PLEASE I NEED HELP analyzing hijackthis and combofix logs please...

Question

CAN SOMEONE PLEASE HELP ME? I have a SUPER SLOW older IBM laptop and it is running even slower now. I think it has viruses but I really don't know. Here below I am posting the hijackthis log and the combofix log that I got from my LapTop. Please help me. I am not that great with computers and I really need this help. Thank you so much in advance....   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:17:34 PM, on 2/25/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\ActivCard\acachsrv.exeC:\Program Files\Common Files\ActivCard\acautoreg.exeC:\Program Files\Common Files\ActivCard\acautoup.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\explorer.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\SoftwareDistribution\Download\f1079ad3f90bf0cb91df4a8ccb3e1ee4\update\update.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUPO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO20 - Winlogon Notify: acAuth - C:\WINDOWS\SYSTEM32\acauth.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: ActivCard Authentication Service (ACachSrv) - ActivCard - C:\Program Files\Common Files\ActivCard\acachsrv.exeO23 - Service: ActivCard Gold Autoregister (acautoreg) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoreg.exeO23 - Service: ActivCard Auto-Update Service (acautoupdate) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoup.exeO23 - Service: ActivCard Gold service (Accoca) - ActivCard - C:\Program Files\Common Files\ActivCard\accoca.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exeO23 - Service: BOCore - Unknown owner - C:\Program Files\Comodo\CBOClean\BOCORE.exe (file missing) --End of file - 4563 bytes     ComboFix 08-02-25.3 - m 2008-02-25 14:07:50.1 - NTFSx86Running from: C:\Documents and Settings\m\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.datC:\WINDOWS\system32\d3dim700r.dllC:\WINDOWS\system32\ddemls.dllC:\WINDOWS\system32\drivers\sdhyhvjb.datC:\WINDOWS\Tasks.\At1.job ----- BITS: Possible infected sites ----- hxxp://update.microsoft.com.(((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) .-------\LEGACY_FOGXAFFH-------\LEGACY_PKIMFRST-------\fogxaffh-------\pkimfrst (((((((((((((((((((((((((   Files Created from 2008-01-25 to 2008-02-25  ))))))))))))))))))))))))))))))). 2008-02-25 13:18 . 2008-02-25 13:18   d-------- C:\Program Files\Trend Micro 2008-02-23 19:53 . 2008-02-23 19:53   d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-23 19:53 . 2008-02-23 19:55   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-23 16:23 . 2007-10-10 15:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-02-23 16:23 . 2007-06-30 19:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-23 16:23 . 2007-06-30 19:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-23 16:23 . 2007-10-10 15:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-02-23 16:23 . 2007-10-10 15:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-02-23 16:23 . 2007-10-10 15:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-02-23 16:23 . 2007-10-10 15:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-02-23 16:23 . 2007-10-10 15:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-02-23 16:23 . 2007-10-10 02:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-23 11:37 . 2008-02-23 11:38   d-------- C:\d696bfeb5b4317c4596316ab26cc04 2008-02-22 19:39 . 2008-02-22 19:39   d-------- C:\Program Files\Lavasoft 2008-02-22 19:39 . 2008-02-22 19:46   d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-22 16:08 . 2008-02-22 16:08   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-22 15:33 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-22 15:33 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-22 15:33 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-18 16:39 . 2008-02-23 11:47   d-------- C:\Documents and Settings\m\Application Data\AVG7 2008-02-18 16:38 . 2008-02-18 16:38   d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-02-18 16:37 . 2008-02-18 16:37   d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-18 16:37 . 2008-02-20 23:32   d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-02-18 15:17 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-02-16 10:23 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-02-15 23:37 . 2007-11-27 22:56 116,416 --a------ C:\WINDOWS\system32\drivers\msfwhlpr.sys 2008-02-15 23:37 . 2007-11-27 22:56 91,328 --a------ C:\WINDOWS\system32\drivers\msfwdrv.sys 2008-02-15 23:24 . 2008-02-15 23:37   d----c--- C:\WINDOWS\system32\DRVSTORE 2008-02-15 23:24 . 2007-07-06 15:09 70,928 --a------ C:\WINDOWS\system32\drivers\MpFilter.sys 2008-02-15 23:23 . 2008-02-15 23:23   d-------- C:\WINDOWS\system32\bits 2008-02-15 23:22 . 2007-03-29 04:56 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx4.dll 2008-02-15 23:22 . 