I have been trying to get rid of this for a long time. I run Spybot and find Zlob.DNSChanger and Zlob.DNSChanger.Rtk. I select FixIt and Spybot says it has fixed it. I run Sypbot again and it is still there. I have MacAfee but it never finds it. Does anyone have any suggestions? I would really be greatful.
Hey texcutter First, please then reboot your computer into Safe Mode by doing the following: • Restart your computer • After pressing the power button, repeatedly tap the F8 key. • Instead of Windows loading as normal, the Advanced Options Menu should appear; • Select the first option, to run Windows in Safe Mode, then press Enter. • Choose the administrator's account. In safe mode, please scan with Spybot and remove all detected items. Next follow steps #3-6 on here: http://forums.afterdawn.com/thread_view.cfm/370698#2210178 After that, please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file. Rename HijackThis(.exe) to scanner(.exe). Next, run scanner(.exe). A window will pop up. • Click on the button which says Main Menu, then Do a system scan and save a logfile. • Please wait for the scan to be completed. • After the scan has completed, a text window will pop up. Please post the contents of this window here. This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved. NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer. Best Regards
Thank you very much for your help. I have enough knowledge about computers to get myself in trouble. But, I followed your instructions and everything went smoothly. Zlob is gone!! Thank you again for taking the time to help me. Makes me feel good that there are good helpful people out there. Tex Cutter
I tried this and it still does not work for me. I followed the steps exactly, but did notice that there was one error in during ther smitfraudfix process, but it just continued.
Hi madnessx7 Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. Best Regards
Hi this is the log that you had mentioned. I noticed the clock time did not change back. Are there any other steps? Thanks in advance for you help on this matter. ComboFix 08-10-27.03 - vdoan 2008-10-27 22:39:19.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1083 [GMT -7:00] Running from: G:\Combo-Fix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\WINDOWS\system32\kdwre.exe ----- BITS: Possible infected sites ----- hxxp://us-hqwsus1 . ((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-28 ))))))))))))))))))))))))))))))) . 2008-10-27 19:02 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-10-27 19:02 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-27 19:02 . 2008-09-08 22:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-27 19:02 . 2008-10-01 14:51 87,552 --a------ C:\WINDOWS\system32\VACFix.exe 2008-10-27 19:02 . 2008-05-18 20:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-10-27 19:02 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-10-27 19:02 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-10-27 19:02 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-10-27 13:50 . 2008-10-27 13:50 <DIR> d-------- C:\Documents and Settings\zeus\Application Data\Helios 2008-10-27 12:49 . 2008-10-27 19:09 5,244 --a------ C:\WINDOWS\system32\tmp.reg 2008-10-26 23:05 . 2008-10-26 23:05 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-26 23:05 . 2008-10-26 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-26 21:57 . 2008-10-27 19:01 393 --a------ C:\WINDOWS\wininit.ini 2008-10-26 20:51 . 2008-10-26 20:51 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys 2008-10-24 11:24 . 2007-10-17 14:27 172,032 --a------ C:\WINDOWS\system32\AeXSWDInstSvc.exe 2008-10-24 09:31 . 2008-10-15 09:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-22 11:06 . 2008-09-08 03:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-22 11:05 . 2008-08-14 03:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-22 11:05 . 2008-08-14 03:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-22 11:05 . 2008-08-14 02:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-22 11:05 . 2008-08-14 02:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-22 11:05 . 2008-09-15 05:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-22 10:18 . 2008-10-22 10:18 <DIR> d-------- C:\Program Files\Beyond Compare 3 2008-10-22 10:18 . 2008-10-22 10:18 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Scooter Software 2008-10-22 09:06 . 2008-10-22 09:06 <DIR> d-------- C:\Program Files\WebEx 2008-10-22 09:06 . 2008-10-22 09:06 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Productivity Tools 2008-10-18 14:20 . 2008-10-18 14:20 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-10-18 13:47 . 2008-10-18 13:47 <DIR> d-------- C:\Program Files\Amazon 2008-10-18 13:47 . 2008-10-18 13:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon 2008-10-17 10:56 . 