sabrasmom

29 Posts

6801

December 3rd, 2007 23:00

HELP! Possible trojan virus on computer.

Over the weekend, Trojan KillAv was detected by my Norton virus scan. It was unable to remove it or quarantine it. Directly after that my homepage changed and I was receiving pop-ups. Since my Norton subscription was about to expire, I purchased Trend Micro Internet Security Plus. Upon installation, I was asked to remove Norton as it downloaded. Since the virus was already there, I did this. Trend Micro also detected Trojan Killav but was unable to remove or quarantine it and I could not finish updating the virus definitions because my internet went down.

Now, I cannot normally start my computer since my Windows XP Pro S2 system comes up to the blue screen right after I log into any of my accounts saying the error "Stop: 0x0000007E (0xc0000005, 0x80536c46, 0xF88F5BDC, 0xF88F58D8)" Upon logging on in safemode, I noticed that my control panel, taskbar, and even registry editor were not operating. From different forums, I was able to restore the control panel, taskbar, and registry editor. However, I still get the blue screen with the error and cannot get my internet to work on the computer. Can someone please help?? (P.S. If you say that I would be better off reinstalling my back-up disk for the operating system, I would not have a problem doing this, but would need assistance on how to do this as well).

I have attached my HijackThis log to help with the process. Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:41, on 2007-12-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1862EF3D-29E4-4127-9615-B1C49977066A} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKLM\..\Run: [clkhost] C:\WINDOWS\dcxxygx.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [dumprep] C:\WINDOWS\system32\spoolc.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBTray.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v57/bjattack/bja.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v45/royal/royal.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4123.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol748.txt
O20 - Winlogon Notify: mcdpm3 - C:\WINDOWS\Registration\mcdpm3.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 10459 bytes

Responses(41)
Solutions(0)

sabrasmom

29 Posts

0

December 6th, 2007 00:00

Here is the second half of the fakealertfixit results:

FakeAlertFix

Version 1.5.0

By bamajim @ CastleCops.com

========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\winav.exe
%windir%\system32\sessmgr.exe

