HELP PLEASE!! Virus? Malware? HJT log

Question

McAfee keeps alerting of NewMalware.j that cannot be deleted. I keep getting random popup webpages while surfing the internet too. Please help, here is my HJT log. . . . . . .     Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:12:10 PM, on 8/13/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cnfgkdkn.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe c:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\McAfee\MSC\mcuimgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.core.com/web/start R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe' O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe 'C:\WINDOWS\system32\jtwdfhjm.dll',forkonce O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin
pjpi160_02.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Coupons.cab O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\cnfgkdkn.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6132 bytes   Thanks!

Bugbatter · Answer

Hi, chicklet,

Please download Combofix from here: http://download.bleepingcomputer.com/sUBs/combofix.exe
Or
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the links are case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new HijackThis log.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run ComboFix.

chicklet · Answer

Thanks so much for the quick response! Here's the Combofix report.........     ComboFix 07-08-09.3 - 'Bill' 2007-08-13 19:44:22.1 - NTFSx86 Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.73 [GMT -5:00]  * Created a new restore point (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) C:	emp\brr C:\WINDOWS\system32\adtmxhds.exe C:\WINDOWS\system32\aofnfwvb.exe C:\WINDOWS\system32\arnykcjs.exe C:\WINDOWS\system32\b02FdUe C:\WINDOWS\SYSTEM32\bunlsqcx.ini C:\WINDOWS\system32\cgscwtfx.exe C:\WINDOWS\system32\cifrewsd.exe C:\WINDOWS\system32\ddayv.dll C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\fccabbc.dll C:\WINDOWS\SYSTEM32\gjllm.bak1 C:\WINDOWS\SYSTEM32\gjllm.bak2 C:\WINDOWS\SYSTEM32\gjllm.ini C:\WINDOWS\system32\hgribqfq.exe C:\WINDOWS\SYSTEM32\hnjkwaaq.ini C:\WINDOWS\system32\htpjkppb.exe C:\WINDOWS\system32\ixvtdliy.exe C:\WINDOWS\system32\jtwdfhjm.dll C:\WINDOWS\system32\jvasyxuc.exe C:\WINDOWS\system32\kuxpclbp.dll C:\WINDOWS\system32\lpitdybq.exe C:\WINDOWS\system32\lvpmteif.exe C:\WINDOWS\system32\mdaaepdv.exe C:\WINDOWS\SYSTEM32\mjhfdwtj.ini C:\WINDOWS\system32\ocfcfgdb.exe C:\WINDOWS\system32\oldiriet.dll C:\WINDOWS\system32\oocxchna.exe C:\WINDOWS\system32\oqytncoe.exe C:\WINDOWS\SYSTEM32\pblcpxuk.ini C:\WINDOWS\system32\pmnoonm.dll C:\WINDOWS\system32\qaawkjnh.dll C:\WINDOWS\system32\qwoowbvs.exe C:\WINDOWS\system32bolgrcm.dll C:\WINDOWS\system32ohocgey.exe C:\WINDOWS\system32\sgcqsxvt.exe C:\WINDOWS\system32	fayeist.exe C:\WINDOWS\system32	lmfldkl.exe C:\WINDOWS\SYSTEM32\vyadd.bak1 C:\WINDOWS\SYSTEM32\vyadd.bak2 C:\WINDOWS\SYSTEM32\vyadd.ini C:\WINDOWS\SYSTEM32\vyadd.ini2 C:\WINDOWS\SYSTEM32\vyadd.tmp C:\WINDOWS\system32\xcqslnub.dll C:\WINDOWS\system32\xdxxjwsf.exe (((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE -------\DomainService (((((((((((((((((((((((((   Files Created from 2007-07-14 to 2007-08-14  ))))))))))))))))))))))))))))))) 2007-08-13 19:42 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-13 17:22 75,328 --a------ C:\WINDOWS\SYSTEM32\fpysalyu.exe 2007-08-13 13:30 75,328 --a------ C:\WINDOWS\SYSTEM32\shwwhmym.exe 2007-08-13 09:10 75,328 --a------ C:\WINDOWS\SYSTEM32\esnkpens.exe 2007-08-12 11:22 75,328 --a------ C:\WINDOWS\SYSTEM32\qvwoiejl.exe 2007-08-12 11:05 75,328 --a------ C:\WINDOWS\SYSTEM32\ggcjupfg.exe 2007-08-11 08:33 75,328 --a------ C:\WINDOWS\SYSTEM32emyanvi.exe 2007-08-10 21:26 75,328 --a------ C:\WINDOWS\SYSTEM32\fqnoqyee.exe 2007-08-09 21:26 75,328 --a------ C:\WINDOWS\SYSTEM32\driolrfa.exe 2007-08-08 21:25 75,328 --a------ C:\WINDOWS\SYSTEM32\cnfgkdkn.exe 2007-08-04 21:00   d-------- C:\Program Files\CCleaner 2007-08-04 20:42   d-------- C:\Program Files\Trend Micro 2007-07-30 13:11   d-------- C:\VundoFix Backups 2007-07-29 22:03   d-------- C:\Program Files\Alwil Software 2007-07-28 23:26 126,016 --a------ C:\WINDOWS\SYSTEM32\fbnbhscr.dll 2007-07-26 22:07 126,016 --a------ C:\WINDOWS\SYSTEM32\qiouwrxv.dll 2007-07-21 16:51   d-------- C:\DOCUME~1\Bill\APPLIC~1\MSN6 2007-07-21 16:51   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6 2007-07-16 22:29   d-------- C:\Temp ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-05 13:31 --------- d-------- C:\Program Files\McAfee 2007-08-05 00:00 --------- d-------- C:\Program Files\Greetings Workshop 2007-07-01 13:59 28256 --a------ C:\WINDOWS\system32\drivers\MxlW2k.sys 2007-06-16 18:50 --------- d-------- C:\Program Files\epson 2007-06-16 18:49 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-16 18:49 --------- d-------- C:\Program Files\ArcSoft 2007-06-16 18:48 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-05-16 10:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll 2005-09-05 08:53 180168 --ahsc--- C:\WINDOWS\Fonts.