Major trouble with virtumonde- please help!!

Question

I am getting numberous popups telling me to download security software and explore keeps lockng up. also, my computer is only one week old and very slow now. Please help!   Here is my saved logfile. Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:42:49 PM, on 8/10/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\SCardSvr.exeC:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\WINDOWS\system32\StacSV.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeC:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeC:\WINDOWS\system32\dllhost.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Trend Micro\OfficeScan Client	mlisten.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\TEMP\NT2547.EXEC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exeC:\WINDOWS\system32\msdtc.exeC:\Program Files\Apoint\Apoint.exeC:\WINDOWS\system32\igfxsrvc.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Apoint\ApMsgFwd.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeC:\Program Files\Wave Systems Corp\SecureUpgrade.exeC:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exeC:\WINDOWS\system32\KADxMain.exeC:\Program Files\Apoint\HidFind.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Trend Micro\OfficeScan Client\pccnt.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webaccR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.comR1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe'O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeO4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exeO4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exeO4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exeO4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startupO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe'O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exeO4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindowO4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe'O4 - HKLM\..\Run: [b807e2d7] rundll32.exe 'C:\WINDOWS\system32\pgojvwyu.dll',bO4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] 'C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe' /autocheckO4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -schedulerO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cabO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeO23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeO23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeO23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exeO23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exeO23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 9416 bytes

bamajim · Answer

ceblake2008

Please download Combofix and save to your desktop:

Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

ceblake2008 · Answer

The log is really long so I had to split it up. Here is the first half.    ComboFix 08-08-10.04 - Christine Blake 2008-08-11 10:46:42.2 - NTFSx86Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1438 [GMT -4:00]Running from: C:\Documents and Settings\Christine Blake.CEBLAKE\Desktop\ComboFix.exe * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\macromedia\Flash Player\#SharedObjects\FSVXS47D\interclick.comC:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\macromedia\Flash Player\#SharedObjects\FSVXS47D\interclick.com\ud.solC:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.comC:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.solC:\Documents and Settings\Christine Blake\Application Data\macromedia\Flash Player\#SharedObjects\XXAE9CVK\interclick.comC:\Documents and Settings\Christine Blake\Application Data\macromedia\Flash Player\#SharedObjects\XXAE9CVK\interclick.com\ud.solC:\Documents and Settings\Christine Blake\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.comC:\Documents and Settings\Christine Blake\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.solC:\WINDOWS\BMbb34d14b.txtC:\WINDOWS\pskt.iniC:\WINDOWS\system32\cbXNGXrq.dllC:\WINDOWS\system32\cfiSstwa.iniC:\WINDOWS\system32\cfiSstwa.ini2C:\WINDOWS\system32\dvkrdppw.iniC:\WINDOWS\system32\fccyVppP.dllC:\WINDOWS\system32\jwjkmt.dllC:\WINDOWS\system32
xtkywvp.dllC:\WINDOWS\system32\PppVyccf.iniC:\WINDOWS\system32\PppVyccf.ini2C:\WINDOWS\system32\uywvjogp.iniC:\WINDOWS\system32\wppdrkvd.dllC:\WINDOWS\system32\wydbnspj.dllC:\WINDOWS\system32\x64C:\WINDOWS\system32\xedmhtmq.dll.---- Previous Run -------.C:\WINDOWS\cookies.iniC:\WINDOWS\system32\mcrh.tmp .(((((((((((((((((((((((((   Files Created from 2008-07-11 to 2008-08-11  ))))))))))))))))))))))))))))))). 2008-08-11 10:42 . 2008-08-11 10:42 0 --a------ C:\WINDOWS\BMbb34d14b.xml2008-08-10 20:09 . 2008-08-10 20:20 1,905 --a------ C:\WINDOWS\diagwrn.xml2008-08-10 20:09 . 2008-08-10 20:20 1,905 --a------ C:\WINDOWS\diagerr.xml2008-08-09 16:26 . 2008-08-11 10:01   d-------- C:\Program Files\Spyware Doctor 2008-08-09 16:26 . 2008-08-09 16:26   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\PC Tools 2008-08-09 16:26 . 2008-08-11 11:01   d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-09 16:26 . 2008-06-10 21:22 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-08-09 16:26 . 2008-06-02 15:19 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-08-09 16:26 . 2008-06-02 15:19 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-08-09 16:26 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-08-08 13:48 . 2008-08-08 13:48   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2008-08-08 13:04 . 2008-08-09 17:07   d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-08 13:04 . 2008-08-09 17:17   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-08 08:11 . 2008-08-08 08:11   d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-08 08:09 . 2008-08-08 18:05   d-------- C:\Program Files\Common Files\Adobe 2008-08-08 08:03 . 2008-08-08 18:05   d-------- C:\Documents and Settings\All Users\Application Data\NOS 2008-08-07 09:48 . 2008-08-07 09:48 21 --a------ C:	muninst.ini 2008-08-07 09:47 . 2008-08-07 09:47   d-------- C:\WINDOWS\system32\log 2008-08-07 08:53 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-08-07 08:53 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-08-07 08:41 . 2008-08-07 08:41   d-------- C:\Program Files\MSXML 4.0 2008-08-06 22:26 . 2008-08-06 22:26   d-------- C:\WINDOWS\Sun 2008-08-06 19:00 . 2008-08-06 19:00 4,128 --a------ C:\INFCACHE.1 2008-08-06 15:17 . 2008-08-11 10:02 86 --a------ C:\WINDOWS\WPCMAPI.INI 2008-08-06 15:12 . 2008-08-06 15:12   d-------- C:\Novell 2008-08-06 15:10 . 2008-08-06 15:13   d-------- C:\WINDOWS\FORMS 2008-08-06 15:10 . 1997-01-21 15:28 280,064 --a------ C:\WINDOWS\system32\csta32.dll 2008-08-06 15:10 . 1996-10-12 21:55 133,904 --a------ C:\WINDOWS\system32\mfcans32.dll 2008-08-06 14:49 . 2008-08-06 14:49   d-------- C:\quarantine 2008-08-06 14:49 . 