More outerinfo popups

Question

I'm having problems with Outerinfo popups. Also, I occasionally receive a message reporting that notepad has encountered an error and must quit (this with the outerinfo logo in the box). It's driving me nuts. Here's an hjt log. Please help Logfile of HijackThis v1.99.1 Scan saved at 3:22:27 PM, on 8/2/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Dell AIO Printer A940\dlbabmon.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\CROSOF~1.NET\msiexec.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {6CFEABEB-410B-6E83-2D76-35B60E40F29A} - C:\WINDOWS\system32\wka.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {81A99149-F047-4090-8AAD-D11FF4EFB734} - (no file) O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [Dell AIO Printer A940] 'C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe' O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [freestyle] lockx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKLM\..\RunServices: [freestyle] lockx.exe O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [freestyle] lockx.exe O4 - HKCU\..\Run: [BitTorrent] 'C:\Program Files\BitTorrent\bittorrent.exe' --force_start_minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ISMModule] 'C:\Program Files\ISM\ISMModule.exe' O4 - HKCU\..\Run: [Aida] 'C:\PROGRA~1\CROSOF~1.NET\msiexec.exe' -vt yazb O4 - HKCU\..\Run: [Qkwbtm] C:\WINDOWS\?ystem
?tepad.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

bamajim · Answer

fiddlejohnson

Please download Combofix and save to your desktop:

Note: It is important that it is saved directly to your desktop
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.

CastleCops Instructor

MRU Graduate

"The world is what you make of it"