2008-04-13 11:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-10-17 10:56 . 2008-04-13 11:45 32,128 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-10-17 10:56 . 2008-04-13 17:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2008-10-17 10:56 . 2008-04-13 17:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2008-10-17 10:56 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-10-17 10:56 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-10-17 10:56 . 2008-04-13 11:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-10-17 10:56 . 2008-04-13 11:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-10-16 13:04 . 2008-10-22 09:06 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\webex 2008-10-15 09:14 . 2006-06-28 11:54 <DIR> d-------- C:\Documents and Settings\altiristms\workspace 2008-10-15 09:14 . 2006-04-14 15:40 <DIR> d---s---- C:\Documents and Settings\altiristms\UserData 2008-10-15 09:14 . 2006-04-14 15:24 <DIR> d-------- C:\Documents and Settings\altiristms\Bluetooth Software 2008-10-15 09:14 . 2006-06-28 11:54 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\TextPad 2008-10-15 09:14 . 2006-04-14 14:26 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\Sonic 2008-10-15 09:14 . 2006-04-17 13:18 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\Intel 2008-10-15 09:14 . 2008-10-09 18:56 <DIR> d-------- C:\Documents and Settings\altiristms\Application Data\ATI 2008-10-15 09:14 . 2008-10-21 08:32 <DIR> d-------- C:\Documents and Settings\altiristms 2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\iTunes 2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\iPod 2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Program Files\Bonjour 2008-10-14 21:33 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-14 21:33 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll 2008-10-14 21:33 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2008-10-14 19:47 . 2008-10-14 19:47 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\acccore 2008-10-14 19:46 . 2008-10-22 12:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-10-14 19:46 . 2008-10-14 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\acccore 2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Program Files\Common Files\AOL 2008-10-14 19:45 . 2008-10-14 19:46 <DIR> d-------- C:\Program Files\AIM6 2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-10-14 19:45 . 2008-10-14 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL 2008-10-14 19:45 . 2008-10-14 19:46 368 --ah----- C:\IPH.PH 2008-10-13 15:00 . 2008-10-13 15:00 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Helios 2008-10-13 13:06 . 2008-10-13 13:06 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-10-13 13:04 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-10-13 13:03 . 2008-10-26 22:39 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-13 13:03 . 2008-10-13 13:03 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-13 13:03 . 2008-10-13 13:03 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-10-13 13:01 . 2008-10-13 13:01 <DIR> dr-h----- C:\MSOCache 2008-10-13 12:49 . 2008-10-13 12:49 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\DAEMON Tools 2008-10-13 12:49 . 2008-10-13 12:50 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-10-13 12:33 . 2008-10-13 12:33 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\InterVideo 2008-10-10 11:01 . 2008-10-10 11:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ATI 2008-10-09 18:59 . 2008-10-09 18:59 <DIR> d-------- C:\Program Files\Common Files\InterVideo 2008-10-04 06:09 . 2008-10-04 06:09 <DIR> d-------- C:\Program Files\Digital Line Detect 2008-10-04 06:08 . 2008-10-04 06:08 <DIR> d-------- C:\Program Files\NetWaiting 2008-10-04 06:08 . 2008-10-04 06:08 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\InstallShield 2008-10-04 06:07 . 2008-10-09 18:39 <DIR> d-------- C:\Program Files\ThinkVantage Fingerprint Software 2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\RSA SecurID Token Common 2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\Common Files\ThinkVantage Fingerprint Software 2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Program Files\Common Files\SPBA 2008-10-04 06:07 . 2008-10-04 06:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\UIB 2008-10-04 05:41 . 2008-10-04 05:41 <DIR> d-------- C:\Program Files\Common Files\Lenovo 2008-10-04 05:38 . 2008-10-09 18:42 <DIR> d-------- C:\swshare 2008-10-03 19:07 . 2008-10-03 19:07 <DIR> d-------- C:\WINDOWS\system32\(null) 2008-10-03 19:06 . 2007-02-18 22:56 21,376 --a------ C:\WINDOWS\system32\drivers\psadd.sys 2008-10-03 16:17 . 2008-10-03 16:17 <DIR> d-------- C:\Program Files\Google 2008-10-03 15:46 . 2008-10-03 15:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip 2008-10-03 15:40 . 2008-10-03 15:42 <DIR> d-------- C:\Program Files\SecureCRT 2008-10-03 15:23 . 