Here is my logfile - I don't know where to startsn Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:35:04 PM, on 10/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Mozilla Firefox\firefox.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\Administrator\Desktop\Scanner(.exe)\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll O3 - Toolbar: dkwqgnbe - {DC51F59F-D0BA-4CE7-8CDB-15ABF290546E} - C:\WINDOWS\dkwqgnbe.dll O3 - Toolbar: peltodgx - {0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - C:\WINDOWS\peltodgx.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup O4 - HKLM\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [28bae072] rundll32.exe "C:\WINDOWS\system32\tedxecrb.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab O20 - AppInit_DLLs: yxtmuw.dll O21 - SSODL: xgpsarbm - {6ED6D4EF-44FF-414D-86E2-03B22C0D5145} - C:\WINDOWS\xgpsarbm.dll O21 - SSODL: neksolda - {E5948172-3E31-4B6A-9410-EFD9792EC8C3} - C:\WINDOWS\neksolda.dll O21 - SSODL: onfwbsak - {969B147E-41A9-45B8-BFBF-8DA229350FDE} - C:\WINDOWS\onfwbsak.dll O21 - SSODL: rwlfsdmk - {81A9EEB3-7D6E-4DE5-A0ED-E2475C093CEC} - C:\WINDOWS\rwlfsdmk.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: dkab_device - Dell - C:\WINDOWS\system32\DKabcoms.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe -- End of file - 6685 bytes
Hi 4runnerda From your hijackthis log, you are infected. Are there any symptoms? Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. Best Regards
It all started when my PC got several popups stating that I was infected and to " click yes" to run a virus program - I didn't. But by then it was too late - i had several new shortcuts on my desktop - pop up blockers, virus scans, etc. and in my system tray instead of the time, it displayed "You are Infected with a virus" I am having to run in SAfe mode. Thanks in Advance for your help ComboFix 08-10-08.02 - Administrator 2008-10-08 21:17:26.1 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.121 [GMT -5:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Owner\Application Data\EHAES8121.dll C:\Documents and Settings\Owner\Application Data\EHBase648121.dll C:\Documents and Settings\Owner\Application Data\EHTLEncryption4401.dll C:\Documents and Settings\Owner\Application Data\EHTLStreams4401.dll C:\Documents and Settings\Owner\Application Data\EHZComp8121.dll C:\Documents and Settings\Owner\Application Data\EHZStream8121.dll C:\Documents and Settings\Owner\Application Data\MBSDeclarePlugin4707.dll C:\Documents and Settings\Owner\Application Data\MBSRegistrationPlugin4987.dll C:\Documents and Settings\Owner\Application Data\MBSWinPlugin5046.dll C:\Documents and Settings\Owner\Application Data\nphost1101.dll C:\Documents and Settings\Owner\Application Data\rbap550.dll C:\Documents and Settings\Owner\Application Data\RBInternetEncodings550.dll C:\Documents and Settings\Owner\Application Data\RBShell550.dll C:\Documents and Settings\Owner\Application Data\RBSSLSocket550.dll C:\Documents and Settings\Owner\Application Data\RBXML550.dll C:\Documents and Settings\Owner\Application Data\V4RB.dll C:\WINDOWS\dkwqgnbe.dll C:\WINDOWS\eepa.exe C:\WINDOWS\evqb.exe C:\WINDOWS\fbxrqtwn.exe C:\WINDOWS\fkebanrw.exe C:\WINDOWS\hosts C:\WINDOWS\IE4 Error Log.txt C:\WINDOWS\onfwbsak.dll C:\WINDOWS\peltodgx.dll C:\WINDOWS\rwlfsdmk.dll C:\WINDOWS\system32\aGjSAcfe.ini C:\WINDOWS\system32\aGjSAcfe.ini2 C:\WINDOWS\system32\ajggjwbf.dll C:\WINDOWS\system32\brcexdet.ini C:\WINDOWS\system32\ddcbCRij.dll C:\WINDOWS\system32\ddeokyeg.ini C:\WINDOWS\system32\efcASjGa.dll C:\WINDOWS\system32\ejmbqf.dll C:\WINDOWS\system32\geykoedd.dll C:\WINDOWS\system32\oVwyHRqr.ini C:\WINDOWS\system32\oVwyHRqr.ini2 C:\WINDOWS\system32\rqRHywVo.dll C:\WINDOWS\system32\TDSSerrors.log C:\WINDOWS\system32\tdssservers.dat C:\WINDOWS\system32\yaanrkwa.dll C:\WINDOWS\system32\yxtmuw.dll C:\WINDOWS\xgpsarbm.dll . ((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 ))))))))))))))))))))))))))))))) . 