fiddlejohnson · Answer

Thanks for your help. Here's the combofix log: ComboFix 07-08-03.4 - 'Philip Johnson' 2007-08-02 20:05:35.1 [GMT -5:00] - NTFS Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1552OinAdmin.exe C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe C:\Program Files\crosof~1.net C:\Program Files\crosof~1.net\msiexec.exe C:\Program Files\outerinfo C:\Program Files\outerinfo\Terms.rtf C:\WINDOWS\system32\wnstsisv32.exe C:\WINDOWS\ystem~1 C:\WINDOWS\ystem~1
?tepad.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\msdirectx -------
m ((((((((((((((((((((((((( Files Created from 2007-07-03 to 2007-08-03 ))))))))))))))))))))))))))))))) 2007-08-02 20:03 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-02 15:19 d-------- C:\HJT 2007-08-02 01:40 60,928 --a------ C:\WINDOWS\SYSTEM32\wka.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-02 20:15 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-08-02 03:12 --------- d-------- C:\Program Files\DC++ 2007-06-27 22:16 17659 --a------ C:\WINDOWS\mozver.dat 2007-06-27 22:16 --------- d-------- C:\Program Files\DivX 2007-05-16 10:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 04:24 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll 2006-07-16 01:03 5837777 --a------ C:\Program Files\BitTorrent-4.20.4.exe 2006-03-23 22:25 560 --a------ C:\DOCUME~1\PHILIP~1\APPLIC~1\ViewerApp.dat 2005-10-17 19:23 12232336 --a------ C:\Program Files\20051010-007-x86.exe 2005-01-25 14:58 21848504 --a------ C:\Program Files\iTunesSetup.exe 2004-11-11 16:47 7741336 --a------ C:\Program Files\DivX521XP2K.exe 2002-09-11 09:26 63730 --a------ C:\Program Files\viewsonicinstruct_xp.pdf ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CFEABEB-410B-6E83-2D76-35B60E40F29A}] 2007-08-01 08:43 60928 --a------ C:\WINDOWS\system32\wka.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81A99149-F047-4090-8AAD-D11FF4EFB734}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UpdateManager'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2003-08-19 01:01] 'TkBellExe'='C:\Program Files\Common Files\Real\Update_OBealsched.exe' [2004-09-03 13:43] 'PCMService'='C:\Program Files\Dell\Media Experience\PCMService.exe' [] 'mmtask'='c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' [2004-04-19 14:45] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 20:12] 'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2004-04-11 11:43] 'Dell AIO Printer A940'='C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe' [2003-02-17 17:00] 'ccApp'='C:\Program Files\Common Files\Symantec Shared\ccApp.exe' [2004-12-10 18:02] 'vptray'='C:\PROGRA~1\SYMANT~1\VPTray.exe' [2004-12-30 14:19] 'freestyle'='lockx.exe' [] 'NeroFilterCheck'='C:\WINDOWS\system32\NeroCheck.exe' [2001-07-09 12:50] 'igfxtray'='C:\WINDOWS\system32\igfxtray.exe' [2005-09-20 09:35] 'igfxhkcmd'='C:\WINDOWS\system32\hkcmd.exe' [2005-09-20 09:32] 'igfxpers'='C:\WINDOWS\system32\igfxpers.exe' [2005-09-20 09:36] 'D-Link AirPlus G'='C:\Program Files\D-Link\AirPlus G\AirGCFG.exe' [2005-03-18 04:34] 'ANIWZCS2Service'='C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe' [2004-12-16 17:49] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-09-01 15:57] 'iTunesHelper'='C:\Program Files\iTunes\iTunesHelper.exe' [2006-09-12 01:58] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe' [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24] 'freestyle'='lockx.exe' [] 'BitTorrent'='C:\Program Files\BitTorrent\bittorrent.exe' [] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 02:56] 'ISMModule'='C:\Program Files\ISM\ISMModule.exe' [] 'Qkwbtm'='C:\WINDOWS\?ystem
?tepad.exe' [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionunservices] 'freestyle'=lockx.exe [HKEY_USERS\.default\software\microsoft\windows\currentversionun] 'Symantec NetDriver Warning'=C:\PROGRA~1\SYMNET~1\SNDWarn.exe C:\Documents and Settings\Philip Johnson\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe [2005-09-23 22:05:26] DESKTOP.INI [2002-09-03 09:00:00] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56] Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2005-12-27 15:49:31] Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2005-12-27 15:49:22] R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys R1 Tcpip6;Microsoft IPv6 Protocol Driver;C:\WINDOWS\system32\DRIVERS	cpip6.sys R2 6to4;IPv6 Helper Service;C:\WINDOWS\system32\svchost.exe -k netsvcs R2 MASPINT;MASPINT;C:\WINDOWS\system32\drivers\MASPINT.sys R2 PCLEPCI;PCLEPCI;C:\WINDOWS\system32\drivers\PCLEPCI.sys R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla	fsnpool.sys R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys R3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys R3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys R3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys R3 mohfilt;mohfilt;C:\WINDOWS\system32\DRIVERS\mohfilt.sys R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys R3 tunmp;Microsoft Tun Miniport Adapter Driver;C:\WINDOWS\system32\DRIVERS	unmp.sys S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys S3 Bridge;MAC Bridge;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 iAimFP0;iAimFP0;C:\WINDOWS\system32\DRIVERS\wADV01nt.sys S3 iAimFP1;iAimFP1;C:\WINDOWS\system32\DRIVERS\wADV02NT.sys S3 iAimFP2;iAimFP2;C:\WINDOWS\system32\DRIVERS\wADV05NT.sys S3 iAimFP3;iAimFP3;C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys S3 iAimFP4;iAimFP4;C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys S3 iAimTV0;iAimTV0;C:\WINDOWS\system32\DRIVERS\wATV01nt.sys S3 iAimTV1;iAimTV1;C:\WINDOWS\system32\DRIVERS\wATV02NT.sys S3 iAimTV2;iAimTV2;C:\WINDOWS\system32\DRIVERS\wATV03nt.sys S3 iAimTV3;iAimTV3;C:\WINDOWS\system32\DRIVERS\wATV04nt.sys S3 iAimTV4;iAimTV4;C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;C:\WINDOWS\system32\DRIVERS\NETR33X.SYS Contents of the 'Scheduled Tasks' folder 2007-07-30 22:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-02 20:14:21 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-02 20:17:11 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-02 20:16 --- E O F ---

bamajim · Answer

fiddlejohnson 1. Open NotePad (not wordpad). Copy and paste the following into Notepad File::C:\WINDOWS\SYSTEM32\wka.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CFEABEB-410B-6E83-2D76-35B60E40F29A}][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'freestyle'=-[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'freestyle'=-'Qkwbtm'=-[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]'freestyle'=- Save the File as CFScript ->> Save it to your Desktop Using the Image as a reference, drag CFScript into ComboFix.exe You will be prompted to run Combofix again, Do so Following the same rules as indicated in my first post Then post the contents of the C:\ComboFix.txt log in your reply CastleCops Instructor MRU Graduate 'The world is what you make of it'

