Hi, Andrew,

Has your friend tried uninstalling/reinstalling the program(s) giving her problems?

I don't see any serious malware in there -- just a few tweaks that can be made...

We'll have to disable some realtime monitoring do it does not interfere with HijackThis.
Right click the running icon of Spybot's TeaTimer, and choose Exit SpyBot S&D - Resident'.

We also need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

* Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
* Click on Tools, General Settings
* Under Real-time protection options, deselect the Turn on real-time protection check box
* Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

Launch HijackThis and place a checkmark next to the following:

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab


I would also take these out of Trusted Zones. There is really no reason why anything should be in there.If the sites get hacked, you've allowed then into your computer too easily.
O15 - Trusted Zone: http://www.google.ca
O15 - Trusted Zone: *.scr-apgirls.com

Close all widows except Hijackthis and click "Fix Checked". Clolse HijackThis.


Run Disk Cleanup in each user's profile:
Click "Start > Programs > Accessories > System Tools > Disk Cleanup"
Please make sure only the following are checked:
-- Downloaded Program Files
-- Temporary Internet Files
-- Recycle Bin
-- Temporary Files
Click "OK" and Disk Cleanup will delete those files.

Her Java is out of date. Older versions have vulnerabilities that malware can use to infect the system. It is possible that she may be running Java code in applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "Java Runtime Environment (JRE) 6u5 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each of the Java versions.
• 
  
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.

Official JAVA Installation Instructions if needed.


She could also run an online scan to see if anything else shows up.
Try Panda ActiveScan
>Here. You need to use Internet Explorer for this scan.

• Once you get to the Panda site, scroll down a bit and click on Scan your PC
• A new window will appear; click on Check Now!
• A new window will appear; fill in the boxes (Country, State, email addy)
• Click on Scan Now! >
• If you have never used TotalScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
  
• From "Select a device to scan...", choose "My Computer"
• Allow the scan to run. It'll take a while.
• When complete, click on "See Report", and then on "Save report"; save it to a convenient location.
• Please post that report in your next reply. Simply open the text file, then copy/paste the content here. Also, please include a fresh HJT log. I don't expect to see any big problems, but I'll be glad to check the logs.

Andrew, just split them up and keep replying to yourself until all text is posted.

Thanks for your help; I would post the panda and HJT logs, but my message can't exceed 20,000 characters (just the panda log is over that) , I'm not sure how to get the logs to you. I've tried uploading them in different ways, but I can't get it to work; how would you suggest I do it?

 

If this is any good, I've uploaded it to Google Docs, but it seemed to take some formatting out:

http://docs.google.com/Doc?id=dg7ns8z9_71f2fp5kdn

 

Thanks again,

Andrew

Okay, here it goes :)

 

PANDA
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-02 05:00:28
PROTECTIONS: 1
MALWARE: 14
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
AVG 7.5.519                                  7.5.519                       Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00035722  adware/comet                       Adware              No        0         Yes            No           HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{edc4193f-34ad-4d07-aa87-e3fdb89e3e76}
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@casalemedia[1].txt]
00139060  Cookie/Casalemedia                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@casalemedia[1].txt]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@atdmt[2].txt]
00139064  Cookie/Atlas DMT                   TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@atdmt[2].txt]
00139535  Application/Processor              HackTools           No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\W32 WORM INFO\smitRem\Process.exe
00139535  Application/Processor              HackTools           No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\W32 WORM INFO\smitRem\Process.exe
00139535  Application/Processor              HackTools           No        0         Yes            No           I:\DOWNLOADS\smitRem\smitRem.exe[smitRem/Process.exe]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@tribalfusion[1].txt]
00145731  Cookie/Tribalfusion                TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@tribalfusion[1].txt]
00162730  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@dist.belnk[2].txt]
00162730  Cookie/Belnk                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@dist.belnk[2].txt]

There wasn't a huge amount of cookies in there, but let's see if some cleaning will help.

While both Teatimer and SpyBot are closed:
Download ResetTeaTimer.bat to remove all entries set by TeaTimer (and preventing TeaTimer from restoring them upon reactivation).

http://downloads.subratam.org/ResetTeaTimer.bat
Alternate link:
http://www.bleepingcomputer.com/files/lonny/ResetTeaTimer.bat

Right click and save link as
Save it as resetteatimer.bat
Save it to your Desktop

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
5) Restart your computer.

Double click on resetteatimer.bat and wait for it to finish

Since it will not be needed again, delete ResetTeaTimer.bat after you run it.
When we are COMPLETELY finished with ALL your fixes, you can turn Teatimer back on again via SpyBot's tools resident page.