2007-03-29 04:56 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll 2008-02-15 23:21 . 2008-02-24 00:07   d--h----- C:\WINDOWS\$hf_mig$ 2008-02-15 22:47 . 2008-02-24 00:15 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-02-15 22:21 . 2008-02-18 16:55   d-------- C:\Program Files\Microsoft Windows OneCare Live 2008-02-15 20:57 . 2008-02-15 20:57 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll 2008-02-15 20:57 . 2008-02-15 20:57 741,632 --a------ C:\WINDOWS\system32\dxvgtnha.dat 2008-02-15 20:57 . 2008-02-15 20:57 246,545 --a------ C:\WINDOWS\system32\libssl32.dll 2008-02-15 20:57 . 2008-02-15 20:57 42,752 --a------ C:\WINDOWS\system32\kryxfhyb.dat 2008-02-15 20:57 . 2008-02-22 15:35 36,608 --a------ C:\WINDOWS\system32\ssvquxrk.dat 2008-02-15 20:57 . 2008-02-15 20:57 35,072 --a------ C:\WINDOWS\system32\aanaquyq.dat 2008-02-14 09:00 . 2008-02-14 09:00 120,576 --a------ C:\WINDOWS\system32\zjlvznld.dat 2008-02-14 08:53 . 2008-02-18 15:06   d-------- C:\WINDOWS\system32\AppCert 2008-02-01 23:16 . 2008-02-15 22:18   d-------- C:\Program Files\Computrainer 2008-02-01 23:15 . 2008-02-01 23:15 249,856 --------- C:\WINDOWS\Setup1.exe 2008-02-01 23:14 . 2008-02-01 23:14 73,216 --a------ C:\WINDOWS\ST6UNST.EXE .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-01-14 05:55 --------- d-----w C:\Program Files\Common Files\Adobe2008-01-09 04:13 --------- d-----w C:\Program Files\Comodo2008-01-09 03:54 --------- d-----w C:\Documents and Settings\m\Application Data\InterTrust2008-01-06 03:39 --------- d-----w C:\Program Files\Alwil Software2008-01-06 00:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira2008-01-05 23:30 --------- d-----w C:\Program Files\SCM Microsystems2008-01-05 23:29 --------- d-----w C:\Program Files\Common Files\InstallShield2008-01-05 23:24 --------- d-----w C:\Program Files\Common Files\ActivCard2008-01-05 23:24 --------- d-----w C:\Program Files\ActivCard2008-01-05 01:06 --------- d-----w C:\Documents and Settings\m\Application Data\MSNInstaller2007-12-14 19:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll2007-11-26 18:38 238,848 ----a-w C:\WINDOWS\UNBOC.EXE. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{161CF20D-FEF8-416B-8C53-BDF1AF72EECC}]   C:\WINDOWS\system32\ddemls.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C5B718D-5C75-4F86-99DD-1B55CA12D47B}]   c:\windows\system32\d3dim700r.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-03 20:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'AVG7_CC'='C:\PROGRA~1\Grisoft\AVG7\avgcc.exe' [2008-02-18 16:37 579072]'KernelFaultCheck'='C:\WINDOWS\system32\dumprep 0 -k' [ ]'combofix'='C:\WINDOWS\system32\kmd.exe' [2004-08-03 20:56 388608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'AVG7_Run'='C:\PROGRA~1\Grisoft\AVG7\avgw.exe' [2008-02-18 16:37 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\acAuth]acauth.dll 2002-12-17 11:11 65536 C:\WINDOWS\system32\acauth.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ActivCard Gold Smart Card Agent.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ActivCard Gold Smart Card Agent.lnkbackup=C:\WINDOWS\pss\ActivCard Gold Smart Card Agent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\acEventServ]--a------ 2003-07-01 07:42 28672 C:\Program Files\ActivCard\ActivCard Gold\acevtsrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]--a------ 2008-01-22 19:43 67112 C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]C:\WINDOWS\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmjb38c]C:\WINDOWS\system32\vmjb38c.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]appsecdll REG_EXPAND_SZ   C:\WINDOWS\system32\AppCert\wsil32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]'EnableFirewall'= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\Grisoft\AVG7\avginet.exe'='C:\Program Files\Grisoft\AVG7\avgamsvr.exe'='C:\Program Files\Grisoft\AVG7\avgcc.exe'='C:\Program Files\Grisoft\AVG7\avgemc.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'= .************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-02-25 14:45:16Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 **************************************************************************.------------------------ Other Running Processes ------------------------.C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\System32\SCardSvr.exeC:\Program Files\Common Files\ActivCard\acachsrv.exeC:\Program Files\Common Files\ActivCard\acautoreg.exeC:\Program Files\Common Files\ActivCard\acautoup.exeC:\Program Files\Common Files\ActivCard\accoca.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe.**************************************************************************.Completion time: 2008-02-25 14:56:23 - machine was rebooted ComboFix-quarantined-files.txt  2008-02-25 22:56:07 . 2008-02-24 08:16:52 --- E O F ---

