this is my log file please help me

Question

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:26:41 PM, on 11/26/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\system32\oslamxqa.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Ryan\Desktop\HiJackThis_v2.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\oumvkaxx.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [ObscuraSetup.exe] C:\DOCUME~1\Ryan\Desktop\OBSCUR~1.EXE /r O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE' -quiet O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228' O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227' O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DomainService -   - C:\WINDOWS\system32\oslamxqa.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 9657 bytes   I get pop-ups saying my computer has several viruses, malware and spyware. When I scan using internet security 14 by pc-cillin it only finds some affected cookies and I still get the pop-ups when I am online.   Any help would be appreciated!   Thank You   ryan

Bugbatter · Answer

Welcome. Thank you for using Dell Community Forums. Father Christmas 2

I am reviewing your log.
In the meantime, you can help me by doing the following:

* Have you have posted this log on another forum? If so, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log. Please do not do anything else until you get further instructions.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence, and do not run any fixes or scanners on your own because this may cause conflicts with the tools that I am using.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

Your HijackThis needs to be in a folder.
Rightclick on an empty space on your desktop and choose New > Folder
Name it HijackThis (HJT, or whatever)
Rightclick HijackThis.exe, choose Cut.
Doubleclick (to open) the folder you created.
Rightclick inside and choose Paste.

Please include a fresh HijackThis log in your reply.

Bugbatter · Answer

Welcome back Father Christmas 2

Please download the latest version of VundoFix.exe to your desktop. (If you have an earlier version, delete it and its old log here: C:\ vundofix.txt.)

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files,
click YES
Once you click yes, your desktop will go blank as it starts removing
Vundo.
When completed, it will prompt that it will shutdown your computer,
click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt and a new
HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not
remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot. ** If you get a warning about updating Java, do not do so until I can give you further instructions.

aquen · Answer

Nope, not on any other forums.   No cracked software.   No P2P. I have not fixed any entries.   HJT is in a folder. New HJT Log:   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:00:55 PM, on 11/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\system32\oslamxqa.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe c:\program files\common files\installshield\updateservice\isuspm.exe C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\Documents and Settings\Izzy\Desktop\New Folder\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\oumvkaxx.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKLM\..\Run: [40fb69d2] rundll32.exe 'C:\WINDOWS\system32\lqyupbpj.dll',b O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DomainService -   - C:\WINDOWS\system32\oslamxqa.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 9265 bytes Thank you for any help you can provide   ryan

