Hi

try post it on the HijackThis forum

From Chris

My computer
Dell Dimension 1100
Microsoft Windows XP Home SP3
512 MB of Ram
Nvidia Geforce FX 5200 256MB
Intel Celeron CPU 2.53GHz
Dell E196FP
HDD WDC WD800BB-75JCO 80GB C:
HDD Samsung SV2042H 20GB F:
TSSTcorp CDRWDVD TS-H492C D:
LITE-ON DVDRW LDW-851S E:
Linksys Wireless-G WUSB54GS With SpeedBooster
Logitech Cordless Desktop EX 90
Logitech Cordless Click Plus Rechargeable Optical Mouse
Mozilla Firefox 3.0
Internet Explorer 8 Beta 1

My Security Software
Avanquest SystemSuite 8 Professional
Windows Defender

Hi, PrincessSu2,
I don't see the same problem that you had in April. Perhaps the symptoms are similar, but something is hiding.
Before we begin, please remove any cracked software and P2P programs (including torrents) that you may have installed.
Just as last time, please do not run any other scans or install software on your own while we are working on this because they may interfere with our tools.

Please perform this online scan: F-Secure Online Scanner
The online scanner is on the bottom right of the page.
Direct link: http://support.f-secure.com/enu/home/ols.shtml

Follow the directions on the F-Secure page for proper Installation.

* You may receive an alert on the address bar at this point to install the ActiveX control.
* Click on that alert and then click " Install ActiveX component".
* Read the license agreement and click " Accept".
* Click " Custom Scan" and be sure the following are checked:

• Scan whole System
• 
  
• Scan all files
• Scan whole system for rootkits
• Scan whole system for spyware
• Scan inside archives
• Use advanced heuristics

* When the scan completes, click the " I want to decide item by item" button.
* For each item found, Select " Disinfect" and click " Next".

* When done, click the " Show Report" button, then copy and paste the entire report into your next reply along with a fresh HijackThis log.

Thanks so much. Here is the FSecure scan info:

 

 

---

Result: 28 malware found

Tracking Cookie (spyware)

• System

Trojan.Win32.Monder (virus)

• System

Trojan.Win32.Monder.gen (virus)

• C:\Windows\System32\dmkcp.exe
• C:\Windows\System32\dmlwk.exe
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmcxg.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmflh.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmgky.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmibd.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmjnj.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmkbq.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmqvm.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmuwx.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmxxp.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\VirtualStore\Windows\System32\dmyox.tmp (Renamed & Submitted)
• C:\Users\Susan\AppData\Local\Temp\freebsd.exe
• C:\!KillBox\dmcxg.tmp (Renamed & Submitted)
• C:\!KillBox\dmflh.tmp (Renamed & Submitted)
• C:\!KillBox\dmgky.tmp (Renamed & Submitted)
• C:\!KillBox\dmibd.tmp (Renamed & Submitted)
• C:\!KillBox\dmjnj.tmp (Renamed & Submitted)
• C:\!KillBox\dmjxz.tmp (Renamed & Submitted)
• C:\!KillBox\dmkbq.tmp (Renamed & Submitted)
• C:\!KillBox\dmlwk.exe (Renamed & Submitted)
• C:\!KillBox\dmqvm.tmp (Renamed & Submitted)
• C:\!KillBox\dmrxe.tmp (Renamed & Submitted)
• C:\!KillBox\dmuwx.tmp (Renamed & Submitted)
• C:\!KillBox\dmxxp.tmp (Renamed & Submitted)
• C:\!KillBox\dmyox.tmp (Renamed & Submitted)

---

Statistics

Scanned:

• Files: 203946
• System: 4795
• Not scanned: 120

Actions:

• Disinfected: 0
• Renamed: 23
• Deleted: 0
• None: 5
• Submitted: 23

Files not scanned:

• (9��t�WINDOWS\TEMP\MCMSC_NXNAAD0FOF87WI0
• C:\WINDOWS\TEMP\MCMSC_OBFUAXKEWE4WXOF
• C:\WINDOWS\TEMP\SQLITE_7MILVACDSXXFGOF
• C:\WINDOWS\TEMP\SQLITE_CEL7XNADM1EXOMG
• C:\WINDOWS\TEMP\SQLITE_PIQEP3BJE1WISYQ
• C:\WINDOWS\TEMP\TFR27BB.TMP
• C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-0.C7483456-A289-439D-8115-601632D005A0
• C:\WINDOWS\SYSTEM32\7B296FB0-376B-497E-B012-9C450E1B7327-2P-1.C7483456-A289-439D-8115-601632D005A0
• C:\WINDOWS\SYSTEM32\BIOS1.ROM
• C:\WINDOWS\SYSTEM32\SMI\STORE\MACHINE\SCHEMA.DAT{D8932E69-6A6F-11DB-B6AB-A038F15A5785}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\MSDTC\KTMRMTMCONTAINER00000000000000000002
• C:\WINDOWS\SYSTEM32\DLA\DLAMRMSG.ISO
• C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
• C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
• C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\SAM
• C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
• C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
• C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG2
• C:\WINDOWS\SYSTEM32\CONFIG\TXR\NTUSER.DAT{B86B2EE4-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\TXR\NTUSER.DAT{B86B2EF3-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\NTUSER.DAT{CAA62D47-7106-11DB-8AAC-806E6F6E6963}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{9B28B3F3-0FDF-11DC-83C7-0019B969FE7A}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\MICROSOFT\WINDOWS\USRCLASS.DAT{F5D7E79C-27F3-11DC-9EA9-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\NTUSER.DAT{B86B2EDD-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\NTUSER.DAT{B86B2EEC-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
• C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM.LOG1
• C:\WINDOWS\SYSTEM32\CONFIG\JOURNAL\NTUSER.DAT{B86B2ED9-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWS\SYSTEM32\CONFIG\JOURNAL\NTUSER.DAT{B86B2EE8-13C4-11DD-892B-00038A000015}.TMCONTAINER00000000000000000002.REGTRANS-MS
• C:\WINDOWl