****** Files in System32\Drivers ******

c:\windows\system32\drivers\1028_dell_ins_i6000.mrk
c:\windows\system32\drivers\1394bus.sys
c:\windows\system32\drivers\abp480n5.sys
c:\windows\system32\drivers\acpi.sys
c:\windows\system32\drivers\acpiec.sys
c:\windows\system32\drivers\adpu160m.sys
c:\windows\system32\drivers\aec.sys
c:\windows\system32\drivers\aegisp.sys
c:\windows\system32\drivers\afd.sys
c:\windows\system32\drivers\agp440.sys
c:\windows\system32\drivers\agpcpq.sys
c:\windows\system32\drivers\aha154x.sys
c:\windows\system32\drivers\aic78u2.sys
c:\windows\system32\drivers\aic78xx.sys
c:\windows\system32\drivers\aliide.sys
c:\windows\system32\drivers\alim1541.sys
c:\windows\system32\drivers\amdagp.sys
c:\windows\system32\drivers\amdk6.sys
c:\windows\system32\drivers\amdk7.sys
c:\windows\system32\drivers\amsint.sys
c:\windows\system32\drivers\apfiltr.sys
c:\windows\system32\drivers\appdrv.sys
c:\windows\system32\drivers\arp1394.sys
c:\windows\system32\drivers\asc.sys
c:\windows\system32\drivers\asc3350p.sys
c:\windows\system32\drivers\asc3550.sys
c:\windows\system32\drivers\asctrm.sys
c:\windows\system32\drivers\asyncmac.sys
c:\windows\system32\drivers\atapi.sys
c:\windows\system32\drivers\atmarpc.sys
c:\windows\system32\drivers\atmepvc.sys
c:\windows\system32\drivers\atmlane.sys
c:\windows\system32\drivers\atmuni.sys
c:\windows\system32\drivers\audstub.sys
c:\windows\system32\drivers\ax88772.sys
c:\windows\system32\drivers\battc.sys
c:\windows\system32\drivers\bcm4sbxp.sys
c:\windows\system32\drivers\bcmwl5.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\bridge.sys
c:\windows\system32\drivers\bvrp_pci.sys
c:\windows\system32\drivers\cbidf2k.sys
c:\windows\system32\drivers\cd20xrnt.sys
c:\windows\system32\drivers\cdaudio.sys
c:\windows\system32\drivers\cdfs.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\drivers\cercsr6.sys
c:\windows\system32\drivers\cinemst2.sys
c:\windows\system32\drivers\classpnp.sys
c:\windows\system32\drivers\cmbatt.sys
c:\windows\system32\drivers\cmdide.sys
c:\windows\system32\drivers\compbatt.sys
c:\windows\system32\drivers\cpqarray.sys
c:\windows\system32\drivers\cpqdap01.sys
c:\windows\system32\drivers\crusoe.sys
c:\windows\system32\drivers\dac2w2k.sys
c:\windows\system32\drivers\dac960nt.sys
c:\windows\system32\drivers\del5422.cty
c:\windows\system32\drivers\disk.sys
c:\windows\system32\drivers\diskdump.sys
c:\windows\system32\drivers\dmboot.sys
c:\windows\system32\drivers\dmio.sys
c:\windows\system32\drivers\dmload.sys
c:\windows\system32\drivers\dmusic.sys
c:\windows\system32\drivers\dpti2o.sys
c:\windows\system32\drivers\drmk.sys
c:\windows\system32\drivers\drmkaud.sys
c:\windows\system32\drivers\drvmcdb.sys
c:\windows\system32\drivers\drvnddm.sys
c:\windows\system32\drivers\dsunidrv.sys
c:\windows\system32\drivers\dxapi.sys
c:\windows\system32\drivers\dxg.sys
c:\windows\system32\drivers\dxgthk.sys
c:\windows\system32\drivers\e100b325.sys
c:\windows\system32\drivers\enum1394.sys
c:\windows\system32\drivers\fastfat.sys
c:\windows\system32\drivers\fdc.sys
c:\windows\system32\drivers\fips.sys
c:\windows\system32\drivers\flpydisk.sys
c:\windows\system32\drivers\fltmgr.sys
c:\windows\system32\drivers\fsvga.sys
c:\windows\system32\drivers\fs_rec.sys
c:\windows\system32\drivers\ftdisk.sys
c:\windows\system32\drivers\gagp30kx.sys
c:\windows\system32\drivers\gm.dls
c:\windows\system32\drivers\gmreadme.txt
c:\windows\system32\drivers\hidclass.sys
c:\windows\system32\drivers\hidparse.sys
c:\windows\system32\drivers\hidusb.sys
c:\windows\system32\drivers\hpn.sys
c:\windows\system32\drivers\hsfhwich.sys
c:\windows\system32\drivers\hsf_cnxt.sys
c:\windows\system32\drivers\hsf_dp.sys
c:\windows\system32\drivers\http.sys
c:\windows\system32\drivers\i2omgmt.sys
c:\windows\system32\drivers\i2omp.sys
c:\windows\system32\drivers\i8042prt.sys
c:\windows\system32\drivers\ialmnt5.sys
c:\windows\system32\drivers\imapi.sys
c:\windows\system32\drivers\ini910u.sys
c:\windows\system32\drivers\intelide.sys
c:\windows\system32\drivers\intelppm.sys
c:\windows\system32\drivers\ip6fw.sys
c:\windows\system32\drivers\ipfltdrv.sys
c:\windows\system32\drivers\ipinip.sys
c:\windows\system32\drivers\ipnat.sys
c:\windows\system32\drivers\ipsec.sys
c:\windows\system32\drivers\irenum.sys
c:\windows\system32\drivers\isapnp.sys
c:\windows\system32\drivers\kbdclass.sys
c:\windows\system32\drivers\kmixer.sys
c:\windows\system32\drivers\ks.sys
c:\windows\system32\drivers\ksecdd.sys
c:\windows\system32\drivers\mcd.sys
c:\windows\system32\drivers\mcstrm.sys
c:\windows\system32\drivers\mdmxsdk.sys
c:\windows\system32\drivers\mf.sys
c:\windows\system32\drivers\mnmdd.sys
c:\windows\system32\drivers\modem.sys
c:\windows\system32\drivers\mouclass.sys
c:\windows\system32\drivers\mountmgr.sys
c:\windows\system32\drivers\mqac.sys
c:\windows\system32\drivers\mraid35x.sys
c:\windows\system32\drivers\mrxdav.sys
c:\windows\system32\drivers\mrxsmb.sys
c:\windows\system32\drivers\msfs.sys
c:\windows\system32\drivers\msgpc.sys
c:\windows\system32\drivers\mskssrv.sys
c:\windows\system32\drivers\mspclock.sys
c:\windows\system32\drivers\mspqm.sys
c:\windows\system32\drivers\mssmbios.sys
c:\windows\system32\drivers\mup.sys
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\drivers\ndistapi.sys
c:\windows\system32\drivers\ndisuio.sys
c:\windows\system32\drivers\ndiswan.sys
c:\windows\system32\drivers\ndproxy.sys
c:\windows\system32\drivers\netbios.sys
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\nic1394.sys
c:\windows\system32\drivers\nikedrv.sys
c:\windows\system32\drivers\nmnt.sys
c:\windows\system32\drivers\npfs.sys
c:\windows\system32\drivers\ntfs.sys
c:\windows\system32\drivers\null.sys
c:\windows\system32\drivers\nv4_mini.sys
c:\windows\system32\drivers\nvatabus.sys
c:\windows\system32\drivers\nvraid.sys
c:\windows\system32\drivers\nwlnkflt.sys
c:\windows\system32\drivers\nwlnkfwd.sys
c:\windows\system32\drivers\nwlnkipx.sys
c:\windows\system32\drivers\nwlnknb.sys
c:\windows\system32\drivers\nwlnkspx.sys
c:\windows\system32\drivers\nwrdr.sys
c:\windows\system32\drivers\ohci1394.sys
c:\windows\system32\drivers\omci.sys
c:\windows\system32\drivers\oprghdlr.sys
c:\windows\system32\drivers\p3.sys
c:\windows\system32\drivers\parport.sys
c:\windows\system32\drivers\partmgr.sys
c:\windows\system32\drivers\parvdm.sys
c:\windows\system32\drivers\pci.sys
c:\windows\system32\drivers\pciide.sys
c:\windows\system32\drivers\pciidex.sys
c:\windows\system32\drivers\pcmcia.sys
c:\windows\system32\drivers\perc2.sys
c:\windows\system32\drivers\perc2hib.sys
c:\windows\system32\drivers\portcls.sys
c:\windows\system32\drivers\processr.sys
c:\windows\system32\drivers\psched.sys
c:\windows\system32\drivers\ptilink.sys
c:\windows\system32\drivers\pxhelp20.sys
c:\windows\system32\drivers\ql1080.sys
c:\windows\system32\drivers\ql10wnt.sys
c:\windows\system32\drivers\ql12160.sys
c:\windows\system32\drivers\ql1240.sys
c:\windows\system32\drivers\ql1280.sys
c:\windows\system32\drivers\rasacd.sys
c:\windows\system32\drivers\rasl2tp.sys
c:\windows\system32\drivers\raspppoe.sys
c:\windows\system32\drivers\raspptp.sys
c:\windows\system32\drivers\raspti.sys
c:\windows\system32\drivers\rawwan.sys
c:\windows\system32\drivers\rdbss.sys
c:\windows\system32\drivers\rdpcdd.sys
c:\windows\system32\drivers\rdpdr.sys
c:\windows\system32\drivers\rdpwd.sys
c:\windows\system32\drivers\redbook.sys
c:\windows\system32\drivers\rio8drv.sys
c:\windows\system32\drivers\riodrv.sys
c:\windows\system32\drivers\rmcast.sys
c:\windows\system32\drivers\rndismp.sys
c:\windows\system32\drivers\rootmdm.sys
c:\windows\system32\drivers\runtime2.sy_
c:\windows\system32\drivers\scsiport.sys
c:\windows\system32\drivers\sdbus.sys
c:\windows\system32\drivers\secdrv.sys
c:\windows\system32\drivers\ser2pl.sys
c:\windows\system32\drivers\serenum.sys
c:\windows\system32\drivers\serial.sys
c:\windows\system32\drivers\sffdisk.sys
c:\windows\system32\drivers\sffp_sd.sys
c:\windows\system32\drivers\sfloppy.sys
c:\windows\system32\drivers\sisagp.sys
c:\windows\system32\drivers\smclib.sys
c:\windows\system32\drivers\sonydcam.sys
c:\windows\system32\drivers\sparrow.sys
c:\windows\system32\drivers\splitter.sys
c:\windows\system32\drivers\sr.sys
c:\windows\system32\drivers\srv.sys
c:\windows\system32\drivers\sscdbhk5.sys
c:\windows\system32\drivers\ssrtln.sys
c:\windows\system32\drivers\stac97.sys
c:\windows\system32\drivers\stream.sys
c:\windows\system32\drivers\swenum.sys
c:\windows\system32\drivers\swmidi.sys
c:\windows\system32\drivers\symc810.sys
c:\windows\system32\drivers\symc8xx.sys
c:\windows\system32\drivers\symevent.cat
c:\windows\system32\drivers\symevent.inf
c:\windows\system32\drivers\sym_hi.sys
c:\windows\system32\drivers\sym_u3.sys
c:\windows\system32\drivers\sysaudio.sys
c:\windows\system32\drivers\tape.sys
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\drivers\tcpip6.sys
c:\windows\system32\drivers\tdi.sys
c:\windows\system32\drivers\tdpipe.sys
c:\windows\system32\drivers\tdtcp.sys
c:\windows\system32\drivers\termdd.sys
c:\windows\system32\drivers\tmactmon.sys
c:\windows\system32\drivers\tmcomm.sys
c:\windows\system32\drivers\tmevtmgr.sys
c:\windows\system32\drivers\tmpreflt.sys
c:\windows\system32\drivers\tmtdi.sys
c:\windows\system32\drivers\tmxpflt.sys
c:\windows\system32\drivers\tm_cfw.sys
c:\windows\system32\drivers\tosdvd.sys
c:\windows\system32\drivers\toside.sys
c:\windows\system32\drivers\tsbvcap.sys
c:\windows\system32\drivers\tunmp.sys
c:\windows\system32\drivers\uagp35.sys
c:\windows\system32\drivers\udfs.sys
c:\windows\system32\drivers\ultra.sys
c:\windows\system32\drivers\update.sys
c:\windows\system32\drivers\usb8023.sys
c:\windows\system32\drivers\usbaudio.sys
c:\windows\system32\drivers\usbcamd.sys
c:\windows\system32\drivers\usbcamd2.sys
c:\windows\system32\drivers\usbccgp.sys
c:\windows\system32\drivers\usbd.sys
c:\windows\system32\drivers\usbehci.sys
c:\windows\system32\drivers\usbhub.sys
c:\windows\system32\drivers\usbintel.sys
c:\windows\system32\drivers\usbport.sys
c:\windows\system32\drivers\usbprint.sys
c:\windows\system32\drivers\usbscan.sys
c:\windows\system32\drivers\usbstor.sys
c:\windows\system32\drivers\usbuhci.sys
c:\windows\system32\drivers\vdmindvd.sys
c:\windows\system32\drivers\vga.sys
c:\windows\system32\drivers\viaagp.sys
c:\windows\system32\drivers\viaide.sys
c:\windows\system32\drivers\videoprt.sys
c:\windows\system32\drivers\volsnap.sys
c:\windows\system32\drivers\vsapint.sys
c:\windows\system32\drivers\wanarp.sys
c:\windows\system32\drivers\wdmaud.sys
c:\windows\system32\drivers\wmilib.sys
c:\windows\system32\drivers\wpdusb.sys
c:\windows\system32\drivers\ws2ifsl.sys

B

bamajim

10.4K Posts

0

December 6th, 2007 12:00

sabrasmom

O.k. Let's proceed.

