Program Files\comcasttb\comcastdx.dllO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exeO4 - HKLM\..\Run: [tgcmd] 'C:\Program Files\support.com\bin	gcmd.exe' /serverO4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1137705124\ee\AOLSoftware.exeO4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1137705124\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exeO4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1137705124\ee\SSCRun.exeO4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exeO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,_RunDLLEntry@16O4 - HKLM\..\Run: [lxcimon.exe] 'C:\Program Files\Lexmark 7300 Series\lxcimon.exe'O4 - HKLM\..\Run: [EzPrint] 'C:\Program Files\Lexmark 7300 Series\ezprint.exe'O4 - HKLM\..\Run: [dscactivate] 'C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe'O4 - HKLM\..\Run: [ddoctorv2] 'C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe' /P ddoctorv2O4 - HKLM\..\Run: [DellSupportCenter] 'C:\Program Files\Dell Support Center\bin\sprtcmd.exe' /P DellSupportCenterO4 - HKLM\..\Run: [sysgif32] C:\WINDOWS\Temp\wpv851257179558.exeO4 - HKLM\..\Run: [09354627] C:\DOCUME~1\ALLUSE~1\APPLIC~1\09354627\09354627.exeO4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32egedit.exeO4 - HKLM\..\Run: [restorer32_a] C:\WINDOWS\system32estorer32_a.exeO4 - HKLM\..\Run: [26946734] C:\DOCUME~1\ALLUSE~1\APPLIC~1\26946734\26946734.exeO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\mnyexpr.exe'O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [DellSupportCenter] 'C:\Program Files\Dell Support Center\bin\sprtcmd.exe' /P DellSupportCenterO4 - HKCU\..\Run: [restorer32_a] C:\Documents and Settings\Thomasestorer32_a.exeO4 - HKCU\..\Run: [ttool] C:\WINDOWS\sa23sl.exeO4 - HKCU\..\Run: [RegistryMonitor1] 'C:\DOCUME~1\Thomas\LOCALS~1\Temp\649.tmp'O4 - HKCU\..\Run: [ComcastAntispyClient] 'C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntispy.exe' /hideO4 - Startup: iidwin32.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exeO4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exeO4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0esources\en-US\local\search.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLLO9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cabO16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/2.0.8.98/cab/aolpPlugins.10.6.0.6.cabO23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exeO23 - Service: lxci_device -   - C:\WINDOWS\system32\lxcicoms.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exeO23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exeO23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe --End of file - 11681 bytes

Bugbatter · Answer

HijackThis does not show everything. but from what I can see, it appears that you are dealing with a couple of Backdoor infections/Trojans.
A backdoor is a small malicious program that is used to gain access to a computer by bypassing the computer access security mechanisms. It gives the attacker almost unlimited rights. While it can be used to spy on a user, it is mainly used to install other malware on the system.

C:\WINDOWS\system32\pqrs.tmo <--Backdoor.Bredavi
http://www.malwarebytes.org/malwarenet.php?name=Backdoor.Bredavi
RESTORER32_A.EXE
http://www.prevx.com/filenames/3142922877828719533-X1/RESTORER32_A.EXE.html
IIDWIN32.EXE
http://www.prevx.com/filenames/1104395637561829493-X1/PDFUPD.EXE.html
sysgif32 (Trojan.Agent)
http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_TIKAYB.A&VSect=P
SA23SL.EXE
http://www.prevx.com/filenames/X229981191624268167-X1/SA23SL.EXE.html

My main concern is the Backdoor. Please read this important information, especially this part:
If you chose to receive help with a backdoor trojan from someone online, at a computer repair shop, etc., we recommend that you do the following:

    * Since these infections may be used for remote access, or even remote control of an infected system, temporarily disconnect it from the Internet as soon as possible.
    * If you don’t have access to another system, and require Internet access, be sure to have a firewall installed. We recommend the free version of Comodo. Note: never run more than one firewall.
    * If you used the infected system for online banking, to perform any online financial transactions (including eBay and Paypal), or access any sensitive information online, please get to a known clean computer and change your passwords as soon as possible. It would also be wise to contact those same financial institutions to let them know your account information and passwords may have been compromised.
    * Closely monitor all bank and credit card statements. In the event you do notice suspicious activity, it’s important you act quickly. Follow these steps recommended by the FTC: Defend: Recover From Identity Theft.

Should I reformat and reinstall, or disinfect?:
http://www.geekstogo.com/2007/10/03/what-is-a-backdoor-trojan/

Let me know what you decide to do.

rvep · Answer

That computer has been of the network for 2 days. I am very concerned about the 2 days it was on the network while I was trying to figure out what was wrong. No online banking was done on that computer. But thanks for the advice...will keep close watch of bank accounts. I will read the link you provided and decide on my next step.

WOW...I knew it was a bad virus...but I wasn't expecting a backdoor trojan...

This computer has comcast and AOL and I know both have firewalls. I know for sure AOL's was on..don't think comcast was on. But I guess if you have 2 activated they cancel each other out?

Oh...got some thinking to do..I will get back to you soon.. Thanks again

Bugbatter · Answer

It has been four days since a reply. Due to the lack of feedback this topic is closed. Everyone else please begin a New Message at the top of the forum.

Virus & Spyware

Able to run executibles now

Was this post helpful?