aquen · Answer

OK.  Here is my new log file. There are no more annoying popups. Thank you tremendously.   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:35:47 PM, on 11/27/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\system32\oslamxqa.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe C:\WINDOWS\system32undll32.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\PROGRA~1\TRENDM~1\INTERN~2	sc.exe C:\Documents and Settings\Ryan\Desktop\New Folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {030A5EBC-2A79-4310-89AD-07DE56266D41} - C:\WINDOWS\system32\jkkjg.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78} - (no file) O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: (no name) - {674BDAAD-552B-4B6C-9F5D-C95F0FBBC95C} - C:\WINDOWS\system32\jkkjg.dll O2 - BHO: {1fa8282a-578c-d9fb-d384-6900df791f09} - {90f197fd-0096-483d-bf9d-c875a2828af1} - C:\WINDOWS\system32\ageyyjvo.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\byxxwvv.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file) O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKLM\..\Run: [40fb69d2] rundll32.exe 'C:\WINDOWS\system32\lqyupbpj.dll',b O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [ObscuraSetup.exe] C:\DOCUME~1\Ryan\Desktop\OBSCUR~1.EXE /r O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE' -quiet O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' O4 - HKUS\S-1-5-21-4245240541-1093928403-113070693-1007\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe' (User 'Laura') O4 - HKUS\S-1-5-21-4245240541-1093928403-113070693-1007\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup (User 'Laura') O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228' O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227' O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: byxxwvv - C:\WINDOWS\SYSTEM32\byxxwvv.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DomainService -   - C:\WINDOWS\system32\oslamxqa.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 11173 bytes vundofix.txt   VundoFix V6.6.2 Checking Java version... Java version is 1.4.2.3 Old versions of java are exploitable and should be removed. Scan started at 3:15:32 PM 11/27/2007 Listing files found while scanning.... C:\windows\system32\euukuouk.dll C:\windows\system32\euukuouk.dllbox C:\windows\system32\hhhgdslm.dllbox C:\windows\system32\hlafxgnw.dllbox C:\windows\system32\hxvfpvip.dllbox C:\windows\system32\odhpvgoj.dll C:\windows\system32\oumvkaxx.dll C:\windows\system32\oumvkaxx.dllbox C:\windows\system32\zdnabgfs.dllbox Beginning removal...  Attempting to delete C:\windows\system32\euukuouk.dll C:\windows\system32\euukuouk.dll Has been deleted!  Attempting to delete C:\windows\system32\euukuouk.dllbox C:\windows\system32\euukuouk.dllbox Has been deleted!  Attempting to delete C:\windows\system32\hhhgdslm.dllbox C:\windows\system32\hhhgdslm.dllbox Has been deleted!  Attempting to delete C:\windows\system32\hlafxgnw.dllbox C:\windows\system32\hlafxgnw.dllbox Has been deleted!  Attempting to delete C:\windows\system32\hxvfpvip.dllbox C:\windows\system32\hxvfpvip.dllbox Has been deleted!  Attempting to delete C:\windows\system32\odhpvgoj.dll C:\windows\system32\odhpvgoj.dll Has been deleted!  Attempting to delete C:\windows\system32\oumvkaxx.dll C:\windows\system32\oumvkaxx.dll Has been deleted!  Attempting to delete C:\windows\system32\oumvkaxx.dllbox C:\windows\system32\oumvkaxx.dllbox Has been deleted!  Attempting to delete C:\windows\system32\zdnabgfs.dllbox C:\windows\system32\zdnabgfs.dllbox Has been deleted! Performing Repairs to the registry. Done!   ryan

Bugbatter · Answer

You are still infected. I am reviewing your log and will reply soon.

Bugbatter · Answer

Okay, here we go...

* Double-click VundoFix.exe to run it again.
Click Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files

* Copy/Paste the first 2 entries below into the top 2 boxes

C:\WINDOWS\system32\jkkjg.dll
C:\WINDOWS\system32\gjkkj.*
C:\WINDOWS\system32\ageyyjvo.dll
C:\WINDOWS\system32\ovjyyega.*
C:\WINDOWS\system32\byxxwvv.dll
C:\WINDOWS\system32\vvwxxyb.*
C:\WINDOWS\system32\lqyupbpj.dll
C:\WINDOWS\system32\jpbpuyql.dll
C:\WINDOWS\system32\oslamxqa.exe

* Click Add Files. Repeat until they are all added. Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.

** If you get a warning in your VundoFix log about updating Java, do not do so until I can give you further instructions.

Launch HijackThis and place a checkmark next to the following if they still exist:

O2 - BHO: (no name) - {030A5EBC-2A79-4310-89AD-07DE56266D41} - C:\WINDOWS\system32\jkkjg.dll
O2 - BHO: (no name) - {674BDAAD-552B-4B6C-9F5D-C95F0FBBC95C} - C:\WINDOWS\system32\jkkjg.dll
O2 - BHO: {1fa8282a-578c-d9fb-d384-6900df791f09} - {90f197fd-0096-483d-bf9d-c875a2828af1} - C:\WINDOWS\system32\ageyyjvo.dll
O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\byxxwvv.dll
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [40fb69d2] rundll32.exe "C:\WINDOWS\system32\lqyupbpj.dll",b
O20 - Winlogon Notify: byxxwvv - C:\WINDOWS\SYSTEM32\byxxwvv.dll
O23 - Service: DomainService - - C:\WINDOWS\system32\oslamxqa.exe

If you do not know what this is, check this one as well:
O4 - HKCU\..\Run: [ObscuraSetup.exe] C:\DOCUME~1\Ryan\Desktop\OBSCUR~1.EXE

Close all windows except Hijackthis and click "Fix Checked".
Close HijackThis.