2008-08-07 08:16 142,096 --a------ C:\WINDOWS\system32\drivers	mcomm.sys 2008-08-06 14:49 . 2008-08-11 09:53 13,586 --a------ C:\WINDOWS\cfgall.ini 2008-08-06 14:48 . 2008-08-06 14:49   d-------- C:\Temp 2008-08-06 14:48 . 2008-08-10 20:41   d-------- C:\Program Files\Trend Micro 2008-08-05 20:59 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-05 19:35 . 2004-03-21 09:35 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys 2008-08-05 19:23 . 2008-08-05 19:23   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\CyberLink 2008-08-05 19:23 . 2004-04-12 07:10 581,632 -ra------ C:\WINDOWS\system32\hpotscl.dll 2008-08-05 19:23 . 2004-03-13 07:32 278,528 -ra------ C:\WINDOWS\system32\hpgwiamd.dll 2008-08-05 19:23 . 2004-03-13 07:34 270,336 -ra------ C:\WINDOWS\system32\HPZc3212.dll 2008-08-05 19:23 . 2004-04-12 07:10 90,112 -ra------ C:\WINDOWS\system32\hpovst08.dll 2008-08-05 19:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-08-05 19:23 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-08-05 19:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-08-05 19:23 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-08-05 19:22 . 2008-08-05 19:22   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\Dell 2008-08-05 19:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-08-05 19:22 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-08-05 19:21 . 2008-07-29 22:27   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\Wave Systems Corp 2008-08-05 19:21 . 2008-07-29 22:16   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\Intel 2008-08-05 19:21 . 2008-07-29 22:15   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE\Application Data\InstallShield 2008-08-05 19:21 . 2008-08-11 09:37   d-------- C:\Documents and Settings\Christine Blake.CEBLAKE 2008-08-05 09:49 . 2008-08-05 09:49   d-------- C:\Program Files\Common Files\HP 2008-08-05 09:48 . 2008-08-05 09:48   d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard 2008-08-05 09:47 . 2008-08-05 09:47   d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-08-05 09:43 . 2008-08-05 19:19   d-------- C:\Program Files\HP 2008-08-05 09:42 . 2008-08-05 10:01 104,294 --a------ C:\WINDOWS\hpoins04.dat 2008-08-05 09:42 . 2004-06-21 06:14 17,176 --------- C:\WINDOWS\hpomdl04.dat 2008-08-04 22:24 . 2008-08-05 19:20   d-------- C:\Documents and Settings\Christine Blake\UserData 2008-08-04 15:37 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-04 15:37 . 2008-06-13 09:10 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-04 14:52 . 2008-07-29 22:27   d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Wave Systems Corp 2008-08-04 14:52 . 2008-07-29 22:15   d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield 2008-08-04 14:52 . 2008-07-29 22:16   d-------- C:\Documents and Settings\Christine Blake\Application Data\Intel 2008-08-04 14:52 . 2008-08-05 19:20   d---s---- C:\Documents and Settings\Christine Blake 2008-08-04 14:45 . 2008-08-04 14:45 8,192 --a------ C:\WINDOWS\REGLOCS.OLD 2008-07-29 22:38 . 2008-07-29 22:38 61 --a------ C:\WINDOWS\smscfg.ini 2008-07-29 22:35 . 2008-08-06 14:32   d-------- C:\Program Files\Google 2008-07-29 22:35 . 2008-07-29 22:35   d-------- C:\Program Files\CyberLink 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Program Files\Sonic 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Program Files\Roxio 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Program Files\Common Files\SureThing Shared 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Program Files\Common Files\Sonic Shared 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Program Files\Common Files\Roxio Shared 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Documents and Settings\All Users\Application Data\Sonic 2008-07-29 22:34 . 2008-07-29 22:34   d-------- C:\Documents and Settings\All Users\Application Data\InstallShield 2008-07-29 22:33 . 2004-08-04 06:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-07-29 22:33 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-07-29 22:31 . 2008-07-29 22:31   d-------- C:\Program Files\Sigmatel 2008-07-29 22:31 . 2008-07-29 22:31   d-------- C:\Program Files\CONEXANT 2008-07-29 22:30 . 