---

Options

Scanning engines:

• F-Secure USS: 2.30.0
• F-Secure Hydra: 2.8.8110, 2008-07-12
• F-Secure AVP: 7.0.171, 2008-07-12
• F-Secure Pegasus: 1.20.0, 2008-04-14

Scanning options:

• Scan all files
• Scan inside archives
• Use Advanced heuristics

---

Here is the Hijack This scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:52:48 AM, on 7/13/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\sttray.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Common Files\AOL\1182799701\ee\aolsoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\SiteAdvisor\6261\SiteAdv.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Downloaded Program Files\gatelauncher.exe
C:\Users\Susan\AppData\Local\Temp\fsgk32.exe
C:\Users\Susan\AppData\Local\Temp\fssm32.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\PhotoDownloader.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1182799701\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SiteAdvisor] "C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: QuickSet.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O23 - Service: McAfee Application Installer Cleanup (0133431215957876) (0133431215957876mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\013343~1.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10327 bytes

 

Thank you!

Good job :) Yes, the nasty stuff was hiding.

You reported the last time that we cleaned:
"I was able to delete KillBox."

If you still have this folder here delete it:
C:\ !KillBox\

How is everything running now?

It does seem to be working okay now.  I will have to learn to stop letting other people use it!

Thank you so much...AGAIN.

 

You're welcome :)

"I will have to learn to stop letting other people use it!"

Definitely!

Java had an update since we fixed you the last time.
If you've had other people using yoru computer, let's do a general cleaning with CCleaner and then update Java.

Download and scan each user profile with CCleaner:
http://www.ccleaner.com/download/builds
** Select to download the SLIM version.

** Because CCleaner removes everything in temp folders, if you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner.

** We will be cleaning cookies as well. Make a note of any passwords, etc. that you want to save.

1. Before first use, select Options > Advanced and UNCHECK
"Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section.
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the "Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click "OK" and it will scan and clean your system.
6. Click "exit" when done.
REBOOT.

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "Java Runtime Environment (JRE) 6u7 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each of the Java versions.
• 
  
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u7-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.

If everything is running well, it would be good to flush System Restore so you can start fresh. We'll purge the old, infected Restore Points by turning System Restore off and on again.

To turn off Windows Vista System Restore:

1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
9. When you have finished, restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows Vista System Restore:

1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Place a checkmark in the box for any drive you wish to enable System Restore on
7. Click OK

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.
These suggestions are general prevention and are not customized for your computer. You may have already taken some of these steps, and depending on your current security, you may not need to implement all of these:

1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (by Checkpoint) has a free version http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

3.You might consider installing Mozilla / Firefox.
http://www.mozilla.com/en-US/

4. Do not use file sharing. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple. File sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known
vulnerabilities.

5. Before using or purchasing any Spyware/Malware protection/removal program, always check the following Rogue/Suspect Spyware Lists.
http://www.spywarewarrior.com/rogue_anti-spyware.htm
http://www.malwarebytes.org/database.php

6. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

7. Practice Safe Surfing with with TrendProtect by Trend Micro. This is not compatible with Firefox 3.0 yet.
TrendProtect is a browser plugin that assigns a safety rating to domains listed in your search engine. TrendProtect also adds a new button to your browser's toolbar area. The icon and color of the button changes to indicate whether the page currently open is safe, unsafe, trusted, or unrated, or whether it contains unwanted content.

The following color codes are used by TrendProtect to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

8. You might consider installing SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html
It will:
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
Periodically check for updates.

9. Here are some helpful articles:
"How did I get infected?"
http://www.bleepingcomputer.com/forums/topic2520.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

 

Edit:  I suggest that you post your connection question for the specialists on the Network/Internet/Wireless Board. See if they have any suggestions.

I may have spoken too soon.  I have lost my wireless connection twice and it says my router is not available when I try to reconnect.   However, My router is listed as available when I choose "Connect To".  Then, it comes back within a few minutes or after I shut it down and restart.  Would this be affected by these viruses or is it a problem with my router?

Thanks