If you checked [ObscuraSetup.exe] delete this file (probably named "Obscura Setup" or something similar)
C:\DOCUME~1\Ryan\Desktop\ OBSCUR~1.EXE

REBOOT.

* Please post the contents of C:\vundofix.txt and a new HiJackThis log. We will have more to do.

Message Edited by Bugbatter on 11-27-2007 08:20 PM

aquen · Answer

Vundofix found no infected files.  No log was created.   I ran HJT and checked and fixed the entries you had specified.  Here is a fresh HJT log after reboot.   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:43:43 AM, on 11/28/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Ryan\Desktop\New Folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKLM\..\Run: [40fb69d2] rundll32.exe 'C:\WINDOWS\system32\ybosagoe.dll',b O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE' -quiet O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228' O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227' O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 9367 bytes   Thank You.   ryan

Bugbatter · Answer

We need a bigger weapon.
Download KILLBOX, extract it to your desktop.
If not available, here is an alternate link for the download:
KILLBOX

Note: In the event you already have Killbox, this is a new version that I need you to download
Save it to your Desktop. Do not run it yet.

Please reboot into Safemode:
Turn on the computer.
Immediately begin tapping the F8 key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

Launch HijackThis and place a checkmark next to the following:
O4 - HKLM\..\Run: [40fb69d2] rundll32.exe "C:\WINDOWS\system32\ybosagoe.dll",b
and this one if you, an Administrator, or Spybot did not set these restrictions:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all windows except HijackThis and click "Fix Checked". Close Hijackthis.

Please double-click Killbox.exe to run it.
Select: Delete on Reboot

Click on the Single File button.

Please copy the file path below to the clipboard by highlighting it and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\ybosagoe.dll

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button.
Click Yes at the Delete on Reboot prompt.
Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message.).

If your computer does not restart automatically, please restart it manually into normal mode.

[Note: Killbox makes backups of all deleted files & folders in a folder called C:\!killbox ]
If Killbox tells you any files are missing don't worry but make a note and let us know in your next reply.

Finally, please post a fresh HJT log and let me know how things are running. Also please let me know if you want to keep Party Poker.

aquen · Answer

Hi.    The entries, O4 - HKLM\..\Run: [40fb69d2] rundll32.exe 'C:\WINDOWS\system32\ybosagoe.dll',b O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present   were not there when I ran HJT.   When I tried to run Killbox I got this error message:   Component 'MSCOMTL.OCX' or one of its dependencies not correctly registered: a file is missing or invalid   I click OK in that box and Killbox does not run.   Here is a fresh HJT log:   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:11:25 AM, on 11/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Ryan\Desktop\New Folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\usscfxpy.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE' -quiet O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228' O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227' O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 9414 bytes Thank you for any help.   ryan

Bugbatter · Answer

You have become reinfected by something that is hiding, and we are now trying to kill a different file.

Download this file to your 'System32' folder:
http://www.boletrice.com/downloads/mscomctl.ocx

Download ATF Cleaner by Atribune:
http://www.atribune.org/ccount/click.php?id=1]
Do not run it yet.

Please reboot into Safemode without networking (so you are offline):
Immediately begin tapping the F8 key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

Launch HijackThis and place a checkmark next to the following:
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\usscfxpy.dll

If you did not set this fix this one as well:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Close all windows except Hijackthis and click "Fix Checked".
Close Hijackthis.

This time run Killbox with these slightly different steps[NOTE: If Killbox still will not run, skip down to the steps for running ATF Cleaner and continue from there.]:
Open Killbox.

Copy the file name below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\system32\usscfxpy.dll

In Killbox, go to the File menu, and choose "Paste from Clipboard".

Select: “ Replace on Reboot”.
Put a check in the box " Use Dummy"
Click the red-and-white " Delete File" button.
When prompted to Replace on Reboot, click YES
If prompted to Reboot Now, Click YES
Allow the PC to shutdown
Reboot your PC back into Safemode.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browser Click Firefox at
the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please
click No at the prompt.
If you use Opera browser Click Opera at the
top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please
click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located
at the bottom of each menu.

Reboot normally.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "Java Runtime Environment (JRE) 6u3 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each of the Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u3-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.