2005-11-02 12:24 36,864 --a------ C:\WINDOWS\system32	pmddl.dll 2008-07-29 22:27 . 2008-07-29 22:27   d-------- C:\Documents and Settings\Administrator\Application Data\Wave Systems Corp 2008-07-29 22:27 . 2007-11-08 23:49 1,769,472 --a------ C:\WINDOWS\system32\Tsp1.dll 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\WINDOWS\system32\GTwinUSB 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\WINDOWS\system32\GPinPad 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\WINDOWS\system32\GemPCKey 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\WINDOWS\system32\GemPCExp 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\WINDOWS\system32\GemPCCard 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\Program Files\Gemplus 2008-07-29 22:24 . 2008-07-29 22:24   d-------- C:\Program Files\Fingerprint Sensor 2008-07-29 22:23 . 2007-09-07 10:57 80,368 --a------ C:\WINDOWS\system32\pbadrvdll.dll 2008-07-29 22:23 . 2007-09-07 10:57 26,608 --a------ C:\WINDOWS\system32\drivers\PBADRV.sys 2008-07-29 22:20 . 2008-07-29 22:20   d-------- C:\WINDOWS\system32\Test 2008-07-29 22:20 . 2008-07-29 22:20   d-------- C:\WINDOWS\system32\BioAPIFFDB 2008-07-29 22:20 . 2008-07-29 22:28   d-------- C:\Program Files\Wave Systems Corp 2008-07-29 22:20 . 2008-07-29 22:20   d-------- C:\Program Files\NTRU Cryptosystems 2008-07-29 22:20 . 2008-07-29 22:28   d-------- C:\Documents and Settings\All Users\Application Data\Wave Systems Corp 2008-07-29 22:20 . 2008-07-29 22:20   d-------- C:\Documents and Settings\All Users\Application Data\NTRU Cryptosystems 2008-07-29 22:20 . 2006-11-16 17:09 1,258,496 --a------ C:\WINDOWS\system	fmessbsp.dll 2008-07-29 22:20 . 2005-10-25 19:57 143,360 --a------ C:\WINDOWS\system32\bioapi_mds300.dll 2008-07-29 22:20 . 2005-10-25 19:57 106,496 --a------ C:\WINDOWS\system32\bioapi100.dll 2008-07-29 22:17 . 2008-07-29 22:17   d-------- C:\Program Files\Intel, Inc 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\WINDOWS\system32\config\systemprofile\Application Data\Intel 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\Program Files\Intel 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\Documents and Settings\NetworkService\Application Data\Intel 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\Documents and Settings\LocalService\Application Data\Intel 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\Documents and Settings\All Users\Application Data\Intel 2008-07-29 22:16 . 2008-07-29 22:16   d-------- C:\Documents and Settings\Administrator\Application Data\Intel 2008-07-29 22:16 . 2008-07-29 22:16 356,352 --a------ C:\WINDOWS\system32\AegisI5Installer.exe 2008-07-29 22:16 . 2008-07-29 22:16 21,393 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-07-29 22:16 . 2008-07-29 22:16 21,393 --a------ C:\WINDOWS\AegisP.sys 2008-07-29 22:16 . 2008-07-29 22:16 13,864 --a------ C:\WINDOWS\AegisP.inf 2008-07-29 22:16 . 2008-07-29 22:16 10,640 --a------ C:\WINDOWS\AegisP.cat 2008-07-29 22:15 . 2008-07-29 22:20   d-------- C:\WINDOWS\Downloaded Installations 2008-07-29 22:15 . 2008-07-29 22:15   d-------- C:\Program Files\NetWaiting 2008-07-29 22:15 . 2008-07-29 22:15   d-------- C:\Program Files\Modem Diagnostic Tool 2008-07-29 22:15 . 2008-07-29 22:35   d--h----- C:\Program Files\InstallShield Installation Information 2008-07-29 22:15 . 2008-07-29 22:15   d-------- C:\Program Files\Digital Line Detect 2008-07-29 22:15 . 2008-07-29 22:35   d-------- C:\Program Files\Dell 2008-07-29 22:15 . 2008-07-29 22:34   d-------- C:\Program Files\Common Files\InstallShield 2008-07-29 22:15 . 2008-07-29 22:15   d-------- C:\Program Files\Broadcom 2008-07-29 22:15 . 2008-07-29 22:15   d-------- C:\Documents and Settings\All Users\Application Data\Dell 2008-07-29 22:15 . 2008-07-29 22:34   d-------- C:\Documents and Settings\Administrator\Application Data\InstallShield 2008-07-29 22:15 . 2005-12-05 10:54 307,200 --a------ C:\WINDOWS\system32\BMAPI.dll 2008-07-29 22:15 . 2008-02-22 13:45 233,472 --a------ C:\WINDOWS\system32\NicConfigSvc.cpl 2008-07-29 22:15 . 2005-12-05 10:54 61,440 --a------ C:\WINDOWS\system32\KPower.dll .