\bilyek.bak2 2005-08-27 15:22 6366 --ahsc--- C:\WINDOWS\Fonts.\bilyek.bak1 (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E16638A-D8D2-42CF-9879-C8E236E60DA7}]    C:\WINDOWS\system32\vtsts.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'IgfxTray'='C:\WINDOWS\system32\igfxtray.exe' [2005-10-19 07:59] 'HotKeysCmds'='C:\WINDOWS\system32\hkcmd.exe' [2005-10-19 07:59] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 20:12] 'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2003-08-06 01:04] 'StorageGuard'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2003-02-13 01:01] 'PCMService'='C:\Program Files\Dell\Media Experience\PCMService.exe' [2003-08-26 19:47] 'TkBellExe'='C:\Program Files\Common Files\Real\Update_OBealsched.exe' [2004-04-15 14:11] 'SiteAdvisor'='C:\Program Files\SiteAdvisor\6066\SiteAdv.exe' [2007-02-08 21:39] 'mcagent_exe'='C:\Program Files\McAfee.com\Agent\mcagent.exe' [2007-08-04 02:33] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe' [2007-07-12 04:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DellSupport'='C:\Program Files\DellSupport\DSAgnt.exe' [2007-03-15 11:09] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24] C:\Documents and Settings\Bill\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cbxwtsp] cbxwtsp.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\keylib] C:\WINDOWS\Fonts\keylib.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @='' [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @='' [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 DllCmd 4.0.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\j2 DllCmd 4.0.lnk backup=C:\WINDOWS\pss\j2 DllCmd 4.0.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 Tray Menu 4.0.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\j2 Tray Menu 4.0.lnk backup=C:\WINDOWS\pss\j2 Tray Menu 4.0.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkvMon.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkvMon.exe.lnk backup=C:\WINDOWS\pss\NkvMon.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk backup=C:\WINDOWS\pss\Greetings Workshop Reminders.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Microsoft Find Fast.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Microsoft Find Fast.lnk backup=C:\WINDOWS\pss\Microsoft Find Fast.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Office Startup.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Office Startup.lnk backup=C:\WINDOWS\pss\Office Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA] RUNDLL32.exe 'C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll',cdaEngineMain R1 MPFP;MPFP;C:\WINDOWS\system32\Drivers\Mpfp.sys R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys S3 bvrp_pci;bvrp_pci;C:\WINDOWS\system32\drivers\bvrp_pci.sys Contents of the 'Scheduled Tasks' folder 2007-08-13 19:00:02 C:\WINDOWS\Tasks\Disk Cleanup.job 2007-05-15 06:10:34 C:\WINDOWS\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe 2007-05-01 06:00:08 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-13 19:57:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-13 19:59:20 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-13 19:59  --- E O F ---   AND THE HJT LOG. . . . . . .   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:04:35 PM, on 8/13/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe c:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\McAfee\MSC\mcuimgr.exe C:\WINDOWS\system32
otepad.exe C:\Program Files\MSN\MSNCoreFiles\msn6.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.core.com/web/start R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: (no name) - {5E16638A-D8D2-42CF-9879-C8E236E60DA7} - C:\WINDOWS\system32\vtsts.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe' O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Coupons.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D040E681-9F25-4FEC-A172-7E46AD84781A}: NameServer = 209.153.128.4 169.207.1.3 O20 - Winlogon Notify: cbxwtsp - cbxwtsp.dll (file missing) O20 - Winlogon Notify: keylib - C:\WINDOWS\Fonts\keylib.dll (file missing) O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 6529 bytes   AGAIN, THANKS SO MUCH!!