bamajim · Answer

sylvainreyes1 1. Open NotePad (not wordpad). Copy and paste the following into Notepad File::C:\WINDOWS\imsins.BAKC:\WINDOWS\system32\dxvgtnha.datC:\WINDOWS\system32\kryxfhyb.datC:\WINDOWS\system32\ssvquxrk.datC:\WINDOWS\system32\aanaquyq.datC:\WINDOWS\system32\zjlvznld.datC:\WINDOWS\system32\vmjb38c.exeC:\WINDOWS\system32\AppCert\wsil32.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{161CF20D-FEF8-416B-8C53-BDF1AF72EECC}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C5B718D-5C75-4F86-99DD-1B55CA12D47B}][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmjb38c][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]'appsecdll'=- Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop Using the Image as a reference, drag CFScript into ComboFix.exe You will be prompted to run Combofix again, Do so Following the same rules as indicated in my first post Then post the contents of the C:\ComboFix.txt log in your reply 2. Rerun Hijackthis and post a fresh Hijackthis log as well Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

sylvainreyes1 · Answer

I really appreciate your help. Thank you so very much. I did exactly as you instructed. I saved the log you sent me as CFScript then I dragged it from my Desktop to Combofix and ran it again. Then I ran hijackthis again. Below are the new logs from Combofix and hijackthis as you requested. Please advise. Thank you once again.   ComboFix 08-02-25.3 - m 2008-03-05 22:59:45.2 - NTFSx86Running from: C:\Documents and Settings\m\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\m\Desktop\CFScript.txt WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE ::C:\WINDOWS\imsins.BAKC:\WINDOWS\system32\aanaquyq.datC:\WINDOWS\system32\AppCert\wsil32.dllC:\WINDOWS\system32\dxvgtnha.datC:\WINDOWS\system32\kryxfhyb.datC:\WINDOWS\system32\ssvquxrk.datC:\WINDOWS\system32\vmjb38c.exeC:\WINDOWS\system32\zjlvznld.dat. (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))). C:\WINDOWS\imsins.BAKC:\WINDOWS\system32\aanaquyq.datC:\WINDOWS\system32\d3dim700r.dllC:\WINDOWS\system32\dxvgtnha.datC:\WINDOWS\system32\kryxfhyb.datC:\WINDOWS\system32\ssvquxrk.datC:\WINDOWS\system32\zjlvznld.dat .(((((((((((((((((((((((((   Files Created from 2008-02-06 to 2008-03-06  ))))))))))))))))))))))))))))))). 2008-02-25 13:18 . 2008-02-25 13:18   d-------- C:\Program Files\Trend Micro 2008-02-23 19:53 . 2008-02-23 19:53   d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-23 19:53 . 2008-02-23 19:55   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-23 16:23 . 2007-10-10 15:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-02-23 16:23 . 2007-06-30 19:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-23 16:23 . 2007-06-30 19:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-23 16:23 . 2007-10-10 15:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-02-23 16:23 . 2007-10-10 15:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-02-23 16:23 . 2007-10-10 15:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-02-23 16:23 . 2007-10-10 15:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-02-23 16:23 . 2007-10-10 15:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-02-23 16:23 . 2007-10-10 02:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-23 11:37 . 2008-02-23 11:38   d-------- C:\d696bfeb5b4317c4596316ab26cc04 2008-02-22 19:39 . 2008-02-22 19:39   d-------- C:\Program Files\Lavasoft 2008-02-22 19:39 . 2008-02-22 19:46   d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-22 16:08 . 2008-02-22 16:08   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-22 15:33 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-22 15:33 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-22 15:33 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-18 16:39 . 2008-02-23 11:47   d-------- C:\Documents and Settings\m\Application Data\AVG7 2008-02-18 16:38 . 2008-02-18 16:38   d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-02-18 16:37 . 2008-02-18 16:37   d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-18 16:37 . 2008-02-20 23:32   d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-02-18 15:17 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-02-16 10:23 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-02-15 23:37 . 2007-11-27 22:56 116,416 --a------ C:\WINDOWS\system32\drivers\msfwhlpr.sys 2008-02-15 23:37 . 2007-11-27 22:56 91,328 --a------ C:\WINDOWS\system32\drivers\msfwdrv.sys 2008-02-15 23:24 . 2008-02-15 23:37   d----c--- C:\WINDOWS\system32\DRVSTORE 2008-02-15 23:24 . 2007-07-06 15:09 70,928 --a------ C:\WINDOWS\system32\drivers\MpFilter.sys 2008-02-15 23:23 . 2008-02-15 23:23   d-------- C:\WINDOWS\system32\bits 2008-02-15 23:22 . 