ceblake2008 · Answer

Here is the second half   .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-08-07 12:16 72,072 ----a-w C:\WINDOWS\system32\drivers	mtdi.sys2008-07-30 01:53 6,949 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_LAT_D630.mrk2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers	cpip.sys2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache	cpip.sys2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers	cpip6.sys2008-06-20 09:52 225,920 ------w C:\WINDOWS\system32\dllcache	cpip6.sys. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ISUSPM'='C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' [2006-09-11 05:40 218032]'swg'='C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe' [2008-07-29 22:35 68856]'SpybotSD TeaTimer'='C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe' [2008-07-07 09:42 2156368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'Apoint'='C:\Program Files\Apoint\Apoint.exe' [2007-01-25 03:34 159744]'IgfxTray'='C:\WINDOWS\system32\igfxtray.exe' [2007-05-18 12:45 138008]'HotKeysCmds'='C:\WINDOWS\system32\hkcmd.exe' [2007-05-18 12:45 162584]'Persistence'='C:\WINDOWS\system32\igfxpers.exe' [2007-05-18 12:45 138008]'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe' [2008-02-22 05:25 144784]'Dell QuickSet'='C:\Program Files\Dell\QuickSet\quickset.exe' [2008-02-22 13:43 1245184]'IntelZeroConfig'='C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe' [2007-07-25 17:32 823296]'IntelWireless'='C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' [2007-07-25 17:30 974848]'WavXMgr'='C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe' [2007-09-10 10:55 92160]'SecureUpgrade'='C:\Program Files\Wave Systems Corp\SecureUpgrade.exe' [2007-09-14 11:53 218424]'KADxMain'='C:\WINDOWS\system32\KADxMain.exe' [2006-11-02 15:05 282624]'Google Desktop Search'='C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' [2008-07-29 22:35 29744]'ECenter'='C:\Dell\E-Center\EULALauncher.exe' [2008-02-26 16:16 17920]'PDVDDXSrv'='C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' [2008-02-26 11:57 128296]'BuildBU'='c:\dell\bldbubg.exe' [2004-02-19 07:23 61440]'OfficeScanNT Monitor'='C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' [2008-08-07 08:19 714024]'ISTray'='C:\Program Files\Spyware Doctor\pctsTray.exe' [2008-07-16 09:16 1166216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-07-29 22:15:21 50688]GroupWise Notify.lnk - C:\Novell\GroupWise
otify.exe [2008-08-06 15:13:05 184378] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\gemsafe]2006-11-16 16:20 73728 C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Authentication Packages REG_MULTI_SZ    msv1_0 wvauth [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]'DisableMonitoring'=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe'='C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe'='C:\Novell\GroupWise\grpwise.exe'='C:\Novell\GroupWise\notify.exe'= R0 PBADRV;PBADRV;C:\WINDOWS\system32\DRIVERS\PBADRV.sys [2007-09-07 10:57]R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2007-07-23 15:49]R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe [2006-12-19 15:21]R2 TdmService;TdmService;C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [2007-09-07 18:29]R2 Wave UCSPlus;Wave UCSPlus;C:\WINDOWS\system32\dllhost.exe [2004-08-04 06:00]R2 WavxDMgr;WavxDMgr;C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys [2007-09-10 10:55]R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 13:32]R3 WaveFDE;Wave System Power Monitor Device Driver;C:\WINDOWS\system32\DRIVERS\WaveFDE.sys [2007-09-06 10:18]S3 SecureStorageService;SecureStorageService;C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [2007-08-31 18:39]S3 WaveEnrollmentService;WaveEnrollmentService;C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe [2007-09-13 15:31].- - - - ORPHANS REMOVED - - - - BHO-{120BB507-7E43-46F1-8645-7BF4E4E11112} - (no file)BHO-{203AA98E-5F24-4A7F-ADA1-CDF0AD11FC95} - C:\WINDOWS\system32\awtsSifc.dllBHO-{F20942A5-CA50-4965-88BB-6D0D90CCA4AF} - (no file)BHO-{F35D5934-E44B-479C-AA9D-864BF5414AE1} - (no file) .------- Supplementary Scan -------.R0 -: HKCU-Main,Start Page = https://web.gwm.sc.edu/servlet/webaccR0 -: HKCU-Main,Search Page = hxxp://www.google.comR0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ieR0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ieR0 -: HKLM-Main,Start Page = hxxp://www.dell.comR0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ieR1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%sR0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-08-11 10:59:56Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification:ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 **************************************************************************.------------------------ Other Running Processes ------------------------.C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\scardsvr.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Dell\QuickSet\NicConfigSvc.exeC:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\WINDOWS\system32\stacsv.exeC:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeC:\Program Files\Intel\Wireless\Bin\WLKEEPER.exeC:\Program Files\Trend Micro\OfficeScan Client\TmListen.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\Sigmatel\C-Major Audio\WDM\stsystra.exeC:\Program Files\Apoint\ApMsgFwd.exeC:\Program Files\Apoint\hidfind.exeC:\Program Files\Apoint\ApntEx.exeC:\WINDOWS\Temp\GH7C5C.EXEC:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\system32	askmgr.exeC:\WINDOWS\system32\msdtc.exe.**************************************************************************.Completion time: 2008-08-11 11:02:34 - machine was rebooted [Christine Blake]ComboFix-quarantined-files.txt  2008-08-11 15:02:29 Pre-Run: 107,569,225,728 bytes freePost-Run: 107,496,742,912 bytes free 293 --- E O F --- 2008-08-07 12:43:49