Boot Into Safe Mode

1. Rerun Hijackthis (scan only) and place checks beside the following entries

O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [dumprep] C:\WINDOWS\system32\spoolc.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol748.txt

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis

2. Using Windows Explorer

(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)

Locate and Delete the following files (be sure the names are exact matches)

C:\WINDOWS\Temp\startdrv.exe
C:\WINDOWS\system32\spoolc.exe
C:\WINDOWS\system32\sol748.txt

Close Windows Explorer

3. We need to see if you can uninstall Norton (Symantec) through add remove programs->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

sabrasmom

29 Posts

0

December 6th, 2007 20:00

bamajim,

I was able to delete the files as requested, except for the startdrv.exe one using explore. It said "Access Denied: Make sure the disk is not full of write-protected and that the file is not currently in use." As for deleting Norton, nothing is coming up under the add/remove button on the control panel that resembles it, except for LiveUpdate (Symantec Corp). However, you cannot delete that in safe mode and in normal, the blue screen shuts me out before I have a chance to delete that item. Here is my HijackThis log under safe mode:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:56, on 2007-12-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1862EF3D-29E4-4127-9615-B1C49977066A} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v57/bjattack/bja.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v45/royal/royal.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4123.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol748.txt
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoBack Polling Service (GBPoll) - Unknown owner - C:\Program Files\Norton SystemWorks Basic Edition\Norton GoBack\GBPoll.exe (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Unknown owner - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE (file missing)
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Speed Disk service - Unknown owner - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE (file missing)
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe (file missing)
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9812 bytes

B

bamajim

10.4K Posts

0

December 6th, 2007 23:00

sabrasmom

Let's continue. We need to get rid of Symantec

Go HERE and download and run the Symantec Removal Tool

Pick the right version according to your application

Then post a fresh Hijackthis log

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

sabrasmom

29 Posts

0

December 6th, 2007 23:00

Alright, it said it's uninstalled. However, I was only able to get the HijackThis in safe mode again. Here it is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:23, on 2007-12-06
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1862EF3D-29E4-4127-9615-B1C49977066A} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v57/bjattack/bja.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v45/royal/royal.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4123.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol748.txt
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7537 bytes

B

bamajim

10.4K Posts

0

December 7th, 2007 12:00

sabrasmom

Delete FakeAlertfix, I have updated the program. There are a couple of files you were unable to delete, let's ee if we can delete tham this way.

1. Go HERE and download FakeAlertFix

Save it to your Desktop. But do not run it yet.

2. Reboot into Safe Mode
This can be done by

Restart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter

3. Run FakeAlertFix ( Make sure IE is closed)

Double click the fakealertfix.Zip file to unzip it.
Open the FakeAlertFix Folder
Double Click FakeAlertFix.vbe to run the program
Then Select O.K. at the prompt
Allow the program to run
When it is finished it wil produce a log C:\FakeAlertFix.txt
Copy and paste the results of that log in your reply

4. Then reboot your PC into Normal Windows Mode->> Rerun Hijackthis and post a fresh Hiajckthis log.
As well as the C:\FakeAlertfix.txt log

Note: you may have to post the results in more than one reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

sabrasmom

29 Posts

0

December 7th, 2007 19:00

And my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:49:07 PM, on 12/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1862EF3D-29E4-4127-9615-B1C49977066A} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/servlet/ProductMessages?module=2007&error=0&language=en&product=SymNRT&version=2008.0.1.19&build=Symantec
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v57/bjattack/bja.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v45/royal/royal.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4123.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\sol748.txt
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 7731 bytes

sabrasmom

29 Posts

0

December 7th, 2007 19:00

Part 2:

FakeAlertFix

Version 1.5.0

By bamajim @ CastleCops.com

========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\winav.exe
%windir%\system32\sessmgr.exe