2007-03-29 04:56 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx4.dll 2008-02-15 23:22 . 2007-03-29 04:56 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll 2008-02-15 23:21 . 2008-02-25 15:10   d--h----- C:\WINDOWS\$hf_mig$ 2008-02-15 22:21 . 2008-02-25 20:12   d-------- C:\Program Files\Microsoft Windows OneCare Live 2008-02-15 20:57 . 2008-02-15 20:57 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll 2008-02-15 20:57 . 2008-02-15 20:57 246,545 --a------ C:\WINDOWS\system32\libssl32.dll 2008-02-14 08:53 . 2008-02-18 15:06   d-------- C:\WINDOWS\system32\AppCert 2008-02-14 08:52 . 2008-02-25 13:04 90,880 --a------ C:\WINDOWS\system32\ddemls.dll .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-02-16 06:18 --------- d-----w C:\Program Files\Computrainer2008-02-02 07:15 249,856 ------w C:\WINDOWS\Setup1.exe2008-02-02 07:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE2008-01-14 05:55 --------- d-----w C:\Program Files\Common Files\Adobe2008-01-09 04:13 --------- d-----w C:\Program Files\Comodo2008-01-09 03:54 --------- d-----w C:\Documents and Settings\m\Application Data\InterTrust2008-01-06 03:39 --------- d-----w C:\Program Files\Alwil Software2008-01-06 00:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira2007-12-14 19:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{161CF20D-FEF8-416B-8C53-BDF1AF72EECC}]2008-02-25 13:04 90880 --a------ C:\WINDOWS\system32\ddemls.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C5B718D-5C75-4F86-99DD-1B55CA12D47B}]   c:\windows\system32\d3dim700r.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-03 20:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'AVG7_CC'='C:\PROGRA~1\Grisoft\AVG7\avgcc.exe' [2008-02-18 16:37 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'AVG7_Run'='C:\PROGRA~1\Grisoft\AVG7\avgw.exe' [2008-02-18 16:37 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\acAuth]acauth.dll 2002-12-17 11:11 65536 C:\WINDOWS\system32\acauth.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dpjanzze]d3dim700r.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ActivCard Gold Smart Card Agent.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ActivCard Gold Smart Card Agent.lnkbackup=C:\WINDOWS\pss\ActivCard Gold Smart Card Agent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\acEventServ]--a------ 2003-07-01 07:42 28672 C:\Program Files\ActivCard\ActivCard Gold\acevtsrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]--a------ 2008-01-22 19:43 67112 C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]C:\WINDOWS\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmjb38c]C:\WINDOWS\system32\vmjb38c.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]appsecdll REG_EXPAND_SZ   C:\WINDOWS\system32\AppCert\wsil32.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]'EnableFirewall'= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\Grisoft\AVG7\avginet.exe'='C:\Program Files\Grisoft\AVG7\avgamsvr.exe'='C:\Program Files\Grisoft\AVG7\avgcc.exe'='C:\Program Files\Grisoft\AVG7\avgemc.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'= HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcspkimfrst .************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-03-05 23:09:09Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 **************************************************************************.Completion time: 2008-03-05 23:14:04ComboFix-quarantined-files.txt  2008-03-06 07:13:19ComboFix2.txt  2008-02-25 22:56:32.2008-02-24 08:16:52 --- E O F ---          Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:44:08 PM, on 3/5/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16574)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\ActivCard\acachsrv.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\ActivCard\acautoup.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\wuauclt.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUPO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO20 - Winlogon Notify: acAuth - C:\WINDOWS\SYSTEM32\acauth.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: ActivCard Authentication Service (ACachSrv) - ActivCard - C:\Program Files\Common Files\ActivCard\acachsrv.exeO23 - Service: ActivCard Gold Autoregister (acautoreg) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoreg.exeO23 - Service: ActivCard Auto-Update Service (acautoupdate) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoup.exeO23 - Service: ActivCard Gold service (Accoca) - ActivCard - C:\Program Files\Common Files\ActivCard\accoca.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exeO23 - Service: BOCore - Unknown owner - C:\Program Files\Comodo\CBOClean\BOCORE.exe (file missing) --End of file - 4452 bytes