1. Please download Combofix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the link is case sensitive
Save ComboFix to the desktop. **Note: It is important that it is saved directly to, and run from your desktop**

In the event you already have Combofix, please delete it as this is a new version.
* Close any open browsers. Disconnect from the internet.
* Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

2. Double click ComboFix.exe and follow the prompts.
You will temporarily lose the Desktop while the scan is running. Once the scan is done your Desktop will return to normal.

3. When finished, it will produce a log for you. Post that log in your next reply along with a fresh HijackThis log.

Notes:
* Do not mouseclick ComboFix's window while it's running. That may cause it to stall.
* ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

* Don't forget to enable your anti-virus before coming back online to post your logs.

The above instructions have been created specifically for this user. If you are not this user, do NOT follow these directions.

aquen · Answer

ok here is the HJT log:   Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:13:08 PM, on 11/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\WINDOWS\system32
vsvc32.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\WINDOWS\system32
otepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78} - (no file) O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {BBB05D9E-0297-404D-A6BF-D8F2876B84A6} - C:\WINDOWS\system32\byxxwvv.dll O2 - BHO: {27bdce0c-9a7d-4d4a-8b44-4c6dfe7b282c} - {c282b7ef-d6c4-44b8-a4d4-d7a9c0ecdb72} - C:\WINDOWS\system32\vywshhgh.dll O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] 'C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' -startup O4 - HKLM\..\Run: [ISUSScheduler] 'C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' -start O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Google Desktop Search] 'C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' /startup O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe O4 - HKLM\..\Run: [XboxStat] 'C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' silentrun O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Yahoo! Pager] 'C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE' -quiet O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startup O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [OE_OEM] 'C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: Display All Images with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/228' O8 - Extra context menu item: Display Image with Full Quality - 'res://C:\Program Files\NetZero\qsacc\appres.dll/227' O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab49816.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: byxxwvv - C:\WINDOWS\SYSTEM32\byxxwvv.dll O20 - Winlogon Notify: usscfxpy - C:\WINDOWS\SYSTEM32\usscfxpy.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2	mproxy.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe -- End of file - 10076 bytes   I am not getting any pop-ups anymore.  Or any big slowdowns.  The only thing that does concern me is a little working offline button that pops up sometimes.  Is it something to worry about?   I made sure pc-cillin internet security 14 was fully updated and enabled.   Thank you for your help.   ryan