****** Files in System32\Drivers ******

c:\windows\system32\drivers\1028_dell_ins_i6000.mrk
c:\windows\system32\drivers\1394bus.sys
c:\windows\system32\drivers\abp480n5.sys
c:\windows\system32\drivers\acpi.sys
c:\windows\system32\drivers\acpiec.sys
c:\windows\system32\drivers\adpu160m.sys
c:\windows\system32\drivers\aec.sys
c:\windows\system32\drivers\aegisp.sys
c:\windows\system32\drivers\afd.sys
c:\windows\system32\drivers\agp440.sys
c:\windows\system32\drivers\agpcpq.sys
c:\windows\system32\drivers\aha154x.sys
c:\windows\system32\drivers\aic78u2.sys
c:\windows\system32\drivers\aic78xx.sys
c:\windows\system32\drivers\aliide.sys
c:\windows\system32\drivers\alim1541.sys
c:\windows\system32\drivers\amdagp.sys
c:\windows\system32\drivers\amdk6.sys
c:\windows\system32\drivers\amdk7.sys
c:\windows\system32\drivers\amsint.sys
c:\windows\system32\drivers\apfiltr.sys
c:\windows\system32\drivers\appdrv.sys
c:\windows\system32\drivers\arp1394.sys
c:\windows\system32\drivers\asc.sys
c:\windows\system32\drivers\asc3350p.sys
c:\windows\system32\drivers\asc3550.sys
c:\windows\system32\drivers\asctrm.sys
c:\windows\system32\drivers\asyncmac.sys
c:\windows\system32\drivers\atapi.sys
c:\windows\system32\drivers\atmarpc.sys
c:\windows\system32\drivers\atmepvc.sys
c:\windows\system32\drivers\atmlane.sys
c:\windows\system32\drivers\atmuni.sys
c:\windows\system32\drivers\audstub.sys
c:\windows\system32\drivers\ax88772.sys
c:\windows\system32\drivers\battc.sys
c:\windows\system32\drivers\bcm4sbxp.sys
c:\windows\system32\drivers\bcmwl5.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\bridge.sys
c:\windows\system32\drivers\bvrp_pci.sys
c:\windows\system32\drivers\cbidf2k.sys
c:\windows\system32\drivers\cd20xrnt.sys
c:\windows\system32\drivers\cdaudio.sys
c:\windows\system32\drivers\cdfs.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\drivers\cercsr6.sys
c:\windows\system32\drivers\cinemst2.sys
c:\windows\system32\drivers\classpnp.sys
c:\windows\system32\drivers\cmbatt.sys
c:\windows\system32\drivers\cmdide.sys
c:\windows\system32\drivers\compbatt.sys
c:\windows\system32\drivers\cpqarray.sys
c:\windows\system32\drivers\cpqdap01.sys
c:\windows\system32\drivers\crusoe.sys
c:\windows\system32\drivers\dac2w2k.sys
c:\windows\system32\drivers\dac960nt.sys
c:\windows\system32\drivers\del5422.cty
c:\windows\system32\drivers\disk.sys
c:\windows\system32\drivers\diskdump.sys
c:\windows\system32\drivers\dmboot.sys
c:\windows\system32\drivers\dmio.sys
c:\windows\system32\drivers\dmload.sys
c:\windows\system32\drivers\dmusic.sys
c:\windows\system32\drivers\dpti2o.sys
c:\windows\system32\drivers\drmk.sys
c:\windows\system32\drivers\drmkaud.sys
c:\windows\system32\drivers\drvmcdb.sys
c:\windows\system32\drivers\drvnddm.sys
c:\windows\system32\drivers\dsunidrv.sys
c:\windows\system32\drivers\dxapi.sys
c:\windows\system32\drivers\dxg.sys
c:\windows\system32\drivers\dxgthk.sys
c:\windows\system32\drivers\e100b325.sys
c:\windows\system32\drivers\enum1394.sys
c:\windows\system32\drivers\fastfat.sys
c:\windows\system32\drivers\fdc.sys
c:\windows\system32\drivers\fips.sys
c:\windows\system32\drivers\flpydisk.sys
c:\windows\system32\drivers\fltmgr.sys
c:\windows\system32\drivers\fsvga.sys
c:\windows\system32\drivers\fs_rec.sys
c:\windows\system32\drivers\ftdisk.sys
c:\windows\system32\drivers\gagp30kx.sys
c:\windows\system32\drivers\gm.dls
c:\windows\system32\drivers\gmreadme.txt
c:\windows\system32\drivers\hidclass.sys
c:\windows\system32\drivers\hidparse.sys
c:\windows\system32\drivers\hidusb.sys
c:\windows\system32\drivers\hpn.sys
c:\windows\system32\drivers\hsfhwich.sys
c:\windows\system32\drivers\hsf_cnxt.sys
c:\windows\system32\drivers\hsf_dp.sys
c:\windows\system32\drivers\http.sys
c:\windows\system32\drivers\i2omgmt.sys
c:\windows\system32\drivers\i2omp.sys
c:\windows\system32\drivers\i8042prt.sys
c:\windows\system32\drivers\ialmnt5.sys
c:\windows\system32\drivers\imapi.sys
c:\windows\system32\drivers\ini910u.sys
c:\windows\system32\drivers\intelide.sys
c:\windows\system32\drivers\intelppm.sys
c:\windows\system32\drivers\ip6fw.sys
c:\windows\system32\drivers\ipfltdrv.sys
c:\windows\system32\drivers\ipinip.sys
c:\windows\system32\drivers\ipnat.sys
c:\windows\system32\drivers\ipsec.sys
c:\windows\system32\drivers\irenum.sys
c:\windows\system32\drivers\isapnp.sys
c:\windows\system32\drivers\kbdclass.sys
c:\windows\system32\drivers\kmixer.sys
c:\windows\system32\drivers\ks.sys
c:\windows\system32\drivers\ksecdd.sys
c:\windows\system32\drivers\mcd.sys
c:\windows\system32\drivers\mcstrm.sys
c:\windows\system32\drivers\mdmxsdk.sys
c:\windows\system32\drivers\mf.sys
c:\windows\system32\drivers\mnmdd.sys
c:\windows\system32\drivers\modem.sys
c:\windows\system32\drivers\mouclass.sys
c:\windows\system32\drivers\mountmgr.sys
c:\windows\system32\drivers\mqac.sys
c:\windows\system32\drivers\mraid35x.sys
c:\windows\system32\drivers\mrxdav.sys
c:\windows\system32\drivers\mrxsmb.sys
c:\windows\system32\drivers\msfs.sys
c:\windows\system32\drivers\msgpc.sys
c:\windows\system32\drivers\mskssrv.sys
c:\windows\system32\drivers\mspclock.sys
c:\windows\system32\drivers\mspqm.sys
c:\windows\system32\drivers\mssmbios.sys
c:\windows\system32\drivers\mup.sys
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\drivers\ndistapi.sys
c:\windows\system32\drivers\ndisuio.sys
c:\windows\system32\drivers\ndiswan.sys
c:\windows\system32\drivers\ndproxy.sys
c:\windows\system32\drivers\netbios.sys
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\nic1394.sys
c:\windows\system32\drivers\nikedrv.sys
c:\windows\system32\drivers\nmnt.sys
c:\windows\system32\drivers\npfs.sys
c:\windows\system32\drivers\ntfs.sys
c:\windows\system32\drivers\null.sys
c:\windows\system32\drivers\nv4_mini.sys
c:\windows\system32\drivers\nvatabus.sys
c:\windows\system32\drivers\nvraid.sys
c:\windows\system32\drivers\nwlnkflt.sys
c:\windows\system32\drivers\nwlnkfwd.sys
c:\windows\system32\drivers\nwlnkipx.sys
c:\windows\system32\drivers\nwlnknb.sys
c:\windows\system32\drivers\nwlnkspx.sys
c:\windows\system32\drivers\nwrdr.sys
c:\windows\system32\drivers\ohci1394.sys
c:\windows\system32\drivers\omci.sys
c:\windows\system32\drivers\oprghdlr.sys
c:\windows\system32\drivers\p3.sys
c:\windows\system32\drivers\parport.sys
c:\windows\system32\drivers\partmgr.sys
c:\windows\system32\drivers\parvdm.sys
c:\windows\system32\drivers\pci.sys
c:\windows\system32\drivers\pciide.sys
c:\windows\system32\drivers\pciidex.sys
c:\windows\system32\drivers\pcmcia.sys
c:\windows\system32\drivers\perc2.sys
c:\windows\system32\drivers\perc2hib.sys
c:\windows\system32\drivers\portcls.sys
c:\windows\system32\drivers\processr.sys
c:\windows\system32\drivers\psched.sys
c:\windows\system32\drivers\ptilink.sys
c:\windows\system32\drivers\pxhelp20.sys
c:\windows\system32\drivers\ql1080.sys
c:\windows\system32\drivers\ql10wnt.sys
c:\windows\system32\drivers\ql12160.sys
c:\windows\system32\drivers\ql1240.sys
c:\windows\system32\drivers\ql1280.sys
c:\windows\system32\drivers\rasacd.sys
c:\windows\system32\drivers\rasl2tp.sys
c:\windows\system32\drivers\raspppoe.sys
c:\windows\system32\drivers\raspptp.sys
c:\windows\system32\drivers\raspti.sys
c:\windows\system32\drivers\rawwan.sys
c:\windows\system32\drivers\rdbss.sys
c:\windows\system32\drivers\rdpcdd.sys
c:\windows\system32\drivers\rdpdr.sys
c:\windows\system32\drivers\rdpwd.sys
c:\windows\system32\drivers\redbook.sys
c:\windows\system32\drivers\rio8drv.sys
c:\windows\system32\drivers\riodrv.sys
c:\windows\system32\drivers\rmcast.sys
c:\windows\system32\drivers\rndismp.sys
c:\windows\system32\drivers\rootmdm.sys
c:\windows\system32\drivers\runtime2.sy_
c:\windows\system32\drivers\scsiport.sys
c:\windows\system32\drivers\sdbus.sys
c:\windows\system32\drivers\secdrv.sys
c:\windows\system32\drivers\ser2pl.sys
c:\windows\system32\drivers\serenum.sys
c:\windows\system32\drivers\serial.sys
c:\windows\system32\drivers\sffdisk.sys
c:\windows\system32\drivers\sffp_sd.sys
c:\windows\system32\drivers\sfloppy.sys
c:\windows\system32\drivers\sisagp.sys
c:\windows\system32\drivers\smclib.sys
c:\windows\system32\drivers\sonydcam.sys
c:\windows\system32\drivers\sparrow.sys
c:\windows\system32\drivers\splitter.sys
c:\windows\system32\drivers\sr.sys
c:\windows\system32\drivers\srv.sys
c:\windows\system32\drivers\sscdbhk5.sys
c:\windows\system32\drivers\ssrtln.sys
c:\windows\system32\drivers\stac97.sys
c:\windows\system32\drivers\stream.sys
c:\windows\system32\drivers\swenum.sys
c:\windows\system32\drivers\swmidi.sys
c:\windows\system32\drivers\symc810.sys
c:\windows\system32\drivers\symc8xx.sys
c:\windows\system32\drivers\symevent.cat
c:\windows\system32\drivers\symevent.inf
c:\windows\system32\drivers\sym_hi.sys
c:\windows\system32\drivers\sym_u3.sys
c:\windows\system32\drivers\sysaudio.sys
c:\windows\system32\drivers\tape.sys
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\drivers\tcpip6.sys
c:\windows\system32\drivers\tdi.sys
c:\windows\system32\drivers\tdpipe.sys
c:\windows\system32\drivers\tdtcp.sys
c:\windows\system32\drivers\termdd.sys
c:\windows\system32\drivers\tmactmon.sys
c:\windows\system32\drivers\tmcomm.sys
c:\windows\system32\drivers\tmevtmgr.sys
c:\windows\system32\drivers\tmpreflt.sys
c:\windows\system32\drivers\tmtdi.sys
c:\windows\system32\drivers\tmxpflt.sys
c:\windows\system32\drivers\tm_cfw.sys
c:\windows\system32\drivers\tosdvd.sys
c:\windows\system32\drivers\toside.sys
c:\windows\system32\drivers\tsbvcap.sys
c:\windows\system32\drivers\tunmp.sys
c:\windows\system32\drivers\uagp35.sys
c:\windows\system32\drivers\udfs.sys
c:\windows\system32\drivers\ultra.sys
c:\windows\system32\drivers\update.sys
c:\windows\system32\drivers\usb8023.sys
c:\windows\system32\drivers\usbaudio.sys
c:\windows\system32\drivers\usbcamd.sys
c:\windows\system32\drivers\usbcamd2.sys
c:\windows\system32\drivers\usbccgp.sys
c:\windows\system32\drivers\usbd.sys
c:\windows\system32\drivers\usbehci.sys
c:\windows\system32\drivers\usbhub.sys
c:\windows\system32\drivers\usbintel.sys
c:\windows\system32\drivers\usbport.sys
c:\windows\system32\drivers\usbprint.sys
c:\windows\system32\drivers\usbscan.sys
c:\windows\system32\drivers\usbstor.sys
c:\windows\system32\drivers\usbuhci.sys
c:\windows\system32\drivers\vdmindvd.sys
c:\windows\system32\drivers\vga.sys
c:\windows\system32\drivers\viaagp.sys
c:\windows\system32\drivers\viaide.sys
c:\windows\system32\drivers\videoprt.sys
c:\windows\system32\drivers\volsnap.sys
c:\windows\system32\drivers\vsapint.sys
c:\windows\system32\drivers\wanarp.sys
c:\windows\system32\drivers\wdmaud.sys
c:\windows\system32\drivers\wmilib.sys
c:\windows\system32\drivers\wpdusb.sys
c:\windows\system32\drivers\ws2ifsl.sys
========================================
FakeAlertFix