bamajim · Answer

sylvainreyes1 You are most welcome. We Need to temporarily disable SpyBotS&D Tea timer so it doesn't interfere with our fix 1) Run Spybot-S&D 2) Go to the Mode menu, and make sure 'Advanced Mode' is selected 3) On the left hand side, choose Tools -> Resident 4) Uncheck 'Resident TeaTimer' and OK any prompts 5) Restart your computer. 1. Open NotePad (not wordpad). Copy and paste the following into Notepad File::C:\WINDOWS\system32\ddemls.dllc:\windows\system32\d3dim700r.dllC:\WINDOWS\system32\vmjb38c.exeRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{161CF20D-FEF8-416B-8C53-BDF1AF72EECC}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8C5B718D-5C75-4F86-99DD-1B55CA12D47B}][-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\dpjanzze][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vmjb38c][-HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls] Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop Using the Image as a reference, drag CFScript into ComboFix.exe You will be prompted to run Combofix again, Do so Following the same rules as indicated in my first post Then post the contents of the C:\ComboFix.txt log in your reply 2. Rerun Hijackthis and post a fresh Hijackthis log as well Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

sylvainreyes1 · Answer

Thank you once again. I have followed your instructions to the 'T'. When I went into SpyBot, the TeaTimer was not checked, only the SD Helper was checked. Is that OK?   Here are the combofix and hijackthis logs I just finished running. I look forward to hearing from you.   ComboFix 08-03-06.2 - m 2008-03-06 19:08:17.5 - NTFSx86Running from: C:\Documents and Settings\m\Desktop\ComboFix.exeCommand switches used :: C:\Documents and Settings\m\Desktop\CFScript.txt WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE ::c:\windows\system32\d3dim700r.dllC:\WINDOWS\system32\ddemls.dllC:\WINDOWS\system32\vmjb38c.exe. (((((((((((((((((((((((((   Files Created from 2008-02-07 to 2008-03-07  ))))))))))))))))))))))))))))))). 2008-02-25 13:18 . 2008-02-25 13:18   d-------- C:\Program Files\Trend Micro 2008-02-23 19:53 . 2008-02-23 19:53   d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-23 19:53 . 2008-03-06 16:13   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-23 16:23 . 2007-12-06 18:21 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-02-23 16:23 . 2007-06-30 19:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-02-23 16:23 . 2007-06-30 19:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-02-23 16:23 . 2007-12-06 18:21 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-02-23 16:23 . 2007-12-06 18:21 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-02-23 16:23 . 2007-12-06 18:21 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-02-23 16:23 . 2007-12-06 18:21 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-02-23 16:23 . 2007-12-06 18:21 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-02-23 16:23 . 2007-12-06 03:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-02-23 11:37 . 2008-02-23 11:38   d-------- C:\d696bfeb5b4317c4596316ab26cc04 2008-02-22 19:39 . 2008-02-22 19:39   d-------- C:\Program Files\Lavasoft 2008-02-22 19:39 . 2008-02-22 19:46   d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-22 16:08 . 2008-02-22 16:08   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-22 15:33 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-02-22 15:33 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-02-22 15:33 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-02-18 16:39 . 2008-02-23 11:47   d-------- C:\Documents and Settings\m\Application Data\AVG7 2008-02-18 16:38 . 2008-02-18 16:38   d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-02-18 16:37 . 2008-02-18 16:37   d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-18 16:37 . 2008-02-20 23:32   d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-02-18 15:17 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-02-18 14:23 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-02-18 14:22 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-02-16 10:23 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-02-15 23:37 . 2007-11-27 22:56 116,416 --a------ C:\WINDOWS\system32\drivers\msfwhlpr.sys 2008-02-15 23:37 . 2007-11-27 22:56 91,328 --a------ C:\WINDOWS\system32\drivers\msfwdrv.sys 2008-02-15 23:24 . 2008-02-15 23:37   d----c--- C:\WINDOWS\system32\DRVSTORE 2008-02-15 23:24 . 2007-07-06 15:09 70,928 --a------ C:\WINDOWS\system32\drivers\MpFilter.sys 2008-02-15 23:23 . 2008-02-15 23:23   d-------- C:\WINDOWS\system32\bits 2008-02-15 23:22 . 2007-03-29 04:56 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx4.dll 2008-02-15 23:22 . 2007-03-29 04:56 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll 2008-02-15 23:21 . 