2008-10-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-10-03 15:22 . 2008-10-03 15:23 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-03 15:21 . 2008-10-03 15:21 <DIR> d-------- C:\Program Files\NOS 2008-10-03 15:21 . 2008-10-03 15:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS 2008-10-03 15:20 . 2008-10-03 15:20 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-03 15:19 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Apple Computer 2008-10-03 15:15 . 2008-10-03 15:15 <DIR> d-------- C:\Program Files\QuickTime 2008-10-03 15:15 . 2008-10-14 21:32 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-10-03 15:15 . 2008-10-14 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-10-03 15:14 . 2008-10-03 15:14 <DIR> d-------- C:\Program Files\Apple Software Update 2008-10-03 15:14 . 2008-10-03 15:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-10-03 14:30 . 2008-10-03 14:30 <DIR> d-------- C:\Program Files\Common Files\Deterministic Networks 2008-10-03 14:30 . 2008-10-03 14:31 1,592 --a------ C:\WINDOWS\VPNInstall.MIF 2008-10-03 14:10 . 2008-10-03 10:41 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-10-03 14:10 . 2007-04-17 02:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-10-03 14:10 . 2007-03-07 22:10 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-10-03 14:10 . 2008-08-26 00:24 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-10-03 14:10 . 2008-08-26 00:24 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-10-03 14:10 . 2008-08-26 00:24 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-10-03 14:10 . 2008-08-26 00:24 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-10-03 14:10 . 2008-08-26 00:24 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-10-03 14:10 . 2008-08-25 01:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-10-03 13:37 . 2008-10-26 20:02 <DIR> d-------- C:\Program Files\TextPad 5 2008-10-03 10:36 . 2008-10-03 10:36 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-10-03 10:34 . 2008-10-03 10:34 <DIR> d-------- C:\Documents and Settings\vdoan\Application Data\Yahoo! 2008-10-03 10:14 . 2008-10-03 11:44 <DIR> d-------- C:\Program Files\Yahoo! 2008-10-03 10:14 . 2008-10-03 10:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\en 2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\system32\bits 2008-10-03 10:10 . 2008-10-03 10:10 <DIR> d-------- C:\WINDOWS\l2schemas 2008-10-03 10:08 . 2008-10-03 10:11 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-10-03 09:58 . 2008-04-13 17:12 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll 2008-10-02 09:40 . 2008-10-02 09:40 <DIR> d-------- C:\WINDOWS\SchCache 2008-10-02 09:21 . 2008-10-02 09:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-02 08:43 . 2008-10-02 08:43 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy) 2008-10-02 08:15 . 2008-10-02 08:15 110,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-10-02 08:15 . 2008-10-02 08:15 48,768 --a------ C:\WINDOWS\system32\S32EVNT1.DLL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-27 06:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-10-27 04:21 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-27 04:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-10-24 18:23 --------- d-----w C:\Program Files\Perforce 2008-10-18 20:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-10 01:59 --------- d-----w C:\Program Files\InterVideo 2008-10-10 01:58 --------- d-----w C:\Program Files\ATI Technologies 2008-10-10 01:56 --------- d-----w C:\Documents and Settings\zeus\Application Data\ATI 2008-10-10 01:56 --------- d-----w C:\Documents and Settings\TSC\Application Data\ATI 2008-10-10 01:56 --------- d-----w C:\Documents and Settings\athena\Application Data\ATI 2008-10-04 13:05 --------- d-----w C:\Program Files\Lenovo 2008-10-02 16:47 --------- d-----w C:\Program Files\Symantec AntiVirus 2008-10-02 15:15 --------- d-----w C:\Program Files\Symantec 2008-10-02 15:15 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-10-02 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-10-02 15:00 --------- d-----w C:\Program Files\Java 2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-29 17:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe 2008-08-29 16:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll 2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-25 08:45 16,384 ------w C:\WINDOWS\PWMBTHLP.EXE 2008-08-14 10:09 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:33 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2005-11-15 22:32 3,638 ----a-r C:\Program Files\Common Files\Altiris_Icon.ico 2008-10-16 20:04 27,976 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcdec.dll 2008-10-16 20:04 125,848 ----a-w C:\Program Files\mozilla firefox\plugins\atgpcext.dll 2008-10-16 20:04 46,408 ----a-w C:\Program