Bugbatter · Answer

You're welcome. :) WE have a bit more to do.
When did you run VundoFix? Please delete that tool if you still have it. Also delete its Backups folder here: C:\VundoFix Backups
You are using McAfee for anti-virus. What Alwil Software are you using?

You have Viewpoint installed. Viewpoint developed a behavioral targeting product in 2006. Viewpoint is associated with a program called viewmgr.exe and the ViewPoint Media Player.
Viewpoint is bundled with AOL, AOL Instant Messenger, Adobe Atmosphere, Netscape 7, etc and sometimes not mentioned in the license agreement. Hardware manufacturers pre-install some of these applications.
ViewPoint Toolbar will redirect your search queries and also transmits non personally identifiable information back to their servers. The Viewpoint Toolbar is listed is also classified as a threat in the CounterSpy Threat Library because it hijacks your search queries and also transmits non personally identifiable information back to their servers.
Viewpoint Manager is a media player often bundled with AIM software. Viewpoint Manager is a useless add on.

Because Viewpoint's software will track your web surfing and tailor advertisements based on the web pages you are visiting, I suggest you remove the program.
** Note: Removing Viewpoint Media Player may cause the program that bundled it to not function as intended. For AOL and AIM it is needed to use their 3D icons known as Super Buddies and for customized themes, etc.
If you wish to remove Viewpoint, end process on ViewManager in Task Manager.
Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

Viewpoint
Viewpoint Manager
Viewpoint Media Player
Viewpoint Toolbar
Viewpoint Experience Technology

Then remove the Viewpoint folder in your Program Files.

Open Notepad and copy/paste the following bold text between the dotted lines into it:
------------------------------------------------------------------------------------------

Files::
C:\WINDOWS\SYSTEM32\fpysalyu.exe
C:\WINDOWS\SYSTEM32\shwwhmym.exe
C:\WINDOWS\SYSTEM32\esnkpens.exe
C:\WINDOWS\SYSTEM32\qvwoiejl.exe
C:\WINDOWS\SYSTEM32\ggcjupfg.exe
C:\WINDOWS\SYSTEM32\remyanvi.exe
C:\WINDOWS\SYSTEM32\fqnoqyee.exe
C:\WINDOWS\SYSTEM32\driolrfa.exe
C:\WINDOWS\SYSTEM32\cnfgkdkn.exe
C:\WINDOWS\SYSTEM32\fbnbhscr.dll
C:\WINDOWS\SYSTEM32\qiouwrxv.dll
C:\WINDOWS\system32\vtsts.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E16638A-D8D2-42CF-9879-C8E236E60DA7}]

----------------------------------------------------------------------------------------------

Save this as CFScript.txt

Photo Sharing and Video Hosting at Photobucket

Referring to the picture above, drag CFScript into ComboFix.exe
You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix.
CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced here: C:\ComboFix.txt

Please launch HijackThis and place a checkmark next to these:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {5E16638A-D8D2-42CF-9879-C8E236E60DA7} - C:\WINDOWS\system32\vtsts.dll (file missing)
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Coupons.cab
O20 - Winlogon Notify: cbxwtsp - cbxwtsp.dll (file missing)
O20 - Winlogon Notify: keylib - C:\WINDOWS\Fonts\keylib.dll (file missing)

If you removed Viewpoint fix this one as well:
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Close all windows except Hijackthis and click 'Fix checked".
Close HijackThis and reboot.