bamajim · Answer

ceblake2008   Good work.   Rerun Hijackthis and post a fresh Hijackthis log.     Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

ceblake2008 · Answer

is this easier to read: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:11:10 PM, on 8/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\StacSV.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\TEMP\GH7C5C.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\msdtc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webacc R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe' O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe' O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindow O4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe' O4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9599 bytes

ceblake2008 · Answer

sorry... here it is again. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:11:10 PM, on 8/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\StacSV.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\TEMP\GH7C5C.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\msdtc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webacc R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe' O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe' O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindow O4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe' O4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9599 bytes

bamajim · Answer

ceblake2008

When you compose and submit your reply, please make sure the box under your text which shows "Automatically convert carriage returns to HTML line breaks" is checked or your reply may not format correctly.

Then repost your log :smileywink:

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

ceblake2008 · Answer

Here is the new log. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:11:10 PM, on 8/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\StacSV.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\TEMP\GH7C5C.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\msdtc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webacc R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe' O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe' O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindow O4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe' O4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9599 bytes

ceblake2008 · Answer

The box was checked but it didn't work. Let's try again. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:11:10 PM, on 8/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\StacSV.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\TEMP\GH7C5C.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\msdtc.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webacc R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730 O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe' O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe' O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe O4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe' O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindow O4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe' O4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exe O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe O23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9599 bytes

ceblake2008 · Answer

My antivirus software (trendmicro) keeps detecting and deleting the following file:

TROJ_VUNDO.DWJ

located here:

C:\systemvolumeinformation\_restor{46DE8921-1D39-44D2-A9E9-64119261F211}\RP11\A0006767.dll

bamajim · Answer

ceblake2008

One more check.

1. Please perform an Ewido Online Malware Scan

When a dialog box appears asking you if you would like to download and install the ewido anti-spyware online scanner please click Yes to allow the download.
Click on Start Scan.
after the scan completes it will produce a log for you, copy and paste the results of that scan as a reply to this thread
If any infections are found, (After you save the logfile), Click on Remove Infections.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

ceblake2008 · Answer

Here is the Ewido log: __________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.2o7 Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@2o7[2].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@avgtechnologies.112.2o7[1].txt Risk: Medium Name: TrackingCookie.Netflame Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@ssl-hints.netflame[1].txt Risk: Medium Name: Not-A-Virus.Adware.Virtumonde Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP10\A0002646.bat Risk: Low Name: Not-A-Virus.Adware.Virtumonde Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP12\A0007469.bat Risk: Low Name: Not-A-Virus.Adware.Virtumonde Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0008506.bat Risk: Low

ceblake2008 · Answer

Oops. I have trouble getting the format right. Here it is again.
__________________________________________________
ewido anti-spyware online scanner
http://www.ewido.net
__________________________________________________

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@2o7[2].txt
Risk: Medium

Name: TrackingCookie.2o7
Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@avgtechnologies.112.2o7[1].txt
Risk: Medium

Name: TrackingCookie.Netflame
Path: C:\Documents and Settings\Christine Blake.CEBLAKE\Cookies\christine blake@ssl-hints.netflame[1].txt
Risk: Medium

Name: Not-A-Virus.Adware.Virtumonde
Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP10\A0002646.bat
Risk: Low

Name: Not-A-Virus.Adware.Virtumonde
Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP12\A0007469.bat
Risk: Low

Name: Not-A-Virus.Adware.Virtumonde
Path: C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP14\A0008506.bat
Risk: Low

bamajim · Answer

ceblake2008

It's not going to be unusual for your AV to find infections in System Restore folders for the next few days now that the active infection has been removed.
And they pose no threat unless System Restore is invoked for the particular date they are associated with. And eventually Windows will delete the older Sytem restore folders for newer ones. You can speed up the detection process by Booting into Safe Mode and running a full system scan.