Files\mozilla firefox\plugins\atmccli.dll 2008-10-16 20:04 98,712 ----a-w C:\Program Files\mozilla firefox\plugins\ieatgpc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] "PTOneClick"="C:\Program Files\WebEx\Productivity Tools\ptoneclk.exe" [2008-08-03 165192] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BGInfo"="C:\windows\bginfo.exe" [2004-09-22 741421] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [2002-10-08 40960] "TPHOTKEY"="C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe" [2008-03-24 68464] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-15 110592] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-15 512000] "EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2005-11-17 237568] "PWRMGRTR"="C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-08-25 331776] "BLOG"="C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-08-25 208896] "LPManager"="C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe" [2006-01-25 106496] "TPKMAPHELPER"="C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 864256] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-12-15 925696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 52840] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-03-14 125632] "AeXAgentLogon"="C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" [2008-01-30 143360] "SgeEcView"="C:\Program Files\Utimaco\SafeGuard Easy\Ecview.exe" [2007-09-05 24576] "EdWizard"="C:\Program Files\Utimaco\SafeGuard Easy\EdWizard.exe" [2007-09-05 245760] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "TVT Scheduler Proxy"="C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "TP4EX"="tp4ex.exe" [2005-10-17 C:\WINDOWS\system32\TP4EX.exe] "TpShocks"="TpShocks.exe" [2005-11-07 C:\WINDOWS\system32\TpShocks.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2005-11-01 581693] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-10-04 50688] Monitor Apache Servers.lnk - D:\devtools\Apache Group\Apache2\bin\ApacheMonitor.exe [2008-01-17 41042] VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2008-10-03 6144] WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2004-02-11 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2008-06-24 17:31 95496 C:\WINDOWS\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 16:37 34344 C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2008-03-17 16:02 34080 C:\Program Files\Lenovo\HOTKEY\tphklock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NotLog] 2002-01-22 15:28 110592 C:\WINDOWS\system32\SGLogEx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SGLogNotification] 2005-03-31 11:27 69632 C:\WINDOWS\system32\SGLogNotification.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= AMINIT.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli psqlpwd [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0] "Script"=\\ariba.com\SysVol\ariba.com\scripts\zeus_change.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0] "Script"=\\ariba.com\SysVol\ariba.com\scripts\InstallHQGrcDat.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\2\0] "Script"=\\ariba.com\SysVol\ariba.com\scripts\Pull_Altiris.bat [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\3\0] "Script"=AddToLocalAdmins.bat [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\devtools\\ora92\\Apache\\Apache\\Apache.exe"= "D:\\devtools\\Apache Group\\Apache2\\bin\\Apache.exe"= "D:\\devtools\\j2sdk1.4.2_12\\bin\\javaw.exe"= "D:\\devtools\\bea814\\jdk142_05\\bin\\java.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6129:TCP"= 6129:TCP:10.0.0.0/255.0.0.0,192.168.0.0/255.255.0.0:Enabledameware R0 AES-256;AES-256;C:\WINDOWS\system32\DRIVERS\AES256.SYS [2007-09-05 19712] R0 SgeFlt;SgeFlt;C:\WINDOWS\system32\DRIVERS\SGEFLT.SYS [2007-09-05 62720] R0 Shockprf;Shockprf;C:\WINDOWS\system32\drivers\Shockprf.sys [2005-11-30 85760] R1 FSLX;FSLX;C:\WINDOWS\system32\drivers\fslx.sys [2008-02-01 191616] R1 ShockMgr;ShockMgr;C:\WINDOWS\system32\drivers\ShockMgr.sys [2005-06-20 4736] R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2008-08-25 4442] R2 agnwifi;AT&T Wi-Fi Support Driver;C:\WINDOWS\system32\DRIVERS\agnwifi.sys [2006-03-17 19328] R2 OracleServiceARIBA;OracleServiceARIBA;c:\devtools\ora92\bin\ORACLE.EXE ARIBA [ ] R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-08-25 94208] R2 smihlp;SMI Helper Driver (smihlp);C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [2008-06-24 12560] S2 OracleOraHome92Agent;OracleOraHome92Agent;c:\devtools\ora92\bin\agntsrvc.exe [2002-04-26 28944] S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752] S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-26 27904] S3 OracleOraHome92ClientCache;OracleOraHome92ClientCache;c:\devtools\ora92\BIN\ONRSD.EXE [2002-04-26 242328] S3 OracleOraHome92HTTPServer;OracleOraHome92HTTPServer;c:\devtools\ora92\Apache\Apache\apache.exe [2002-04-18 