Please post your new Combofix log along with the fresh Hijackthis log.

Message Edited by Bugbatter on 08-13-2007 10:17 PM

chicklet · Answer

Here is the new combo fix report (I jumped the gun and ran the combofix bfore I deleted the Vundo fix items you asked me too; they are deleted now though) I can run Combofix again if you need me too. I ran Vundo fix about a week or 2 ago when McAfee noted a Trojan.vundo, I had lost use of Explorer and I saw someone on here with a similar problem that was instructed to use VundoFix. The Alwil software was Avast antivirus; my sister thought that might help when I ran into the Vundo problem, but I thought I had deleted the Avast program. . . . . . . . . .   ComboFix 07-08-09.3 - 'Bill' 2007-08-14 22:28:07.2 - NTFSx86Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.62 [GMT -5:00]Command switches used ::  C:\Documents and Settings\Bill\Desktop\CFScript.txt * Created a new restore point   (((((((((((((((((((((((((   Files Created from 2007-07-15 to 2007-08-15  )))))))))))))))))))))))))))))))   2007-08-14 13:29   d-------- C:\WINDOWS\LastGood 2007-08-13 19:42 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-13 17:22 75,328 --a------ C:\WINDOWS\SYSTEM32\fpysalyu.exe 2007-08-13 13:30 75,328 --a------ C:\WINDOWS\SYSTEM32\shwwhmym.exe 2007-08-13 09:10 75,328 --a------ C:\WINDOWS\SYSTEM32\esnkpens.exe 2007-08-12 11:22 75,328 --a------ C:\WINDOWS\SYSTEM32\qvwoiejl.exe 2007-08-12 11:05 75,328 --a------ C:\WINDOWS\SYSTEM32\ggcjupfg.exe 2007-08-11 08:33 75,328 --a------ C:\WINDOWS\SYSTEM32emyanvi.exe 2007-08-10 21:26 75,328 --a------ C:\WINDOWS\SYSTEM32\fqnoqyee.exe 2007-08-09 21:26 75,328 --a------ C:\WINDOWS\SYSTEM32\driolrfa.exe 2007-08-04 21:00   d-------- C:\Program Files\CCleaner 2007-08-04 20:42   d-------- C:\Program Files\Trend Micro 2007-07-30 13:11   d-------- C:\VundoFix Backups 2007-07-29 22:03   d-------- C:\Program Files\Alwil Software 2007-07-28 23:26 126,016 --a------ C:\WINDOWS\SYSTEM32\fbnbhscr.dll 2007-07-26 22:07 126,016 --a------ C:\WINDOWS\SYSTEM32\qiouwrxv.dll 2007-07-21 16:51   d-------- C:\DOCUME~1\Bill\APPLIC~1\MSN6 2007-07-21 16:51   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6 2007-07-16 22:29   d-------- C:\Temp   ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))   2007-08-05 13:31 --------- d-------- C:\Program Files\McAfee 2007-08-05 00:00 --------- d-------- C:\Program Files\Greetings Workshop 2007-07-01 13:59 28256 --a------ C:\WINDOWS\system32\drivers\MxlW2k.sys 2007-06-16 18:50 --------- d-------- C:\Program Files\epson 2007-06-16 18:49 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-06-16 18:49 --------- d-------- C:\Program Files\ArcSoft 2007-06-16 18:48 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-05-16 10:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll 2005-09-05 08:53 180168 --ahsc--- C:\WINDOWS\Fonts.\bilyek.bak2 2005-08-27 15:22 6366 --ahsc--- C:\WINDOWS\Fonts.\bilyek.bak1   (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))     *Note* empty entries & legit default entries are not shown   [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E16638A-D8D2-42CF-9879-C8E236E60DA7}]    C:\WINDOWS\system32\vtsts.dll   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'IgfxTray'='C:\WINDOWS\system32\igfxtray.exe' [2005-10-19 07:59] 'HotKeysCmds'='C:\WINDOWS\system32\hkcmd.exe' [2005-10-19 07:59] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 20:12] 'dla'='C:\WINDOWS\system32\dla	fswctrl.exe' [2003-08-06 01:04] 'StorageGuard'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2003-02-13 01:01] 'PCMService'='C:\Program Files\Dell\Media Experience\PCMService.exe' [2003-08-26 19:47] 'TkBellExe'='C:\Program Files\Common Files\Real\Update_OBealsched.exe' [2004-04-15 14:11] 'SiteAdvisor'='C:\Program Files\SiteAdvisor\6066\SiteAdv.exe' [2007-02-08 21:39] 'mcagent_exe'='C:\Program Files\McAfee.com\Agent\mcagent.exe' [2007-08-04 02:33] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe' [2007-07-12 04:00]   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'DellSupport'='C:\Program Files\DellSupport\DSAgnt.exe' [2007-03-15 11:09] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24]   C:\Documents and Settings\Bill\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00]   C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00]   [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cbxwtsp] cbxwtsp.dll   [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\keylib] C:\WINDOWS\Fonts\keylib.dll   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @=''   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @=''   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 DllCmd 4.0.