2008-10-07 23:20 . 2008-10-07 23:20 <DIR> d-------- C:\Program Files\TeaTimer (Spybot - Search & Destroy) 2008-10-07 23:20 . 2008-10-07 23:20 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy) 2008-10-07 20:11 . 2008-10-07 20:11 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-10-07 20:10 . 2008-10-07 20:12 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6 2008-10-07 06:30 . 2008-10-07 06:30 <DIR> d-------- C:\WINDOWS\CRYSTAL 2008-10-07 06:30 . 2008-10-07 06:30 <DIR> d-------- C:\Program Files\Seagate Software 2008-10-04 09:26 . 2008-10-07 20:10 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-03 23:37 . 2005-09-08 16:26 1,406,112 --a------ C:\WINDOWS\system32\FPSPR70.ocx 2008-10-03 23:37 . 2001-11-20 11:29 571,096 --a------ C:\WINDOWS\system32\Cal32x30.ocx 2008-10-03 23:37 . 2002-01-03 11:02 337,672 --a------ C:\WINDOWS\system32\SSTree.ocx 2008-10-03 23:37 . 2000-07-15 00:00 311,296 --a------ C:\WINDOWS\system32\MSDBRPT.DLL 2008-10-03 23:37 . 2000-12-06 00:00 209,608 --a------ C:\WINDOWS\system32\tabctl32.ocx 2008-10-03 23:37 . 2001-05-30 16:42 194,248 --a------ C:\WINDOWS\system32\ssscrl30.ocx 2008-10-03 23:37 . 2001-05-30 16:43 181,960 --a------ C:\WINDOWS\system32\sssplt30.ocx 2008-10-03 23:37 . 2001-05-30 16:41 153,288 --a------ C:\WINDOWS\system32\ssresz30.ocx 2008-10-03 23:36 . 2008-10-03 23:36 <DIR> d-------- C:\Program Files\Wiley 2008-10-03 19:25 . 2008-10-03 19:25 <DIR> d-------- C:\Program Files\Apple Software Update 2008-10-03 19:20 . 2008-10-03 19:21 <DIR> d-------- C:\Program Files\iTunes 2008-10-03 19:20 . 2008-10-03 19:20 <DIR> d-------- C:\Program Files\iPod 2008-10-03 19:20 . 2008-10-03 19:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-03 19:13 . 2008-10-03 19:13 <DIR> d-------- C:\Program Files\Bonjour 2008-10-03 19:08 . 2008-10-03 19:11 <DIR> d-------- C:\Program Files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-08 04:38 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-08 04:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-10-04 19:11 --------- d-----w C:\Documents and Settings\Owner\Application Data\SiteAdvisor 2008-10-04 00:09 --------- d-----w C:\Program Files\Common Files\Apple 2008-10-03 23:53 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-10-03 23:51 --------- d-----w C:\Program Files\Common Files\Adobe 2008-10-03 23:50 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-03 14:49 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\SiteAdvisor 2008-09-14 02:22 --------- d-----w C:\Program Files\McAfee 2008-09-06 21:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\AdobeUM 2007-03-25 21:50 23,520 -c--a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2006-07-24 02:41 26,624 -c-ha-w C:\Documents and Settings\Owner\Application Data\EHGuid.dll 2006-07-24 02:41 245,760 -c-ha-w C:\Documents and Settings\Owner\Application Data\HttpProxyPlugin.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "McAfee QuickClean Imonitor"="C:\Program Files\McAfee\McAfee QuickClean\Plguni.exe" [2004-08-25 94208] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976] "MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-19 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 126976] "Dell AIO Printer A940"="C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2003-08-06 114741] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "iRiver Updater"="\Updater.exe" [2004-07-01 212992] "D-Link AirPlus XtremeG"="C:\Program Files\D-Link\AirPlus XtremeG\AirPlusCFG.exe" [2004-10-27 987136] "ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-10-14 45056] "MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976] "MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe" [2005-03-23 1111040] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 C:\WINDOWS\BCMSMMSG.