aquen · Answer

OK.  Downloaded missing file. Ran HJT and fixed specified entries. Ran Killbox. Here is the log:   Pocket Killbox version 2.0.0.881 Running on Windows XP as Ryan(Administrator) was started @ Thursday, November 29, 2007, 1:01 PM   # 1 [Replace on Delete] Path = C:\WINDOWS\system32\usscfxpy.dll *Replaced with C:\Documents and Settings\Ryan\Local Settings\Temp\kbdummy.0   I Rebooted @ 1:03:24 PM Killbox Closed(Exit) @ 1:03:26 PM __________________________________________________   Ran ATF Cleaner. I did not find a log for it.  But it said that it emptied the selected directories and the rebooted.   Installed JRE version 6 after removing old java.   Ran Combofix. Here is the log:   ComboFix 07-11-19.4C - Ryan 2007-11-29 13:59:36.1 - NTFSx86 Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.684 [GMT -6:00] Running from: C:\Documents and Settings\Ryan\Desktop\ComboFix.exe  * Created a new restore point . (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Desktop\Live Safety Center.lnk C:\Documents and Settings\Administrator\Desktop\Online Security Guide.lnk C:\Documents and Settings\Administrator\Favorites\Online Security Guide.lnk C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk C:\Documents and Settings\Guest\Favorites\Online Security Guide.lnk C:\Documents and Settings\Izzy\Desktop\Live Safety Center.lnk C:\Documents and Settings\Izzy\Desktop\Online Security Guide.lnk C:\Documents and Settings\Izzy\Favorites\Online Security Guide.lnk c:\documents and settingsyan\favorites\Online Security Guide.lnk C:\WINDOWS\system32\driver C:\WINDOWS\system32\driver\bcm43xx.cat C:\WINDOWS\system32\driver\RNDISMP.sys C:\WINDOWS\system32\driver\RNDISMPK.sys C:\WINDOWS\system32\driver\usb8023.sys C:\WINDOWS\system32\driver\usb8023k.sys C:\WINDOWS\system32\gjkkj.ini C:\WINDOWS\system32\gjkkj.ini2 C:\WINDOWS\system32\jkkjg.dll C:\WINDOWS\system32\usscfxpy.dllbox . (((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\DomainService (((((((((((((((((((((((((   Files Created from 2007-10-28 to 2007-11-29  ))))))))))))))))))))))))))))))) . 2007-11-29 13:50 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-11-29 13:49   d-------- C:\Program Files\Common Files\Java 2007-11-29 12:54 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2007-11-29 09:36 85,056 --a------ C:\WINDOWS\system32\ljgxcefv.dll 2007-11-29 09:35 145,984 --a------ C:\WINDOWS\system32\jkxhxobt.dll 2007-11-29 02:57 78,912 --a------ C:\WINDOWS\system32\ijmngeqf.dll 2007-11-29 02:57 71,232 --a------ C:\WINDOWS\system32
acdbfdq.exe 2007-11-27 15:47 71,232 --a------ C:\WINDOWS\system32\biprsyxa.exe 2007-11-27 15:47 654 --ahs---- C:\WINDOWS\system32\eogasoby.ini 2007-11-27 15:15   d-------- C:\VundoFix Backups 2007-11-27 14:50 354 --ahs---- C:\WINDOWS\system32\jpbpuyql.ini 2007-11-27 14:47 78,912 --a------ C:\WINDOWS\system32\ageyyjvo.dll 2007-11-26 10:35   d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro 2007-11-26 10:35 73,288 --a------ C:\WINDOWS\system32\drivers	mtdi.sys 2007-11-26 10:17   d-------- C:\Program Files\Ventrilo 2007-11-26 10:17   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-19 14:05   d-------- C:\Documents and Settings\Guest\UserData 2007-11-18 22:22 36,352 --a------ C:\WINDOWS\system32\byxxwvv.dll 2007-11-18 22:22 35,840 --a------ C:\WINDOWS\mrofinu72.exe 2007-11-05 14:52   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-05 14:44   d-------- C:\Documents and Settings\Ryan\Application Data\Uniblue . ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 19:50 --------- d-----w C:\Program Files\Java 2007-11-26 23:26 --------- d-----w C:\Program Files\Trend Micro 2007-11-26 20:49 --------- d-----w C:\Program Files\Dell 2007-11-26 20:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-13 22:50 --------- d-----w C:\Program Files\World of Warcraft 2007-10-10 04:59 --------- d-----w C:\Program Files\Google 2007-10-10 01:10 --------- d-----w C:\Documents and Settings\Izzy\Application Data\Gtek 2007-10-02 06:08 --------- d-----w C:\Documents and Settings\Ryan\Application Data\Ventrilo 2007-09-29 23:39 --------- d-----w C:\Documents and Settings\Ryan\Application Data\Viewpoint 2007-09-29 23:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-09-29 05:51 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment . (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}] 2007-11-18 22:22 36352 --a------ C:\WINDOWS\system32\byxxwvv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c282b7ef-d6c4-44b8-a4d4-d7a9c0ecdb72}] 2007-11-29 09:38 77888 --a------ C:\WINDOWS\system32\vywshhgh.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 10:24] 'Yahoo! Pager'='C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe' [2006-10-24 16:10] 'DellSupport'='C:\Program Files\DellSupport\DSAgnt.exe' [2007-03-15 10:09] 'Uniblue RegistryBooster 2'='C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe' [] 'OE_OEM'='C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' [2006-08-04 16:15] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ehTray'='C:\WINDOWS\ehome\ehtray.exe' [2005-09-29 14:01] 'SigmatelSysTrayApp'='stsystra.exe' [2005-03-22 23:20 C:\WINDOWS\stsystra.exe] 'IAAnotif'='C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe' [2005-06-17 07:56] 'DMXLauncher'='C:\Program Files\Dell\Media Experience\DMXLauncher.exe' [2005-10-05 03:12] 'RealTray'='C:\Program Files\Real\RealPlayer\RealPlay.exe' [2006-03-22 22:04] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-03-22 22:04] 'ISUSPM Startup'='C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' [2005-06-10 10:44] 'ISUSScheduler'='C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' [2005-06-10 10:44] 'DLA'='C:\WINDOWS\System32\DLA\DLACTRLW.EXE' [2005-09-08 05:20] 'Google Desktop Search'='C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' [2007-09-17 09:09] 'Corel Photo Downloader'='C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe' [2005-08-31 11:06] 'AOLDialer'='C:\Program Files\Common Files\AOL\ACS\AOLDial.exe' [2006-10-23 06:50] 'HostManager'='C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe' [2006-09-25 18:52] 'XboxStat'='C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' [2006-12-21 18:05] 'NvCplDaemon'='RUNDLL32.exe' [2004-08-10 05:00 C:\WINDOWS\system32undll32.exe] 'pccguide.exe'='C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' [2006-11-21 14:02] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe' [2007-09-25 01:11] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-03-22 22:04:07] ClientManager3.lnk - C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe [2007-09-16 14:33:20] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-03-22 22:02:15] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 'InstallVisualStyle'= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles 'InstallTheme'= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] '{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}'= C:\WINDOWS\system32\byxxwvv.dll [2007-11-18 22:22 36352] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\byxxwvv] byxxwvv.dll 2007-11-18 22:22 36352 C:\WINDOWS\system32\byxxwvv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\usscfxpy] usscfxpy.dll 2007-11-29 13:02 56 C:\WINDOWS\system32\usscfxpy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 'AppInit_DLLs'=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] 'Authentication Packages'= msv1_0 C:\WINDOWS\system32\jkkjg.dll R1 BUFADPT;BUFADPT;\??\C:\WINDOWS\system32\BUFADPT.SYS S3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\WINDOWS\system32\DRIVERS\xusb20.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 14:07:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 14:11:16 - machine was rebooted .  --- E O F ---       ok new post now with HJT log.