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\j2 DllCmd 4.0.lnk backup=C:\WINDOWS\pss\j2 DllCmd 4.0.lnkCommon Startup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^j2 Tray Menu 4.0.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\j2 Tray Menu 4.0.lnk backup=C:\WINDOWS\pss\j2 Tray Menu 4.0.lnkCommon Startup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkvMon.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NkvMon.exe.lnk backup=C:\WINDOWS\pss\NkvMon.exe.lnkCommon Startup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Greetings Workshop Reminders.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Greetings Workshop Reminders.lnk backup=C:\WINDOWS\pss\Greetings Workshop Reminders.lnkStartup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Microsoft Find Fast.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Microsoft Find Fast.lnk backup=C:\WINDOWS\pss\Microsoft Find Fast.lnkStartup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^Office Startup.lnk] path=C:\Documents and Settings\Bill\Start Menu\Programs\Startup\Office Startup.lnk backup=C:\WINDOWS\pss\Office Startup.lnkStartup   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime   [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA] RUNDLL32.exe 'C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll',cdaEngineMain   R1 MPFP;MPFP;C:\WINDOWS\system32\Drivers\Mpfp.sys R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys S3 bvrp_pci;bvrp_pci;C:\WINDOWS\system32\drivers\bvrp_pci.sys   Contents of the 'Scheduled Tasks' folder 2007-08-13 19:00:02 C:\WINDOWS\Tasks\Disk Cleanup.job 2007-05-15 06:10:34 C:\WINDOWS\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe 2007-05-01 06:00:08 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe   **************************************************************************   catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net/ Rootkit scan 2007-08-14 22:30:32 Windows 5.1.2600 Service Pack 2 NTFS   scanning hidden processes ...   scanning hidden registry entries ...   scanning hidden files ...   scan completed successfully hidden files: 0   **************************************************************************   Completion time: 2007-08-14 22:32:02 C:\ComboFix-quarantined-files.txt ... 2007-08-14 22:31 C:\ComboFix2.txt ... 2007-08-13 19:59    --- E O F ---   And here is the new HJT:   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:59:02 PM, on 8/14/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: Normal   Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\program files\common files\mcafee\mna\mcnasvc.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcods.exec:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Common Files\Real\Update_OBealsched.exeC:\Program Files\SiteAdvisor\6066\SiteAdv.exeC:\Program Files\McAfee.com\Agent\mcagent.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeC:\Program Files\Java\jre1.6.0_02\bin\jusched.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\Program Files\SiteAdvisor\6066\SAService.exeC:\WINDOWS\System32\svchost.exec:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\McAfee\MSC\mcuimgr.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.core.com/web/startR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywayR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywayO2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dllO3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dllO3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osbootO4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exeO4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkeyO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe'O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cabO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exeO23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafeeedirsvcedirsvc.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exeO24 - Desktop Component 0: (no name) - https://home.core.com/webmail/img/addrbk.gif   --End of file - 5874 bytes I saw another item in the 'Add/Remove programs' called WinPolis that I don't recall adding. I tried to uninstall it but can't because it says some file is missing. . . . . Is that something bad??   Thanks so much for all your help,

Bugbatter · Answer

You're welcome. We're almost finished.