We are going to Create a clean System Restore point in our closing comments.

Let's Remove Combofix

Select Start ->> Run ->> type in combofix /u (there is a space between x and /) Then O.K.

user posted image

Now that your log is clean

There are some final notes:

Lets create a clean System Restore point
the instructions are here

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of
Java Runtime Environment (JRE) 6.u7.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the " Download" button to the right.
Check the box that says: " Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windowsi586-p.exe to install the newest version.

Update your Anti Virus Software

Use and maintain a Firewall

Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Important Documents and Files on a regular basis

To a disc or a USB key, not your Hardrive

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

ceblake2008 · Answer

Hi, It looks like Vundo is back. I am getting messages from my antivirus that there are 10 possible vundo8 files on my computer but so far I am noticing any problems. I have not restored my system or downloaded anything unusual so am not sure what is going on.  Here is the log:   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:45:59 AM, on 10/10/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\SCardSvr.exeC:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeC:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\Program Files\Apoint\Apoint.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\WINDOWS\system32\igfxsrvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeC:\Program Files\Wave Systems Corp\SecureUpgrade.exeC:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exeC:\WINDOWS\system32\KADxMain.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exeC:\Program Files\Apoint\ApMsgFwd.exeC:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\HP\HP Software Update\HPWuSchd2.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\Apoint\HidFind.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Sony Handheld\HOTSYNC.EXEC:\Program Files\HP\Digital Imaging\bin\hpqgalry.exeC:\WINDOWS\system32\StacSV.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeC:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeC:\WINDOWS\system32\dllhost.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Trend Micro\OfficeScan Client	mlisten.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\TEMP\SR74D6.EXEC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exeC:\WINDOWS\system32\msdtc.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Microsoft Office\Office12\WINWORD.EXEC:\Program Files\Spyware Doctor\pctsGui.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://web.gwm.sc.edu/servlet/webaccR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.comR1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=6080730O2 - BHO: (no name) - {120BB507-7E43-46F1-8645-7BF4E4E11112} - (no file)O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dllO2 - BHO: (no name) - {F20942A5-CA50-4965-88BB-6D0D90CCA4AF} - (no file)O2 - BHO: (no name) - {F35D5934-E44B-479C-AA9D-864BF5414AE1} - (no file)O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exeO4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exeO4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exeO4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exeO4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startupO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [PDVDDXSrv] 'C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe'O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exeO4 - HKLM\..\Run: [OfficeScanNT Monitor] 'C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe' -HideWindowO4 - HKLM\..\Run: [ISTray] 'C:\Program Files\Spyware Doctor\pctsTray.exe'O4 - HKLM\..\Run: [GrooveMonitor] 'C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe'O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [HP Software Update] 'C:\Program Files\HP\HP Software Update\HPWuSchd2.exe'O4 - HKLM\..\Run: [HP Component Manager] 'C:\Program Files\HP\hpcoretech\hpcmpmgr.exe'O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.0\masqform.exe -UpdateCurrentUserO4 - HKCU\..\Run: [ISUSPM] 'C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe' -schedulerO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXEO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise
otify.exeO4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeO4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exeO8 - Extra context menu item: Convert for CLIÉ - C:\Program Files\Sony\Image Converter\menu.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cabO16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dllO23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exeO23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client
trtscan.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exeO23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\StacSV.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: NTRU TSS v1.2.1.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin	csd_win32.exeO23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exeO23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client	mlisten.exeO23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exeO23 - Service: WaveEnrollmentService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Authentication Manager\WaveEnrollmentService.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 11961 bytes

Virus & Spyware

Major trouble with virtumonde- please help!!

Was this post helpful?