bamajim · Answer

fiddlejohnson   Good job. Rerun Hijackthis and post a fresh Hijackthis log.   CastleCops Instructor MRU Graduate 'The world is what you make of it'

fiddlejohnson · Answer

Here's the next one: ComboFix 07-08-03.4 - 'Philip Johnson' 2007-08-03 12:55:38.2 [GMT -5:00] - NTFS Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.True Command switches used :: C:\Documents and Settings\Philip Johnson\Desktop\CFScript.txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\SYSTEM32\wka.dll ((((((((((((((((((((((((( Files Created from 2007-07-03 to 2007-08-03 ))))))))))))))))))))))))))))))) 2007-08-02 20:03 51,200 --a------ C:\WINDOWS
ircmd.exe 2007-08-02 15:19 d-------- C:\HJT (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-02 22:11 --------- d-------- C:\Program Files\DC++ 2007-08-02 20:15 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-06-27 22:16 17659 --a------ C:\WINDOWS\mozver.dat 2007-06-27 22:16 --------- d-------- C:\Program Files\DivX 2007-05-16 10:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 10:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 10:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 10:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 10:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 04:24 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll 2006-07-16 01:03 5837777 --a------ C:\Program Files\BitTorrent-4.20.4.exe 2006-03-23 22:25 560 --a------ C:\DOCUME~1\PHILIP~1\APPLIC~1\ViewerApp.dat 2005-10-17 19:23 12232336 --a------ C:\Program Files\20051010-007-x86.exe 2005-01-25 14:58 21848504 --a------ C:\Program Files\iTunesSetup.exe 2004-11-11 16:47 7741336 --a------ C:\Program Files\DivX521XP2K.exe 2002-09-11 09:26 63730 --a------ C:\Program Files\viewsonicinstruct_xp.pdf ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{81A99149-F047-4090-8AAD-D11FF4EFB734}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'UpdateManager'='C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' [2003-08-19 01:01] 'TkBellExe'='C:\Program Files\Common Files\Real\Update_OBealsched.exe' [2004-09-03 13:43] 'PCMService'='C:\Program Files\Dell\Media Experience\PCMService.exe' [] 'mmtask'='c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe' [2004-04-19 14:45] 'IntelMeM'='C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe' [2003-09-03 20:12] 'DVDLauncher'='C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' [2004-04-11 11:43] 'Dell AIO Printer A940'='C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe' [2003-02-17 17:00] 'ccApp'='C:\Program Files\Common Files\Symantec Shared\ccApp.exe' [2004-12-10 18:02] 'vptray'='C:\PROGRA~1\SYMANT~1\VPTray.exe' [2004-12-30 14:19] 'NeroFilterCheck'='C:\WINDOWS\system32\NeroCheck.exe' [2001-07-09 12:50] 'igfxtray'='C:\WINDOWS\system32\igfxtray.exe' [2005-09-20 09:35] 'igfxhkcmd'='C:\WINDOWS\system32\hkcmd.exe' [2005-09-20 09:32] 'igfxpers'='C:\WINDOWS\system32\igfxpers.exe' [2005-09-20 09:36] 'D-Link AirPlus G'='C:\Program Files\D-Link\AirPlus G\AirGCFG.exe' [2005-03-18 04:34] 'ANIWZCS2Service'='C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe' [2004-12-16 17:49] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-09-01 15:57] 'iTunesHelper'='C:\Program Files\iTunes\iTunesHelper.exe' [2006-09-12 01:58] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe' [2007-03-14 03:43] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 11:24] 'BitTorrent'='C:\Program Files\BitTorrent\bittorrent.exe' [] 'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-04 02:56] 'ISMModule'='C:\Program Files\ISM\ISMModule.exe' [] [HKEY_USERS\.default\software\microsoft\windows\currentversionun] 'Symantec NetDriver Warning'=C:\PROGRA~1\SYMNET~1\SNDWarn.exe C:\Documents and Settings\Philip Johnson\Start Menu\Programs\Startup\ DESKTOP.INI [2002-09-03 09:00:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe [2005-09-23 22:05:26] DESKTOP.INI [2002-09-03 09:00:00] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56] Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2005-12-27 15:49:31] Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2005-12-27 15:49:22] R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys R1 Tcpip6;Microsoft IPv6 Protocol Driver;C:\WINDOWS\system32\DRIVERS	cpip6.sys R2 6to4;IPv6 Helper Service;C:\WINDOWS\system32\svchost.exe -k netsvcs R2 MASPINT;MASPINT;C:\WINDOWS\system32\drivers\MASPINT.sys R2 PCLEPCI;PCLEPCI;C:\WINDOWS\system32\drivers\PCLEPCI.sys R2 SVKP;SVKP;\??\C:\WINDOWS\system32\SVKP.sys R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla	fsnpool.sys R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys R3 IntelC51;IntelC51;C:\WINDOWS\system32\DRIVERS\IntelC51.sys R3 IntelC52;IntelC52;C:\WINDOWS\system32\DRIVERS\IntelC52.sys R3 IntelC53;IntelC53;C:\WINDOWS\system32\DRIVERS\IntelC53.sys R3 mohfilt;mohfilt;C:\WINDOWS\system32\DRIVERS\mohfilt.sys R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys R3 tunmp;Microsoft Tun Miniport Adapter Driver;C:\WINDOWS\system32\DRIVERS	unmp.sys S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys S3 Bridge;MAC Bridge;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 BridgeMP;MAC Bridge Miniport;C:\WINDOWS\system32\DRIVERS\bridge.sys S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 iAimFP0;iAimFP0;C:\WINDOWS\system32\DRIVERS\wADV01nt.sys S3 iAimFP1;iAimFP1;C:\WINDOWS\system32\DRIVERS\wADV02NT.sys S3 iAimFP2;iAimFP2;C:\WINDOWS\system32\DRIVERS\wADV05NT.sys S3 iAimFP3;iAimFP3;C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys S3 iAimFP4;iAimFP4;C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys S3 iAimTV0;iAimTV0;C:\WINDOWS\system32\DRIVERS\wATV01nt.sys S3 iAimTV1;iAimTV1;C:\WINDOWS\system32\DRIVERS\wATV02NT.sys S3 iAimTV2;iAimTV2;C:\WINDOWS\system32\DRIVERS\wATV03nt.sys S3 iAimTV3;iAimTV3;C:\WINDOWS\system32\DRIVERS\wATV04nt.sys S3 iAimTV4;iAimTV4;C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys S3 NETR33X;D-Link Air Wireless Adapter(RTL) NT Driver;C:\WINDOWS\system32\DRIVERS\NETR33X.SYS *Newly Created Service* - CATCHME Contents of the 'Scheduled Tasks' folder 2007-07-30 22:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-03 13:00:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... C:\WINDOWS\SYSTEM32\cmd.exe [3428] 0x81E72020 scanning hidden registry entries ... scanning hidden files ... ************************************************************************** Completion time: 2007-08-03 13:01:57 C:\ComboFix-quarantined-files.txt ... 2007-08-03 13:01 C:\ComboFix2.txt ... 2007-08-02 20:17 --- E O F --- Thanks, Philip