WinPolis is a game like Monopoly..someone must have installed it. If you do not want it, remove it. Presently, VundoFix does not handle the variant of the infection that you had. Sometimes following the advice given to others is not good because each computer is different.
Running more than one anti-virus probably did you more harm than good. I just wanted to make sure you actually removed Avast.

Please run Notepad and paste the following bold text between the dotted lines into a new file. Do not copy the dotted lines:

------------------------------------------------------------------------------------

REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E16638A-D8D2-42CF-9879-C8E236E60DA7}]

--------------------------------------------------------------------------------------

Save the file to the desktop as fix.reg and make sure the "Save as Type" field says "All Files". Then please go to the desktop and double-click on fix.reg, and click Yes to merge it with the registry.

I see that you have CCleaner. Please run that in all user accounts.
After that let me know how things are running. If your issue has been resolved, we'll flush your System Restore.

chicklet · Answer

Things have been running much smoother from even your first instructions; no NewMalware detections from McAfee and no annoying popups while working in explorer.   So I guess I'm ready to proceed with flushing the system restore. . . . . . . . .   THANKS!!

Bugbatter · Answer

Okay, we'll flush away! Laughing 6

First we need to delete the tools that you used because you will no longer need them.
Please delete ComboFix and its quarantine folder along with these other files if they still exist:
C:\ QooBox
You may need to search for these:
catchme.exe
nircmd.exe
swreg.exe
Swxcacls.exe
Swsc.exe

You may want to keep HJT so you can post a log in the future if you ever have another problem -- assuming the tool does not have a newer version at that time.

Following that, if everything is running well....
To flush the XP System Restore Points:
(Using XP, you must be logged in as Administrator to do this.)
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn Off System Restore.

Reboot. Go back in and turn System Restore ON. A new Restore Point will be created.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

You may have already taken some of these steps:
1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Adjust your security settings for ActiveX:
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

3. Download and install the following free programs:
a. SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
b. SpywareGuard:
http://www.javacoolsoftware.com/spywareguard.html
Tutorial here: http://www.bleepingcomputer.com/tutorials/tutorial50.html
Periodically check for updates in both programs.

4. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (Zone Labs) http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads
Sunbelt Kerio has a free version: http://www.kerio.com/kpf_download.html

5. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

6. Install spyware detection and removal programs:
You may also want to consider installing either or both of AdAware (free version) and Spybot S&D (freeware). Use these programs to regularly scan your system for and remove many forms of spyware/malware.

a. Ad-aware: http://www.lavasoft.de/software/adaware/

b. SpyBot S&D: http://safer-networking.org/en/news/2005-05-31.html

I would check for updates in SpyBot once a week or so.
Check for updates in Ad-aware frequently.

7. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List.
Here is the link:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

8. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

9. If you use Adobe Reader it may need to be updated to be sure that you have a more secure version. If you are using a version prior to v. 6.05, you should update to 6.05, preferably version 8.1.0.
It would be best to remove prior versions before updating to a new version.
If you need additional assistance, the Adobe forums are here: http://www.adobe.com/support/forums/main.html

10. Make sure you are using the most updated version of Java.
The current version is Java Runtime Environment (JRE) 6u2
You can go here to download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says " Java Runtime Environment (JRE) 6u2 allows end-users to run Java applications".

Click the link to download the Windows (Offline Installation) package: Save it, do not run it. When the download is complete, close the browser.

Remove all prior versions using Add/Remove Programs, and delete the Java folder in Program Files.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version.
Official JAVA Installation Instructions if needed.
Reboot.

11. Practice Safe Surfing with with TrendProtect by Trendmicro.
TrendProtect is a browser plugin that assigns a safety rating to domains listed in your search engine. TrendProtect also adds a new button to your browser's toolbar area. The icon and color of the button changes to indicate whether the page currently open is safe, unsafe, trusted, or unrated, or whether it contains unwanted content.

The following color codes are used by TrendProtect to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

12. Here are some helpful articles:
"So how did I get infected in the first place?"
by TonyKlein
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

13. This is an excellent resource for users of all levels. General computer maintenance as well as internet security is covered.
Rootkits for Dummies
(Paperback)
by Larry Stevenson (Author), Nancy Altholz (Author)

Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!

Virus & Spyware

HELP PLEASE!! Virus? Malware? HJT log

Was this post helpful?