2008-02-25 15:10   d--h----- C:\WINDOWS\$hf_mig$ 2008-02-15 22:47 . 2008-03-06 11:53 1,355 --a------ C:\WINDOWS\imsins.BAK 2008-02-15 22:21 . 2008-02-25 20:12   d-------- C:\Program Files\Microsoft Windows OneCare Live 2008-02-15 20:57 . 2008-02-15 20:57 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll 2008-02-15 20:57 . 2008-02-15 20:57 246,545 --a------ C:\WINDOWS\system32\libssl32.dll 2008-02-14 08:53 . 2008-02-18 15:06   d-------- C:\WINDOWS\system32\AppCert .((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-02-16 06:18 --------- d-----w C:\Program Files\Computrainer2008-02-02 07:15 249,856 ------w C:\WINDOWS\Setup1.exe2008-02-02 07:14 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE2008-01-14 05:55 --------- d-----w C:\Program Files\Common Files\Adobe2008-01-09 04:13 --------- d-----w C:\Program Files\Comodo2008-01-09 03:54 --------- d-----w C:\Documents and Settings\m\Application Data\InterTrust2007-12-14 19:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe2007-12-07 02:21 824,832 ----a-w C:\WINDOWS\system32\wininet.dll. (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'ctfmon.exe'='C:\WINDOWS\system32\ctfmon.exe' [2004-08-03 20:56 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'AVG7_CC'='C:\PROGRA~1\Grisoft\AVG7\avgcc.exe' [2008-02-18 16:37 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]'AVG7_Run'='C:\PROGRA~1\Grisoft\AVG7\avgw.exe' [2008-02-18 16:37 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\acAuth]acauth.dll 2002-12-17 11:11 65536 C:\WINDOWS\system32\acauth.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ActivCard Gold Smart Card Agent.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ActivCard Gold Smart Card Agent.lnkbackup=C:\WINDOWS\pss\ActivCard Gold Smart Card Agent.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnkbackup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\acEventServ]--a------ 2003-07-01 07:42 28672 C:\Program Files\ActivCard\ActivCard Gold\acevtsrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OneCareUI]--a------ 2008-01-22 19:43 67112 C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]C:\WINDOWS\system32\dumprep 0 -u [HKEY_LOCAL_MACHINE\software\microsoft\security center]'AntiVirusDisableNotify'=dword:00000001'UpdatesDisableNotify'=dword:00000001'FirewallOverride'=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]'EnableFirewall'= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]'%windir%\system32\sessmgr.exe'='C:\Program Files\Grisoft\AVG7\avginet.exe'='C:\Program Files\Grisoft\AVG7\avgamsvr.exe'='C:\Program Files\Grisoft\AVG7\avgcc.exe'='C:\Program Files\Grisoft\AVG7\avgemc.exe'='%windir%\Network Diagnostic\xpnetdiag.exe'= HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcspkimfrst .************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-03-06 19:19:46Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\fogxaffh]'ImagePath'='system32\drivers\sdhyhvjb.dat'.Completion time: 2008-03-06 19:26:49ComboFix-quarantined-files.txt  2008-03-07 03:26:14ComboFix2.txt  2008-03-07 02:54:52ComboFix3.txt  2008-03-07 01:52:39ComboFix4.txt  2008-03-06 07:14:09ComboFix5.txt  2008-02-25 22:56:32.2008-03-06 19:59:00 --- E O F ---          Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:03:19 PM, on 3/6/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16608)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\ActivCard\acachsrv.exeC:\Program Files\Common Files\ActivCard\acautoup.exeC:\PROGRA~1\Grisoft\AVG7\avgcc.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeC:\PROGRA~1\Grisoft\AVG7\avgemc.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\wuauclt.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUPO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO20 - Winlogon Notify: acAuth - C:\WINDOWS\SYSTEM32\acauth.dllO23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exeO23 - Service: ActivCard Authentication Service (ACachSrv) - ActivCard - C:\Program Files\Common Files\ActivCard\acachsrv.exeO23 - Service: ActivCard Gold Autoregister (acautoreg) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoreg.exeO23 - Service: ActivCard Auto-Update Service (acautoupdate) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoup.exeO23 - Service: ActivCard Gold service (Accoca) - ActivCard - C:\Program Files\Common Files\ActivCard\accoca.exeO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exeO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exeO23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exeO23 - Service: BOCore - Unknown owner - C:\Program Files\Comodo\CBOClean\BOCORE.exe (file missing) --End of file - 4379 bytes

sylvainreyes1 · Answer

Hello. I am sure you are very busy but I await your further instruction. Thank you once again.