Version 1.5.1

By bamajim @ CastleCops.com

========================================

C:\WINDOWS\Temp\startdrv.exe Found!
C:\WINDOWS\Temp\startdrv.exe Deleted!
C:\WINDOWS\system32\sol748.txt Found!
C:\WINDOWS\system32\sol748.txt Deleted!
C:\WINDOWS\dcxxygx.exe Found!
C:\WINDOWS\dcxxygx.exe Deleted!
========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\winav.exe
%windir%\system32\sessmgr.exe

sabrasmom

29 Posts

0

December 7th, 2007 19:00

bamajim,

I did as instructed and the blue error screen continues to come up, making my only option to do the HijackThis in safe mode. Here is part one of my log:

========================================
FakeAlertFix

Version 1.5.0

By bamajim @ CastleCops.com

========================================

C:\WINDOWS\system32\protector.exe Found!
C:\WINDOWS\system32\protector.exe Deleted!
========================================

Values under HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

%windir%\system32\winav.exe

****** Files in System32\Drivers ******

c:\windows\system32\drivers\1028_dell_ins_i6000.mrk
c:\windows\system32\drivers\1394bus.sys
c:\windows\system32\drivers\abp480n5.sys
c:\windows\system32\drivers\acpi.sys
c:\windows\system32\drivers\acpiec.sys
c:\windows\system32\drivers\adpu160m.sys
c:\windows\system32\drivers\aec.sys
c:\windows\system32\drivers\aegisp.sys
c:\windows\system32\drivers\afd.sys
c:\windows\system32\drivers\agp440.sys
c:\windows\system32\drivers\agpcpq.sys
c:\windows\system32\drivers\aha154x.sys
c:\windows\system32\drivers\aic78u2.sys
c:\windows\system32\drivers\aic78xx.sys
c:\windows\system32\drivers\aliide.sys
c:\windows\system32\drivers\alim1541.sys
c:\windows\system32\drivers\amdagp.sys
c:\windows\system32\drivers\amdk6.sys
c:\windows\system32\drivers\amdk7.sys
c:\windows\system32\drivers\amsint.sys
c:\windows\system32\drivers\apfiltr.sys
c:\windows\system32\drivers\appdrv.sys
c:\windows\system32\drivers\arp1394.sys
c:\windows\system32\drivers\asc.sys
c:\windows\system32\drivers\asc3350p.sys
c:\windows\system32\drivers\asc3550.sys
c:\windows\system32\drivers\asctrm.sys
c:\windows\system32\drivers\asyncmac.sys
c:\windows\system32\drivers\atapi.sys
c:\windows\system32\drivers\atmarpc.sys
c:\windows\system32\drivers\atmepvc.sys
c:\windows\system32\drivers\atmlane.sys
c:\windows\system32\drivers\atmuni.sys
c:\windows\system32\drivers\audstub.sys
c:\windows\system32\drivers\ax88772.sys
c:\windows\system32\drivers\battc.sys
c:\windows\system32\drivers\bcm4sbxp.sys
c:\windows\system32\drivers\bcmwl5.sys
c:\windows\system32\drivers\beep.sys
c:\windows\system32\drivers\bridge.sys
c:\windows\system32\drivers\bvrp_pci.sys
c:\windows\system32\drivers\cbidf2k.sys
c:\windows\system32\drivers\cd20xrnt.sys
c:\windows\system32\drivers\cdaudio.sys
c:\windows\system32\drivers\cdfs.sys
c:\windows\system32\drivers\cdrom.sys
c:\windows\system32\drivers\cinemst2.sys
c:\windows\system32\drivers\classpnp.sys
c:\windows\system32\drivers\cmbatt.sys
c:\windows\system32\drivers\cmdide.sys
c:\windows\system32\drivers\coh_mon.cat
c:\windows\system32\drivers\coh_mon.inf
c:\windows\system32\drivers\coh_mon.sys
c:\windows\system32\drivers\compbatt.sys
c:\windows\system32\drivers\cpqarray.sys
c:\windows\system32\drivers\cpqdap01.sys
c:\windows\system32\drivers\crusoe.sys
c:\windows\system32\drivers\dac2w2k.sys
c:\windows\system32\drivers\dac960nt.sys
c:\windows\system32\drivers\del5422.cty
c:\windows\system32\drivers\disk.sys
c:\windows\system32\drivers\diskdump.sys
c:\windows\system32\drivers\dmboot.sys
c:\windows\system32\drivers\dmio.sys
c:\windows\system32\drivers\dmload.sys
c:\windows\system32\drivers\dmusic.sys
c:\windows\system32\drivers\dpti2o.sys
c:\windows\system32\drivers\drmk.sys
c:\windows\system32\drivers\drmkaud.sys
c:\windows\system32\drivers\drvmcdb.sys
c:\windows\system32\drivers\drvnddm.sys
c:\windows\system32\drivers\dsunidrv.sys
c:\windows\system32\drivers\dxapi.sys
c:\windows\system32\drivers\dxg.sys
c:\windows\system32\drivers\dxgthk.sys
c:\windows\system32\drivers\e100b325.sys
c:\windows\system32\drivers\enum1394.sys
c:\windows\system32\drivers\fastfat.sys
c:\windows\system32\drivers\fdc.sys
c:\windows\system32\drivers\fips.sys
c:\windows\system32\drivers\flpydisk.sys
c:\windows\system32\drivers\fltmgr.sys
c:\windows\system32\drivers\fsvga.sys
c:\windows\system32\drivers\fs_rec.sys
c:\windows\system32\drivers\ftdisk.sys
c:\windows\system32\drivers\gbdevice.sys
c:\windows\system32\drivers\gbfshook.sys
c:\windows\system32\drivers\gm.dls
c:\windows\system32\drivers\gmreadme.txt
c:\windows\system32\drivers\goback2k.sys
c:\windows\system32\drivers\hidclass.sys
c:\windows\system32\drivers\hidparse.sys
c:\windows\system32\drivers\hidusb.sys
c:\windows\system32\drivers\hpn.sys
c:\windows\system32\drivers\hsfhwich.sys
c:\windows\system32\drivers\hsf_cnxt.sys
c:\windows\system32\drivers\hsf_dp.sys
c:\windows\system32\drivers\http.sys
c:\windows\system32\drivers\i2omgmt.sys
c:\windows\system32\drivers\i2omp.sys
c:\windows\system32\drivers\i8042prt.sys
c:\windows\system32\drivers\ialmnt5.sys
c:\windows\system32\drivers\imapi.sys
c:\windows\system32\drivers\ini910u.sys
c:\windows\system32\drivers\intelide.sys
c:\windows\system32\drivers\intelppm.sys
c:\windows\system32\drivers\ip6fw.sys
c:\windows\system32\drivers\ipfltdrv.sys
c:\windows\system32\drivers\ipinip.sys
c:\windows\system32\drivers\ipnat.sys
c:\windows\system32\drivers\ipsec.sys
c:\windows\system32\drivers\irenum.sys
c:\windows\system32\drivers\isapnp.sys
c:\windows\system32\drivers\kbdclass.sys
c:\windows\system32\drivers\kmixer.sys
c:\windows\system32\drivers\ks.sys
c:\windows\system32\drivers\ksecdd.sys
c:\windows\system32\drivers\mcd.sys
c:\windows\system32\drivers\mcstrm.sys
c:\windows\system32\drivers\mdmxsdk.sys
c:\windows\system32\drivers\mf.sys
c:\windows\system32\drivers\mnmdd.sys
c:\windows\system32\drivers\modem.sys
c:\windows\system32\drivers\mouclass.sys
c:\windows\system32\drivers\mountmgr.sys
c:\windows\system32\drivers\mqac.sys
c:\windows\system32\drivers\mraid35x.sys
c:\windows\system32\drivers\mrxdav.sys
c:\windows\system32\drivers\mrxsmb.sys
c:\windows\system32\drivers\msfs.sys
c:\windows\system32\drivers\msgpc.sys
c:\windows\system32\drivers\mskssrv.sys
c:\windows\system32\drivers\mspclock.sys