4096] S3 OracleOraHome92SNMPPeerEncapsulator;OracleOraHome92SNMPPeerEncapsulator;c:\devtools\ora92\BIN\ENCSVC.EXE [2002-02-13 187392] S3 OracleOraHome92SNMPPeerMasterAgent;OracleOraHome92SNMPPeerMasterAgent;c:\devtools\ora92\BIN\AGNTSVC.EXE [2002-02-13 254464] . Contents of the 'Scheduled Tasks' folder 2008-10-11 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-10-28 C:\WINDOWS\Tasks\PMTask.job - C:\PROGRA~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-08-25 01:45] . - - - - ORPHANS REMOVED - - - - ShellIconOverlayIdentifiers-{ba930330-a721-11d3-a7b9-00500464ee16} - Sgedrse.Dll ShellIconOverlayIdentifiers-{2030D939-54A7-4fea-9B06-49EA77EFC87F} - Sgedrse.Dll HKCU-Run-Aim6 - (no file) HKLM-Run-C:\WINDOWS\system32\kdouq.exe - C:\WINDOWS\system32\kdouq.exe HKLM-Run-C:\WINDOWS\system32\kdwre.exe - C:\WINDOWS\system32\kdwre.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\vdoan\Application Data\Mozilla\Firefox\Profiles\tmi48ci6.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://web.ariba.com/ FF -: plugin - C:\Documents and Settings\vdoan\Application Data\Mozilla\Firefox\Profiles\tmi48ci6.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll FF -: plugin - c:\program files\mozilla firefox\plugins\np_gp.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 22:46:18 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** "ImagePath"="\??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\D:] [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OracleOraHome92PagingServer] "ImagePath"="c:\devtools\ora92/bin/pagntsrv.exe" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OracleOraHome92TNSListener] "ImagePath"="c:\devtools\ora92\BIN\TNSLSNR " . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe D:\devtools\Apache Group\Apache2\bin\Apache.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\DWRCS.EXE C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE C:\devtools\ora92\bin\omtsreco.exe C:\devtools\ora92\bin\TNSLSNR.EXE C:\devtools\ora92\bin\oracle.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\Utimaco\SafeGuard Easy\SgeCtl.exe C:\WINDOWS\system32\SgLogPlayer.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe C:\WINDOWS\system32\TPHDEXLG.exe C:\WINDOWS\system32\TpKmpSvc.exe C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Utimaco\SafeGuard Easy\WksCfgSrv.exe D:\devtools\Apache Group\Apache2\bin\Apache.exe C:\Program Files\Lenovo\System Update\SUService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\DWRCST.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe C:\Program Files\Lenovo\ZOOM\TpScrex.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Symantec AntiVirus\DoScan.exe C:\Program Files\WebEx\Productivity Tools\ptSrv.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\PROGRA~1\ThinkPad\BLUETO~1\BTSTAC~1.EXE C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-10-27 22:49:29 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-28 05:49:21 Pre-Run: 13,675,393,024 bytes free Post-Run: 13,721,595,904 bytes free 377 --- E O F --- 2008-10-24 16:37:02
Hey madnessx7 Please download Malwarebytes Anti-Malware and install it. Follow the prompts and reboot if required. Launch Malwarebytes either by running C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe or double-click the Malwarebytes' Anti-Malware shortcut on your Desktop. Configuring Malwarebytes • Click on the tab Settings. • Make sure only these boxes are checked: Code: Terminate Internet Explorer Automatically save and display logfile after removal Always scan memory objects Always scan registry objects Always scan filesystem Always scan extra and heuristics objects Updating Malwarebytes • Click on the tab Update. • Press the button Check for Updates • Wait for Malwarebytes to be fully updated. Scanning Time • Click on the tab Scanner. • Check Perform full scan and click on Scan • Wait for the scan to complete, and then click on Show Results. • Make sure all items are checked, then click on Remove Selected. **If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If you are asked to restart the computer, please do so immediately. Post A Log • A text box will pop up after the removal process is over. Post the contents of the text here. • If no text box pops up, launch Malwarebytes, and click on the tab Logs. • The logs will appear as mbam-log-*date-*time.txt. Select the latest one, and then click on Open. • Post the log here. Best Regards
Here is the post that was displayed. Thanks again. Malwarebytes' Anti-Malware 1.30 Database version: 1335 Windows 5.1.2600 Service Pack 3 10/29/2008 8:16:38 AM mbam-log-2008-10-29 (08-16-38).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 151498 Time elapsed: 1 hour(s), 4 minute(s), 25 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\sexvid (Trojan.DNSChanger) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