bamajim · Answer

sylvainreyes1 1. Download CCleaner from here to clean temp files from your computer. Double click on the file to start the installation of the program. Select your language and click OK, then next. Read the license agreement and click I Agree. Click next to use the default install location. Click Install then finish to complete installation. Double click the CCleaner shortcut on the desktop to start the program. On the 'Windows' tab, under 'Internet Explorer,' uncheck 'Cookies' if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit). If you use either the Firefox or Mozilla browsers, the box to uncheck for 'Cookies' is on the Applications tab, under Firefox/Mozilla. Click on the 'Options' icon at the left side of the window, then click on 'Advanced.' deselect 'Only delete files in Windows Temp folders older than 48 hours.' Click on the 'Cleaner' icon on the left side of the window, then click Run Cleaner to run the program. Caution: It is not recommended that you use the 'Issues' feature unless you are very familiar with the registry as it has been known to find legitimate items. After CCleaner has completed its process, click Exit. 2. Run an online virus scan called Kaspersky from HERE. 1. Click on ' Kaspersky Online Scanner' 2. A new smaller window will pop up. Press on ' Accept'. After reading the contents. 3. Now Kaspersky will update the anti-virus database. Let it run. 4. Click on ' Next'->>' Scan Settings', and make sure the database is set to ' extended'. And check both the scan options. Then click OK. 5. Then click on ' My Computer'. And the scan will start. 6. When the scan is complete Select 'Save error report as' Then in the file name just type in kaspersky Under 'save as type' select text .txt Save it to your Desktop. Copy and post the results of the Kaspersky Online scan Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

sylvainreyes1 · Answer

Hello bamajim.   I ran CCleaner already and then I ran Kaspersky. My computer crashed and it took over 2 hours to complete but I finally got it done. Here are the results of the Kasperky Online Scan as you requested. I look forward to hearing from you once again with the next step. Thank you once again.       ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Wednesday, March 12, 2008 1:05:14 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 12/03/2008 Kaspersky Anti-Virus database records: 625147------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 20820 Number of viruses found: 1 Number of infected objects: 3 Number of suspicious objects: 0 Duration of the scan process: 02:09:01 Infected Object Name / Virus Name / Last ActionC:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\OneCare Protection\Support\MPLog-02152008-232612.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\edb.log Object is locked skippedC:\Documents and Settings\All Users\Application Data\Microsoft\Protection Service\MPSSVCPolicyIdLog.etl Object is locked skippedC:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\LocalService
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\m\Cookies\index.dat Object is locked skippedC:\Documents and Settings\m\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\m\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\m\Local Settings\History\History.IE5\index.dat Object is locked skippedC:\Documents and Settings\m\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skippedC:\Documents and Settings\m
tuser.dat Object is locked skippedC:\Documents and Settings\m
tuser.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skippedC:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skippedC:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skippedC:\Documents and Settings\NetworkService
tuser.dat.LOG Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Ent.dat Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\prov.xml Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\service.xml.bak Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\Prov\user.xml.bak Object is locked skippedC:\Program Files\Microsoft Windows OneCare Live\ClientSD\SubInfo.xml Object is locked skippedC:\QooBox\Quarantine\C\WINDOWS\system32\drivers\sdhyhvjb.dat.vir Object is locked skippedC:\QooBox\Quarantine\catchme2008-02-25_143651.33.zip/sdhyhvjb.dat Infected: Rootkit.Win32.Agent.aap skippedC:\QooBox\Quarantine\catchme2008-02-25_143651.33.zip/sdhyhvjb.dat.1 Infected: Rootkit.Win32.Agent.aap skippedC:\QooBox\Quarantine\catchme2008-02-25_143651.33.zip ZIP: infected - 2 skippedC:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skippedC:\System Volume Information\_restore{77EE9B02-DBB0-4ECD-A8F8-275BB73915EB}\RP17\change.log Object is locked skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skippedC:\WINDOWS\SchedLgU.Txt Object is locked skippedC:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skippedC:\WINDOWS\system32\AppCert\prx99b.dll Object is locked skippedC:\WINDOWS\system32\CatRoot2\edb.log Object is locked skippedC:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skippedC:\WINDOWS\system32\CatRoot2	mp.edb Object is locked skippedC:\WINDOWS\system32\config\AppEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\default Object is locked skippedC:\WINDOWS\system32\config\default.LOG Object is locked skippedC:\WINDOWS\system32\config\Internet.evt Object is locked skippedC:\WINDOWS\system32\config\MSFWSVC.evt Object is locked skippedC:\WINDOWS\system32\config\SAM Object is locked skippedC:\WINDOWS\system32\config\SAM.LOG Object is locked skippedC:\WINDOWS\system32\config\SecEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\SECURITY Object is locked skippedC:\WINDOWS\system32\config\SECURITY.LOG Object is locked skippedC:\WINDOWS\system32\config\software Object is locked skippedC:\WINDOWS\system32\config\software.LOG Object is locked skippedC:\WINDOWS\system32\config\SysEvent.Evt Object is locked skippedC:\WINDOWS\system32\config\system Object is locked skippedC:\WINDOWS\system32\config\system.LOG Object is locked skippedC:\WINDOWS\system32\config\Windows_OneCare_Evt.evt Object is locked skippedC:\WINDOWS\system32\h323log.txt Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skippedC:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skippedC:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