Bugbatter · Answer

You are still infected. I am reviewing the logs and will reply as soon as possible. If possible, until we have this cleaned up, please limit your online time to coming here for our fixes and for downloading our suggested tools.
Thank you for waiting patiently.

Bugbatter · Answer

Open Notepad and copy/paste the following text between the dotted lines into it. Do not copy the dotted lines. ** Make sure you copy/paste ALL the text at once. ----------------------------------------------------------------------------------------------- File::C:\WINDOWS\system32\ljgxcefv.dllC:\WINDOWS\system32\jkxhxobt.dllC:\WINDOWS\system32\ijmngeqf.dllC:\WINDOWS\system32
acdbfdq.exeC:\WINDOWS\system32\biprsyxa.exeC:\WINDOWS\system32\eogasoby.iniC:\WINDOWS\system32\jpbpuyql.iniC:\WINDOWS\system32\ageyyjvo.dllC:\WINDOWS\system32\byxxwvv.dllC:\WINDOWS\mrofinu72.exeC:\WINDOWS\system32\vywshhgh.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{27bdce0c-9a7d-4d4a-8b44-4c6dfe7b282c}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c282b7ef-d6c4-44b8-a4d4-d7a9c0ecdb72}][hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]'{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}'=-[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\byxxwvv][-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\usscfxpy][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]'Authentication Packages'=hex(7):6d,73,76,31,5f,30,00,00 -------------------------------------------------------------------------------------------------------- Save this as CFScript.txt Referring to the picture above, drag CFScript into ComboFix.exe You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix. CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. When finished, a log is produced here: C:\ComboFix.txt Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and let me know how things are running. Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