fiddlejohnson · Answer

How's it looking?

Logfile of HijackThis v1.99.1
Scan saved at 2:15:29 PM, on 8/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {81A99149-F047-4090-8AAD-D11FF4EFB734} - (no file)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISMModule] "C:\Program Files\ISM\ISMModule.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

bamajim · Answer

fiddlejohnson   How's your PC running now?   CastleCops Instructor MRU Graduate 'The world is what you make of it'

fiddlejohnson · Answer

It's running fine. No more popups, unless they're luring me into a false sense of security. If everything looks ok from your end, I really appreciate your help. Thanks a million.

bamajim · Answer

fiddlejohnson

You are most welcome

You may now remove/delete/uninstall the tools we used to clean your PC

Now that your log is clean

There are some final notes:
Disable and Enable System Restore

Lets create a clean System Restore point
the instructions are here

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of
Java Runtime Environment (JRE) 6.u2.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the " Download" button to the right.
Check the box that says: " Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u2-windowsi586-p.exe to install the newest version.

Update your Anti Virus Software

Use and maintain a Firewall

Install IE SPYAD for protection against innocent looking websites that are not innocent

Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Important Documents and Files on a regular basis

To a disc or a USB key, not your Hardrive

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

CastleCops Instructor

MRU Graduate

"The world is what you make of it"

Virus & Spyware

More outerinfo popups

Was this post helpful?