Download and scan each user profile with CCleaner:
http://www.ccleaner.com/download/builds
** Select to download the SLIM version.

**Because CCleaner removes everything in temp folders, if you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner.


1. Before first use, select Options > Advanced and UNCHECK
" Only delete files in Windows Temp folder older than 48 hours"
2. Then select the items you wish to clean up.
In the Windows Tab:
• Clean all entries in the "Internet Explorer" section except Cookies (if you want to keep those).
• Clean all the entries in the "Windows Explorer" section.
• Clean all entries in the "System" section.
• Clean all entries in the "Advanced" section.
• Clean any others that you choose.
In the Applications Tab:
• Clean all except cookies (if you want to keep those) in the Firefox/Mozilla section if you use it.
• Clean all in the Opera section if you use it.
• Clean Sun Java in the Internet Section.
• Clean any others that you choose.
3. Click the " Run Cleaner" button.
4. A pop up box will appear advising this process will permanently delete files from your system.
5. Click " OK" and it will scan and clean your system.
6. Click " exit" when done.
REBOOT.

Let's get an updated version of Hijackthis, so I can be sure I'm seeing all that HJT has to offer.

First, open Notepad and UNcheck wordwrap in the Format Menu.

Please download HJT Installer for version 2.02 from Here to your desktop.
If not available use this alternate link: Here

• Click the Download button. When the Trend Micro HJT install box appears, double click on the HJTInstall.exe. Click on Install.
• It will be installed by default here: C:\Program Files\Trend Micro\HijackThis.
• A shortcut to the application will also be placed on your Desktop.
• The program will open automatically after installation.
• You can double-click the icon that was placed on the Desktop to run subsequent HijackThis scans or you can use the icon inside the folder. The folder HijackThis is where you will find the HJT logs that you save. When you use the application to remove anything, you will also find the backup copies made by HJT inside this folder.
• The first time you open HijackThis, check the Main Menu button at the bottom center. When the main menu appears check the box "Show this window when I start HijackThis".
• Click on "Do a system scan and save logfile."
  When the log pops up in Notepad, copy and paste that file back here.
• DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
• Before closing HJT, please click on the AnalyzeThis button. "Analyze This" DOES NOT mean "Analyze My Log". You will need to post your log on the forum.
• Close the web page that appears and then close the program
• 
  
  

00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@com[2].txt]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@com[2].txt]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@com[2].txt]
00167642  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@com[2].txt]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@xiti[1].txt]
00167704  Cookie/Xiti                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@xiti[1].txt]
00167708  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@c2.gostats[3].txt]
00167708  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@c2.gostats[3].txt]
00167708  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@c2.gostats[2].txt]
00167708  Cookie/GoStats                     TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@c2.gostats[2].txt]
00167747  Cookie/Azjmp                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@azjmp[2].txt]
00167747  Cookie/Azjmp                       TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@azjmp[2].txt]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@statcounter[1].txt]
00167753  Cookie/Statcounter                 TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/data pro@statcounter[1].txt]
00167774  Cookie/web-stat                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@www.web-stat[2].txt]
00167774  Cookie/web-stat                    TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@www.web-stat[2].txt]
00173905  Cookie/Xmts                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@xmts[2].txt]
00173905  Cookie/Xmts                        TrackingCookie      No        0         Yes            No           C:\Documents and Settings\Owner\My Documents\temp folder FROM lACIE\My Documents\My Email Backups\Email Backup 06-21-2005.zip[Internet Explorer/Cookies/jan burgess@xmts[2].txt]
00188303  Application/MyWebSearch            HackTools           No        0         Yes            No           C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll
;===================================================================================================================================================================================

SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ~ý
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ~ý
;===================================================================================================================================================================================
;===================================================================================================================================================================================

HI-JACK LOG
 
Logfile of HijackThis v1.99.1

Scan saved at 7:50:26 AM, on 04/02/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\E_S00RP1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\slpservice.exe
C:\WINDOWS\system32\slpmonx.exe
C:\WINDOWS\system32\SAgent4.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\DeskPins\DeskPins.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\WINDOWS\system32\Tablet.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Hijackthis\HijackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart
 
Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web
 
Printing\hpswp_framework.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} -
 
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI
 
RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
 
Files\Java\jre1.6.0_05\bin\ssv.dll

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI
 
RoboForm\roboform.dll

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader
 
8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: DeskPins.lnk = C:\Program Files\DeskPins\DeskPins.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe

O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: &Lookup Meaning - res://C:\Program
 
Files\ieSpell\iespell.dll/LOOKUPMEANING.HTM
O8 - Extra context menu item: &Webshots Photo Search - res://C:\Program
 
Files\Webshots\Webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
O8 - Extra context menu item: Add to EverNote - res://C:\Program Files\EverNote\EverNote\enbar.dll/2000

O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI
 
RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel -
 
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI
 
RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Identities Editor - file://C:\Program Files\Siber Systems\AI
 
RoboForm\RoboFormComEditIdent.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI
 
RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI
 
RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Similar Pages - res://C:\Program
 
Files\Google\GoogleToolbar1.dll/cmsimilar.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
 
Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
 
Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program
 
Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program
 
Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program
 
Files\ieSpell\iespell.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber
 
Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program
 
Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber
 
Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program
 
Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Identities - {45DB34C3-955C-11D3-ABEF-444553540000} - file://C:\Program Files\Siber
 
Systems\AI RoboForm\RoboFormComEditIdent.html
O9 - Extra 'Tools' menuitem: Identities Editor - {45DB34C3-955C-11D3-ABEF-444553540000} -
 
file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComEditIdent.html

O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program
 
Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber
 
Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} -
 
file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program
 
Files\EverNote\EverNote\enbar.dll
O9 - Extra 'Tools' menuitem: Add to EverNote - {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - C:\Program
 
Files\EverNote\EverNote\enbar.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -
 
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -
 
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) -
 
http://www.pandasecurity.com/activescan/cabs/as2stubie.cab

O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) -
 
http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) -
 
http://www.shockwave.com/content/luxoramunrising/sis/mjolauncher.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
 
http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) -
 
http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} (Java Plug-in 1.5.0_04) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -

O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -
 
http://www.live365.com/players/play365.cab

O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) -
 
http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware
 
2007\aawservice.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program
 
Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program
 
Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -
 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -
 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. -
 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION -
 
C:\WINDOWS\system32\E_S00RP1.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common
 
Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common
 
Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
 
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SLPMONX - ProdEx Technologies - C:\WINDOWS\system32\slpservice.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION -
 
C:\WINDOWS\system32\SAgent4.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

 

Thanks for your help!

Thanks; here's the latest HJT log; did you wan to see the CCleaner log?

 

HiJAck 2.02 log:

Hi, Andrew,

No, I do not need to see the CCleaner log.

The HJT log looks good -- no active malware. There are some renmants that we can fix, however.

Please launch Hijackthis and place a checkmark by the following:

O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} (Java Plug-in 1.5.0_04) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -

Close windows except Hijackthis and click "Fix Checked". Close Hijackthis.

Reboot.

If your friend is still having problems with some programs, the only other thing I would suggest is reinstalling the programs.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

You may have already taken some of these steps, and depending on your current security, you may not need to implement all of these:

1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (by Checkpoint) has a free version http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

3. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

4. Do not use file sharing. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple. File sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known
vulnerabilities.

5. Before using or purchasing any Spyware/Malware protection/removal program, always check the following Rogue/Suspect Spyware Lists.
http://www.spywarewarrior.com/rogue_anti-spyware.htm
http://www.malwarebytes.org/database.php

6. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

7. Make sure you are using the most updated version of Java.
The current version is Java Runtime Environment (JRE) 6u5
You can go here to download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says " Java Runtime Environment (JRE) 6u5 allows end-users to run Java applications".

Click the link to download the Windows (Offline Installation) package: Save it, do not run it. When the download is complete, close the browser.

Remove all prior versions using Add/Remove Programs, and delete the Java folder in Program Files.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u5-windows-i586-p.exe to install the newest version.
Official JAVA Installation Instructions if needed.
Reboot.

8. Practice Safe Surfing with with TrendProtect by Trendmicro.
TrendProtect is a browser plugin that assigns a safety rating to domains listed in your search engine. TrendProtect also adds a new button to your browser's toolbar area. The icon and color of the button changes to indicate whether the page currently open is safe, unsafe, trusted, or unrated, or whether it contains unwanted content.

The following color codes are used by TrendProtect to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

9. You might consider installing SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html
It will:
Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
Restrict the actions of potentially unwanted sites in Internet Explorer.
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
Periodically check for updates.

10. Here are some helpful articles:
"So how did I get infected in the first place?"
by TonyKlein
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

11. This is an excellent resource for users of all levels. General computer maintenance as well as internet security is covered.
Rootkits for Dummies
(Paperback)
by Larry Stevenson (Author), Nancy Altholz (Author)

Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!