aquen · Answer

OK, here is the combofix log:   ComboFix 07-11-19.4C - Ryan 2007-11-30  0:31:17.2 - NTFSx86 Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.370 [GMT -6:00] Running from: C:\Documents and Settings\Ryan\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Ryan\Desktop\CFScript.txt  * Created a new restore point FILE File::C:\WINDOWS\system32\ljgxcefv.dllC:\WINDOWS\system32\jkxhxobt.dllC:\WINDOWS\system32\ijmngeqf.dllC:\WINDOWS\system32
acdbfdq.exeC:\WINDOWS\system32\biprsyxa.exeC:\WINDOWS\system32\eogasoby.iniC:\WINDOWS\system32\jpbpuyql.iniC:\WINDOWS\system32\ageyyjvo.dllC:\WINDOWS\system32\byxxwvv.dllC:\WINDOWS\mrofinu72.exeC:\WINDOWS\system32\vywshhgh.dllRegistry::[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{27bdce0c-9a7d-4d4a-8b44-4c6dfe7b282c}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}][-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c282b7ef-d6c4-44b8-a4d4-d7a9c0ecdb72}][hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]'{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}'=-[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\byxxwvv][-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\usscfxpy][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]'Authentication Packages'=hex(7):6d,73,76,31,5f,30,00,00 . (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\jkkjh.dll . (((((((((((((((((((((((((   Files Created from 2007-10-28 to 2007-11-30  ))))))))))))))))))))))))))))))) . 2007-11-30 00:13 5,371 --a------ C:\WINDOWS\system32\pmnnn.dll 2007-11-29 13:50 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-11-29 13:49   d-------- C:\Program Files\Common Files\Java 2007-11-29 12:54 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2007-11-29 09:36 85,056 --a------ C:\WINDOWS\system32\ljgxcefv.dll 2007-11-29 09:35 145,984 --a------ C:\WINDOWS\system32\jkxhxobt.dll 2007-11-29 02:57 78,912 --a------ C:\WINDOWS\system32\ijmngeqf.dll 2007-11-29 02:57 71,232 --a------ C:\WINDOWS\system32
acdbfdq.exe 2007-11-27 15:47 71,232 --a------ C:\WINDOWS\system32\biprsyxa.exe 2007-11-27 15:47 654 --ahs---- C:\WINDOWS\system32\eogasoby.ini 2007-11-27 15:15   d-------- C:\VundoFix Backups 2007-11-27 14:50 354 --ahs---- C:\WINDOWS\system32\jpbpuyql.ini 2007-11-27 14:47 78,912 --a------ C:\WINDOWS\system32\ageyyjvo.dll 2007-11-26 10:35   d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro 2007-11-26 10:35 73,288 --a------ C:\WINDOWS\system32\drivers	mtdi.sys 2007-11-26 10:17   d-------- C:\Program Files\Ventrilo 2007-11-26 10:17   d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-11-19 14:05   d-------- C:\Documents and Settings\Guest\UserData 2007-11-18 22:22 36,352 --a------ C:\WINDOWS\system32\byxxwvv.dll 2007-11-18 22:22 35,840 --a------ C:\WINDOWS\mrofinu72.exe 2007-11-05 14:52   d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-05 14:44   d-------- C:\Documents and Settings\Ryan\Application Data\Uniblue 2007-10-01 23:56   d-------- C:\Documents and Settings\Ryan\Application Data\Ventrilo . ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 19:50 --------- d-----w C:\Program Files\Java 2007-11-29 15:38 77,888 ----a-w C:\WINDOWS\system32\vywshhgh.dll 2007-11-29 15:36 71,232 ----a-w C:\WINDOWS\system32\yadihdmo.exe 2007-11-27 21:50 78,912 ----a-w C:\WINDOWS\system32\xbwspcea.dll 2007-11-26 23:26 --------- d-----w C:\Program Files\Trend Micro 2007-11-26 20:49 --------- d-----w C:\Program Files\Dell 2007-11-26 20:46 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-13 22:50 --------- d-----w C:\Program Files\World of Warcraft 2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-15 04:25 6,060 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-10-10 04:59 --------- d-----w C:\Program Files\Google 2007-10-10 01:10 --------- d-----w C:\Documents and Settings\Izzy\Application Data\Gtek 2007-09-29 23:39 --------- d-----w C:\Documents and Settings\Ryan\Application Data\Viewpoint 2007-09-29 23:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2007-09-29 05:51 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment 2007-08-22 12:55 96,256 ------w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-22 12:55 665,600 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-22 12:55 617,984 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-22 12:55 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-22 12:55 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-22 12:55 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 12:55 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-22 12:55 