bamajim · Answer

sylvainreyes1

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select " Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

sylvainreyes1 · Answer

Thank you. See next message. Message Edited by sylvainreyes1 on 03-12-2008 06:36 PM

sylvainreyes1 · Answer

Hello bamajim. I did exactly what you said with MBAM and I closed the previous Kaspersky window when I got to the remove selected section of MBAM. Here is the MBAM report. Thank you and I look forward to hearing from you once again.

Malwarebytes' Anti-Malware 1.08
Database version: 471

Scan type: Quick Scan
Objects scanned: 27584
Time elapsed: 22 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\system32\AppCert (Trojan.Downloader) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\AppCert\filter.drv (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\options.dat (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AppCert\prx99b.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

bamajim · Answer

sylvainreyes1

Rerun Hijackthis and post a fresh Hijackthis log.

And in your reply give me an update on how your PC is running now.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

sylvainreyes1 · Answer

Hello bamajim. You know my laptop is running much better. I realize that it only has 128 of RAM so it may be running as good as it can. Here is the hijackthis log I just ran. Let me know if anything else needs to be done. Thank you once again.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:49:10 PM, on 3/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivCard\acachsrv.exe
C:\Program Files\Common Files\ActivCard\acautoreg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\ActivCard\acautoup.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O20 - Winlogon Notify: acAuth - C:\WINDOWS\SYSTEM32\acauth.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ActivCard Authentication Service (ACachSrv) - ActivCard - C:\Program Files\Common Files\ActivCard\acachsrv.exe
O23 - Service: ActivCard Gold Autoregister (acautoreg) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoreg.exe
O23 - Service: ActivCard Auto-Update Service (acautoupdate) - ActivCard S.A. - C:\Program Files\Common Files\ActivCard\acautoup.exe
O23 - Service: ActivCard Gold service (Accoca) - ActivCard - C:\Program Files\Common Files\ActivCard\accoca.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BOCore - Unknown owner - C:\Program Files\Comodo\CBOClean\BOCORE.exe (file missing)

--
End of file - 4552 bytes

bamajim · Answer

sylvainreyes1

With 128K, I'm suprised it has any speed at all. XP needs at least 256K to run at a respectible rate, and 512K would be prefered.

You may want to use this program to clean up

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced." deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.

You may now remove/delete/uninstall the tools we used to clean your PC

Now that your log is clean

There are some final notes:
Disable and Enable System Restore

Lets create a clean System Restore point
the instructions are here

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of
Java Runtime Environment (JRE) 6.u5.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the " Download" button to the right.
Check the box that says: " Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u5-windowsi586-p.exe to install the newest version.

Update your Anti Virus Software

Use and maintain a Firewall

Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Important Documents and Files on a regular basis

To a disc or a USB key, not your Hardrive

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

sylvainreyes1 · Answer

Hi bamajim. I ran CCleaner and everything was fine. I deleted combofix and hijackthis from my laptop along with the other tools we used to clean it. After I created a new system restore point I connected the Ethernet cable to go online to update JAVA. Now the laptop is running slower than before we started cleaning it. Can you please help me once again?

bamajim · Answer

sylvainreyes1   Post a fresh Hijackthis log and lets see if anything changed     Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

Virus & Spyware

PLEASE I NEED HELP analyzing hijackthis and combofix logs please...

Was this post helpful?