c:\windows\system32\drivers\mspqm.sys
c:\windows\system32\drivers\mssmbios.sys
c:\windows\system32\drivers\mup.sys
c:\windows\system32\drivers\ndis.sys
c:\windows\system32\drivers\ndistapi.sys
c:\windows\system32\drivers\ndisuio.sys
c:\windows\system32\drivers\ndiswan.sys
c:\windows\system32\drivers\ndproxy.sys
c:\windows\system32\drivers\netbios.sys
c:\windows\system32\drivers\netbt.sys
c:\windows\system32\drivers\nic1394.sys
c:\windows\system32\drivers\nikedrv.sys
c:\windows\system32\drivers\nmnt.sys
c:\windows\system32\drivers\npdriver.sys
c:\windows\system32\drivers\npfs.sys
c:\windows\system32\drivers\ntfs.sys
c:\windows\system32\drivers\null.sys
c:\windows\system32\drivers\nv4_mini.sys
c:\windows\system32\drivers\nwlnkflt.sys
c:\windows\system32\drivers\nwlnkfwd.sys
c:\windows\system32\drivers\nwlnkipx.sys
c:\windows\system32\drivers\nwlnknb.sys
c:\windows\system32\drivers\nwlnkspx.sys
c:\windows\system32\drivers\nwrdr.sys
c:\windows\system32\drivers\ohci1394.sys
c:\windows\system32\drivers\omci.sys
c:\windows\system32\drivers\oprghdlr.sys
c:\windows\system32\drivers\p3.sys
c:\windows\system32\drivers\parport.sys
c:\windows\system32\drivers\partmgr.sys
c:\windows\system32\drivers\parvdm.sys
c:\windows\system32\drivers\pci.sys
c:\windows\system32\drivers\pciide.sys
c:\windows\system32\drivers\pciidex.sys
c:\windows\system32\drivers\pcmcia.sys
c:\windows\system32\drivers\perc2.sys
c:\windows\system32\drivers\perc2hib.sys
c:\windows\system32\drivers\portcls.sys
c:\windows\system32\drivers\processr.sys
c:\windows\system32\drivers\psched.sys
c:\windows\system32\drivers\ptilink.sys
c:\windows\system32\drivers\pxhelp20.sys
c:\windows\system32\drivers\ql1080.sys
c:\windows\system32\drivers\ql10wnt.sys
c:\windows\system32\drivers\ql12160.sys
c:\windows\system32\drivers\ql1240.sys
c:\windows\system32\drivers\ql1280.sys
c:\windows\system32\drivers\rasacd.sys
c:\windows\system32\drivers\rasl2tp.sys
c:\windows\system32\drivers\raspppoe.sys
c:\windows\system32\drivers\raspptp.sys
c:\windows\system32\drivers\raspti.sys
c:\windows\system32\drivers\rawwan.sys
c:\windows\system32\drivers\rdbss.sys
c:\windows\system32\drivers\rdpcdd.sys
c:\windows\system32\drivers\rdpdr.sys
c:\windows\system32\drivers\rdpwd.sys
c:\windows\system32\drivers\redbook.sys
c:\windows\system32\drivers\rio8drv.sys
c:\windows\system32\drivers\riodrv.sys
c:\windows\system32\drivers\rmcast.sys
c:\windows\system32\drivers\rndismp.sys
c:\windows\system32\drivers\rootmdm.sys
c:\windows\system32\drivers\scsiport.sys
c:\windows\system32\drivers\sdbus.sys
c:\windows\system32\drivers\sddriver.sys
c:\windows\system32\drivers\secdrv.sys
c:\windows\system32\drivers\ser2pl.sys
c:\windows\system32\drivers\serenum.sys
c:\windows\system32\drivers\serial.sys
c:\windows\system32\drivers\sffdisk.sys
c:\windows\system32\drivers\sffp_sd.sys
c:\windows\system32\drivers\sfloppy.sys
c:\windows\system32\drivers\sisagp.sys
c:\windows\system32\drivers\smclib.sys
c:\windows\system32\drivers\sonydcam.sys
c:\windows\system32\drivers\sparrow.sys
c:\windows\system32\drivers\splitter.sys
c:\windows\system32\drivers\sr.sys
c:\windows\system32\drivers\srv.sys
c:\windows\system32\drivers\sscdbhk5.sys
c:\windows\system32\drivers\ssrtln.sys
c:\windows\system32\drivers\stac97.sys
c:\windows\system32\drivers\stream.sys
c:\windows\system32\drivers\swenum.sys
c:\windows\system32\drivers\swmidi.sys
c:\windows\system32\drivers\symc810.sys
c:\windows\system32\drivers\symc8xx.sys
c:\windows\system32\drivers\symevent.cat
c:\windows\system32\drivers\symevent.inf
c:\windows\system32\drivers\symevent.sys
c:\windows\system32\drivers\sym_hi.sys
c:\windows\system32\drivers\sym_u3.sys
c:\windows\system32\drivers\sysaudio.sys
c:\windows\system32\drivers\tape.sys
c:\windows\system32\drivers\tcpip.sys
c:\windows\system32\drivers\tcpip6.sys
c:\windows\system32\drivers\tdi.sys
c:\windows\system32\drivers\tdpipe.sys
c:\windows\system32\drivers\tdtcp.sys
c:\windows\system32\drivers\termdd.sys
c:\windows\system32\drivers\tmactmon.sys
c:\windows\system32\drivers\tmcomm.sys
c:\windows\system32\drivers\tmevtmgr.sys
c:\windows\system32\drivers\tmpreflt.sys
c:\windows\system32\drivers\tmtdi.sys
c:\windows\system32\drivers\tmxpflt.sys
c:\windows\system32\drivers\tm_cfw.sys
c:\windows\system32\drivers\tosdvd.sys
c:\windows\system32\drivers\toside.sys
c:\windows\system32\drivers\tsbvcap.sys
c:\windows\system32\drivers\tunmp.sys
c:\windows\system32\drivers\udfs.sys
c:\windows\system32\drivers\ultra.sys
c:\windows\system32\drivers\update.sys
c:\windows\system32\drivers\usb8023.sys
c:\windows\system32\drivers\usbaudio.sys
c:\windows\system32\drivers\usbcamd.sys
c:\windows\system32\drivers\usbcamd2.sys
c:\windows\system32\drivers\usbccgp.sys
c:\windows\system32\drivers\usbd.sys
c:\windows\system32\drivers\usbehci.sys
c:\windows\system32\drivers\usbhub.sys
c:\windows\system32\drivers\usbintel.sys
c:\windows\system32\drivers\usbport.sys
c:\windows\system32\drivers\usbprint.sys
c:\windows\system32\drivers\usbscan.sys
c:\windows\system32\drivers\usbstor.sys
c:\windows\system32\drivers\usbuhci.sys
c:\windows\system32\drivers\vdmindvd.sys
c:\windows\system32\drivers\vga.sys
c:\windows\system32\drivers\viaagp.sys
c:\windows\system32\drivers\viaide.sys
c:\windows\system32\drivers\videoprt.sys
c:\windows\system32\drivers\volsnap.sys
c:\windows\system32\drivers\vsapint.sys
c:\windows\system32\drivers\wanarp.sys
c:\windows\system32\drivers\wdmaud.sys
c:\windows\system32\drivers\wmilib.sys
c:\windows\system32\drivers\wpdusb.sys
c:\windows\system32\drivers\ws2ifsl.sys
========================================

sabrasmom

29 Posts

0

December 7th, 2007 20:00

bajajim,

I think it worked! The combofix that I had installed on my computer before never searched through that many things. But it's up and running now with no blue error screen, and I can even access the internet with my computer. There is however, a straight line across my computer but the Trend Micro is now fully installed and is scanning for viruses. As for what I was doing when the blue screen came up the first time, was trying to uninstall Norton and install Trend Micro Internet Security Pro instead, after Norton kept saying that I had a virus but it could not remove or quarintine it. Anyways, here is my combofix log:

ComboFix 07-12-07.5 - Amanda Sell 2007-12-07 17:24:36.2 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.348 [GMT -5:00]
Running from: E:\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\3_exception.nls
C:\WINDOWS\system32\drivers\ctl_w32.sys
C:\WINDOWS\system32\drivers\ip6fw.sys
C:\WINDOWS\system32\drivers\KWF49.sys
C:\WINDOWS\system32\drivers\runtime2.sy_
C:\WINDOWS\system32\drivers\smtpdrv.sys
C:\WINDOWS\system32\drivers\symavc32.sys
C:\WINDOWS\system32\ntio256.sys
.
---- Previous Run -------
.
C:\Documents and Settings\Amanda Sell\Application Data\searchtoolbarcorp
C:\Documents and Settings\Amanda Sell\Application Data\searchtoolbarcorp\Toolbar Vision\PageHistory.txt
C:\Documents and Settings\Amanda Sell\Application Data\searchtoolbarcorp\Toolbar Vision\WebHistory.txt
C:\Program Files\screensavers.com
C:\Program Files\screensavers.com\Installer\bin\siuninst.exe
C:\Program Files\screensavers.com\Installer\temp\dm1C2.tmp
C:\Program Files\screensavers.com\Wallpaper\Sea Turtle 2.jpg
C:\Program Files\screensavers.com\Wallpaper\swpstart.exe
C:\Program Files\vsadd-in
C:\WINDOWS\system32\bszip.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_CTL_W32
-------\LEGACY_KWF49
-------\LEGACY_NTIO256
-------\LEGACY_RUNTIME
-------\ntio256

((((((((((((((((((((((((( Files Created from 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))
.

2007-12-07 17:34 . 474,374 C:\WINDOWS\system32\PerfStringBackup.TMP
2007-12-05 20:53 . 2005-02-15 15:02 163,840 --a------ C:\WINDOWS\system32\igfxres.dll
2007-12-05 20:29 . 2004-08-04 07:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2007-12-05 20:27 . 2004-08-04 07:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2007-12-05 20:26 . 2004-08-04 07:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2007-12-05 20:25 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2007-12-05 20:23 . 2004-08-04 07:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2007-12-05 14:59 . 2007-12-05 14:59 d-------- C:\WINDOWS\dell
2007-12-03 18:48 . 2007-12-03 18:48 d-------- C:\WINDOWS\ERUNT
2007-12-03 17:51 . 2007-12-03 17:54 d--h----- C:\WINDOWS\system32\GroupPolicy
2007-12-03 16:41 . 2007-12-03 16:41 29 --a------ C:\WINDOWS\system32\puqardaq.tmp
2007-12-03 16:39 . 2007-12-03 16:39 138,240 --a------ C:\WINDOWS\xnnnav.exe
2007-12-02 23:16 . 2007-12-02 23:16 d-------- C:\WINDOWS\l2schemas
2007-12-02 23:15 . 2006-11-01 02:14 69,120 --a------ C:\WINDOWS\system32\wlanapi.dll
2007-12-02 21:42 . 2007-12-02 21:42 210 --a------ C:\WINDOWS\system32\3021.lps
2007-12-02 21:07 . 2007-12-02 21:07 d-------- C:\WINDOWS\LocalSSL
2007-12-02 21:07 . 2007-12-03 16:51 d-------- C:\WINDOWS\kdefense
2007-12-02 21:07 . 2007-12-02 21:07 849,920 --a------ C:\WINDOWS\system32\kdfinj.dll
2007-12-02 21:07 . 2007-12-03 16:27 726,568 --a------ C:\WINDOWS\system32\kdfmgr.exe
2007-12-02 21:07 . 2007-12-03 16:27 192,512 --a------ C:\WINDOWS\system32\kdfvmgr.exe
2007-12-02 21:07 . 2007-12-03 16:27 77,824 --a------ C:\WINDOWS\system32\kdfapi.dll
2007-12-02 21:07 . 2007-12-03 16:27 53,248 --a------ C:\WINDOWS\system32\Kdfhok.dll
2007-12-02 21:03 . 2007-09-17 13:29 138,512 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-02 21:03 . 2007-09-17 13:29 52,496 --a------ C:\WINDOWS\system32\drivers\tmactmon.sys
2007-12-02 21:03 . 2007-09-17 13:29 52,368 --a------ C:\WINDOWS\system32\drivers\tmevtmgr.sys
2007-12-02 21:00 . 2007-12-02 21:07 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-12-02 20:24 . 2007-12-02 20:24 20,992 --a------ C:\WINDOWS\daverx.exe
2007-12-01 10:28 . 2007-12-02 23:22 291,328 --a------ C:\WINDOWS\system32\libcurl.dll
2007-11-18 22:00 . 2007-11-18 22:00 d-------- C:\Documents and Settings\Sell\Application Data\GTek

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 21:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-03 02:05 --------- d-----w C:\Program Files\Trend Micro
2007-12-03 01:46 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2006-03-05 03:34 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-01-16 04:34 830,685 --sha-w C:\WINDOWS\Registration\3mpdcm.bak1
2007-02-03 00:06 983,236 --sha-w C:\WINDOWS\Registration\3mpdcm.bak2
2007-02-03 00:17 960,155 --sha-w C:\WINDOWS\Registration\3mpdcm.ini2
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1862EF3D-29E4-4127-9615-B1C49977066A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E7620C98-FCCC-40E5-92EC-C7685D2E1E40}"= C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll [2007-09-16 09:21 103760]

[HKEY_CLASSES_ROOT\clsid\{e7620c98-fccc-40e5-92ec-c7685d2e1e40}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EC525605-2266-4775-8F78-A68A6446465C}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-18 12:40]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-06 17:28]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 12:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-02-15 15:02]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-02-15 15:02]
"EPSON Stylus CX4200 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.exe" [2005-03-07 22:00]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 11:26]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 16:33]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2007-09-17 13:25]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-01 09:54:12]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
"NoToolbarsOnTaskbar"= 0 (0x0)

R2 BCMNTIO;BCMNTIO;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys
R2 MAPMEM;MAPMEM;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys
S1 ctl_w32;ctl_w32;C:\WINDOWS\system32\drivers\ctl_w32.sys
S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver;\??\D:\INSTAL~E\Core\BVRPMPR5.SYS
S3 DPCNET5U;Satellite USB Driver;C:\WINDOWS\system32\DRIVERS\dpcnet5u.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM

*Newly Created Service* - BITS
.
------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\DOCUME~1\AMANDA~1\LOCALS~1\Temp\pfsplmyx.dll
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 17:33:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 17:37:15 - machine was rebooted
.
--- E O F ---

B

bamajim

10.4K Posts

0

December 7th, 2007 20:00

sabrasmom

Something is not right here. When did the Blue screen issue start?

Was it when you installed something?

Did you replace something?

Was it when you downloaded something?

This file C:\WINDOWS\system32\ savedump.exe is a system dump file indicating a system failure. And I think it is making the removal of some of this infection near impossible.

Usually a software issue will be resolved by a repair install.

I can only think of one other thing to try, before it's time to pull your data off the HD and reformat.