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-22 12:55 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-22 12:55 3,064,832 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-22 12:55 251,904 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-22 12:55 205,824 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-22 12:55 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-22 12:55 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 12:55 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-22 12:55 1,498,112 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 12:55 1,054,208 ------w C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 12:55 1,022,976 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-21 10:19 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll . (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3BA6D8E4-8D8D-40EE-AE47-2AA50A1C7B78}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}] 2007-11-18 22:22 36352 --a------ C:\WINDOWS\system32\byxxwvv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c282b7ef-d6c4-44b8-a4d4-d7a9c0ecdb72}] 2007-11-29 09:38 77888 --a------ C:\WINDOWS\system32\vywshhgh.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MSMSGS'='C:\Program Files\Messenger\msmsgs.exe' [2004-10-13 10:24] 'Yahoo! Pager'='C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe' [2006-10-24 16:10] 'DellSupport'='C:\Program Files\DellSupport\DSAgnt.exe' [2007-03-15 10:09] 'Uniblue RegistryBooster 2'='C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe' [] 'OE_OEM'='C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe' [2006-08-04 16:15] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ehTray'='C:\WINDOWS\ehome\ehtray.exe' [2005-09-29 14:01] 'SigmatelSysTrayApp'='stsystra.exe' [2005-03-22 23:20 C:\WINDOWS\stsystra.exe] 'IAAnotif'='C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe' [2005-06-17 07:56] 'DMXLauncher'='C:\Program Files\Dell\Media Experience\DMXLauncher.exe' [2005-10-05 03:12] 'RealTray'='C:\Program Files\Real\RealPlayer\RealPlay.exe' [2006-03-22 22:04] 'QuickTime Task'='C:\Program Files\QuickTime\qttask.exe' [2006-03-22 22:04] 'ISUSPM Startup'='C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe' [2005-06-10 10:44] 'ISUSScheduler'='C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe' [2005-06-10 10:44] 'DLA'='C:\WINDOWS\System32\DLA\DLACTRLW.EXE' [2005-09-08 05:20] 'Google Desktop Search'='C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe' [2007-09-17 09:09] 'Corel Photo Downloader'='C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe' [2005-08-31 11:06] 'AOLDialer'='C:\Program Files\Common Files\AOL\ACS\AOLDial.exe' [2006-10-23 06:50] 'HostManager'='C:\Program Files\Common Files\AOL\1172617964\ee\AOLSoftware.exe' [2006-09-25 18:52] 'XboxStat'='C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe' [2006-12-21 18:05] 'NvCplDaemon'='RUNDLL32.exe' [2004-08-10 05:00 C:\WINDOWS\system32undll32.exe] 'pccguide.exe'='C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe' [2006-11-21 14:02] 'SunJavaUpdateSched'='C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe' [2007-09-25 01:11] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-03-22 22:04:07] ClientManager3.lnk - C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe [2007-09-16 14:33:20] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-03-22 22:02:15] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 'InstallVisualStyle'= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles 'InstallTheme'= C:\WINDOWS\Resources\Themes\Royale.theme [hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks] '{BBB05D9E-0297-404D-A6BF-D8F2876B84A6}'= C:\WINDOWS\system32\byxxwvv.dll [2007-11-18 22:22 36352] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\byxxwvv] byxxwvv.dll 2007-11-18 22:22 36352 C:\WINDOWS\system32\byxxwvv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\usscfxpy] usscfxpy.dll 2007-11-29 13:02 56 C:\WINDOWS\system32\usscfxpy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 'AppInit_DLLs'=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL R1 BUFADPT;BUFADPT;\??\C:\WINDOWS\system32\BUFADPT.SYS S3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\WINDOWS\system32\DRIVERS\xusb20.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 00:38:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-30  0:41:22 - machine was rebooted C:\ComboFix2.txt ... 2007-11-29 14:11 .  --- E O F --- HJT log in next post ryan

Virus & Spyware

this is my log file please help me

Was this post helpful?