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=ejmbqf.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Shareaza\\Shareaza.exe"= "C:\\WINDOWS\\system32\\LEXPPS.EXE"= "C:\\Program Files\\AIM\\aim.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Microsoft SQL Server\\MSSQL\\Binn\\sqlservr.exe"= "C:\\WINDOWS\\system32\\DKabcoms.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:Shareaza "6346:UDP"= 6346:UDP:Shareaza S3 A5AGU;D-Link USB Wireless Network Adapter Service;C:\WINDOWS\system32\DRIVERS\A5AGU.sys [2004-10-06 283904] S3 ATHFMWDL;D-Link predator Bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys [2004-10-04 43392] S3 dkab_device;dkab_device;C:\WINDOWS\system32\DKabcoms.exe [2005-05-23 487424] . Contents of the 'Scheduled Tasks' folder 2008-10-04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-09-15 C:\WINDOWS\Tasks\McDefragTask.job - C:\WINDOWS\system32\defrag.exe [2004-08-04 02:56] 2008-10-01 C:\WINDOWS\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] . - - - - ORPHANS REMOVED - - - - BHO-{622DC620-E7AA-4A5A-A8A5-5E79745CAE61} - C:\WINDOWS\system32\rqRHywVo.dll BHO-{674855C3-B0B1-4413-9BB4-BFA6A9B5257B} - C:\WINDOWS\system32\iifgEuRl.dll BHO-{78F2D3BD-ADAC-4BB1-8503-E94279050E59} - C:\WINDOWS\system32\efcASjGa.dll BHO-{8e3f9ef7-7478-4c40-b06b-e6fc1baed8c1} - C:\WINDOWS\system32\ejmbqf.dll Toolbar-{DC51F59F-D0BA-4CE7-8CDB-15ABF290546E} - C:\WINDOWS\dkwqgnbe.dll Toolbar-{0FA15166-39DA-4DAB-9B1A-0DDDBACA8BD5} - C:\WINDOWS\peltodgx.dll HKCU-Run-Sonic RecordNow! - (no file) HKCU-Run-Aim6 - (no file) HKLM-Run-tgcmd - C:\Program Files\Support.com\bin\tgcmd.exe HKLM-Run-ISUSPM - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe HKLM-Run-28bae072 - C:\WINDOWS\system32\geykoedd.dll ShellExecuteHooks-{674855C3-B0B1-4413-9BB4-BFA6A9B5257B} - C:\WINDOWS\system32\iifgEuRl.dll SSODL-xgpsarbm-{6ED6D4EF-44FF-414D-86E2-03B22C0D5145} - C:\WINDOWS\xgpsarbm.dll SSODL-neksolda-{E5948172-3E31-4B6A-9410-EFD9792EC8C3} - C:\WINDOWS\neksolda.dll . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\w8f1ev25.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-08 21:33:58 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MpfSrv.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Dell AIO Printer A940\dlbabmon.exe C:\Updater.exe C:\PROGRA~1\McAfee\MSC\mcuimgr.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-10-08 21:43:39 - machine was rebooted [Owner] ComboFix-quarantined-files.txt 2008-10-09 02:43:30 Pre-Run: 18,650,562,560 bytes free Post-Run: 18,960,769,024 bytes free 217 --- E O F --- 2008-09-10 08:03:20
Hey 4runnerda Please download Superantispyware Free and install it. Follow the prompts and reboot if required. Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware... Configuring SuperAntispyware • Click on Preferences. • In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run. • Navigate to the tab Scanning Control. • Make sure only these boxes are checked: Code: Close browsers before scanning Scan for tracking cookies Terminate memory threats before quarantining Scan Alternate Data Streams Use Kernel Direct File Access (recommended) Use Kernel Direct Registry Access (recommended) Use Direct Disk Access (recommended) • Click on Close. Updating SuperAntispyware • At the main window, click on Check for Updates.... • Wait for SuperAntispyware to be fully updated. Scanning Time • Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode. • Launch SuperAntispyware. • At the main window, click on Scan your Computer.... • Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next. • Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items. • Reboot your computer. Post A Log • Launch SuperAntispyware • Click on Preferences • Navigate to the tab Statistics/Logs. • Choose the latest scan log, and the click on View Log.... • Copy and paste the contents of the log here in your next post. Best Regards