I know you tried this before, but we need to try again

Please download Combofix and save to your desktop:

Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

B

bamajim

10.4K Posts

0

December 8th, 2007 01:00

sabrasmom

Outstanding. Could I see a fresh Hijackthis log in Normal windows mode?

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

sabrasmom

29 Posts

0

December 8th, 2007 02:00

bamajim,

Here is the new HijackThis log. Also, the icon for my desktop for my internet explorer does not allow you to run it but just creates shortcuts on the desktop. There is also an install for Photo Gallery that comes up as soon as I turn on the computer or come back from hibernation.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:11 PM, on 12/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1862EF3D-29E4-4127-9615-B1C49977066A} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: TransactionProtector BHO - {C1656CCA-D2EA-4A32-94AE-AE0B180E6449} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O3 - Toolbar: Transaction Protector - {E7620C98-FCCC-40E5-92EC-C7685D2E1E40} - C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://mypoints.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.webshots.com/html/atx/wsaxcontrol.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinner.com/games/v57/bjattack/bja.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinner.com/games/v41/freecell/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} (Cubis Control) - http://www.worldwinner.com/games/v57/cubis/cubis.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinner.com/games/v46/sol/sol.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BB637307-92FA-47EC-B3F7-6969078673CC} (Royal Control) - http://www.worldwinner.com/games/v45/royal/royal.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinner.com/games/v43/paint/paint.cab
O16 - DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} (MsnMusicAx Class) - http://entimg.msn.com/client/msnmusax4123.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 9395 bytes

B

bamajim

10.4K Posts

0

December 10th, 2007 11:00

sabrasmom

1. Open NotePad (not wordpad). Copy and paste the following into Notepad



File::
C:\WINDOWS\xnnnav.exe
C:\WINDOWS\daverx.exe

Driver::
ctl_w32

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1862EF3D-29E4-4127-9615-B1C49977066A}]

Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop

Using the Image as a reference, drag CFScript into ComboFix.exe



     
     
     
     
     
      
       You will be prompted to run Combofix again, Do so 
Following the same rules as indicated in my first post 
Then post the contents of the C:\ComboFix.txt log in your reply

Microsoft MVP Windows-Security

CastleCops Instructor

"The world is what you make of it"

sabrasmom

29 Posts

0

December 10th, 2007 22:00

The Photo Gallery installation button still comes up upon startup, the internet desktop icon only allows you to create a shortcut and there is still a line across the screen. Below is the log for Combofix. Thanks for helping me this much!

ComboFix 07-12-07.5 - Amanda Sell 2007-12-10 19:33:10.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.161 [GMT -5:00]
Running from: C:\Documents and Settings\Amanda Sell\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Amanda Sell\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\daverx.exe
C:\WINDOWS\xnnnav.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\daverx.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))
.

2007-12-09 11:40 . 2007-12-09 11:40 d-------- C:\WINDOWS\LastGood
2007-12-05 20:53 . 2005-02-15 15:02 163,840 --a------ C:\WINDOWS\system32\igfxres.dll
2007-12-05 20:29 . 2004-08-04 07:00 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls
2007-12-05 20:27 . 2004-08-04 07:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2007-12-05 20:26 . 2004-08-04 07:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2007-12-05 20:25 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2007-12-05 20:23 . 2004-08-04 07:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2007-12-05 20:23 . 2007-12-05 20:23 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2007-12-05 14:59 . 2007-12-05 14:59 d-------- C:\WINDOWS\dell
2007-12-03 18:48 . 2007-12-03 18:48 d-------- C:\WINDOWS\ERUNT
2007-12-03 17:51 . 2007-12-03 17:54 d--h----- C:\WINDOWS\system32\GroupPolicy
2007-12-03 16:41 . 2007-12-03 16:41 29 --a------ C:\WINDOWS\system32\puqardaq.tmp
2007-12-02 23:16 . 2007-12-02 23:16 d-------- C:\WINDOWS\l2schemas
2007-12-02 23:15 . 2006-11-01 02:14 69,120 --a------ C:\WINDOWS\system32\wlanapi.dll
2007-12-02 21:42 . 2007-12-02 21:42 210 --a------ C:\WINDOWS\system32\3021.lps
2007-12-02 21:07 . 2007-12-02 21:07 d-------- C:\WINDOWS\LocalSSL
2007-12-02 21:07 . 2007-12-03 16:51 d-------- C:\WINDOWS\kdefense
2007-12-02 21:07 . 2007-12-02 21:07 849,920 --a------ C:\WINDOWS\system32\kdfinj.dll
2007-12-02 21:07 . 2007-12-03 16:27 726,568 --a------ C:\WINDOWS\system32\kdfmgr.exe
2007-12-02 21:07 . 2007-12-03 16:27 192,512 --a------ C:\WINDOWS\system32\kdfvmgr.exe
2007-12-02 21:07 . 2007-12-03 16:27 77,824 --a------ C:\WINDOWS\system32\kdfapi.dll
2007-12-02 21:07 . 2007-12-03 16:27 53,248 --a------ C:\WINDOWS\system32\Kdfhok.dll
2007-12-02 21:03 . 2007-09-17 13:29 138,512 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-02 21:03 . 2007-09-17 13:29 52,496 --a------ C:\WINDOWS\system32\drivers\tmactmon.sys
2007-12-02 21:03 . 2007-09-17 13:29 52,368 --a------ C:\WINDOWS\system32\drivers\tmevtmgr.sys
2007-12-02 21:00 . 2007-12-02 21:07 d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2007-12-01 10:28 . 2007-12-02 23:22 291,328 --a------ C:\WINDOWS\system32\libcurl.dll
2007-11-18 22:00 . 2007-11-18 22:00 d-------- C:\Documents and Settings\Sell\Application Data\GTek

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 21:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-03 02:05 --------- d-----w C:\Program Files\Trend Micro
2007-12-03 01:46 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-31 18:03 245,408 ----a-w C:\WINDOWS\system32\unicows.dll
2006-03-05 03:34 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2007-01-16 04:34 830,685 --sha-w C:\WINDOWS\Registration\3mpdcm.bak1
2007-02-03 00:06 983,236 --sha-w C:\WINDOWS\Registration\3mpdcm.bak2
2007-02-03 00:17 960,155 --sha-w C:\WINDOWS\Registration\3mpdcm.ini2
.

((((((((((((((((((((((((((((( snapshot_2007-12-09_11.38.58.20 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1862EF3D-29E4-4127-9615-B1C49977066A}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E7620C98-FCCC-40E5-92EC-C7685D2E1E40}"= C:\Program Files\Trend Micro\TrendSecure\TransactionProtector\TSToolbar.dll [2007-09-16 09:21 103760]

[HKEY_CLASSES_ROOT\clsid\{e7620c98-fccc-40e5-92ec-c7685d2e1e40}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EC525605-2266-4775-8F78-A68A6446465C}]
[HKEY_CLASSES_ROOT\TSToolbar.TSProtectorBar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"QdrModule10"="C:\Program Files\QdrModule\QdrModule10.exe" []
"QdrPack10"="C:\Program Files\QdrPack\QdrPack10.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-18 12:40]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-12-06 17:28]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 12:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-02-15 15:02]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-02-15 15:02]
"EPSON Stylus CX4200 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.exe" [2005-03-07 22:00]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05]
"Dell Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" []
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2005-03-04 11:26]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 16:33]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2007-09-17 13:25]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-10-01 09:54:12]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 11:59:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
"NoMovingBands"= 0 (0x0)
"NoCloseDragDropBands"= 0 (0x0)
"NoToolbarsOnTaskbar"= 0 (0x0)

R2 BCMNTIO;BCMNTIO;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys
R2 MAPMEM;MAPMEM;\??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys
S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver;\??\D:\INSTAL~E\Core\BVRPMPR5.SYS
S3 DPCNET5U;Satellite USB Driver;C:\WINDOWS\system32\DRIVERS\dpcnet5u.sys
S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM

.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-10 19:36:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-10 19:37:40
C:\ComboFix2.txt ... 2007-12-09 11:40
C:\ComboFix3.txt ... 2007-12-07 20:33
.
--- E O F ---

1
2
3

View All

No Events found!

Virus & Spyware

HELP! Possible trojan virus on computer.

Was this post helpful?