HELP Antivirus 2009 AGAIN

View previous topic View next topic Go down

HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 28th December 2008, 4:35 pm

It has disabled my virus software and sound this time.....how do I keep getting this??? Popups are horrible!


Here is my HijackThis log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34, on 2008-12-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\kbiggerstaff\Desktop\hijackgpthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Webtools\webtools.dll
O2 - BHO: (no name) - {6101022B-EC69-4AD3-A383-9013EFA2A7D0} - C:\WINDOWS\system32\efccYRlI.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnooLDV.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: {59a976f7-cb9a-f9c9-d2a4-9a197ead45dc} - {cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95} - C:\WINDOWS\system32\yddwiq.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [0cbfd446] rundll32.exe "C:\WINDOWS\system32\kkwghuok.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tes.monroe.k12.ky.us
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\Software\..\Telephony: DomainName = monroe.ketsds.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O20 - AppInit_DLLs: yddwiq.dll
O20 - Winlogon Notify: opnooLDV - C:\WINDOWS\SYSTEM32\opnooLDV.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 8570 bytes

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 28th December 2008, 4:56 pm

Hello.


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
    O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Webtools\webtools.dll
    O2 - BHO: (no name) - {6101022B-EC69-4AD3-A383-9013EFA2A7D0} - C:\WINDOWS\system32\efccYRlI.dll
    O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnooLDV.dll
    O2 - BHO: {59a976f7-cb9a-f9c9-d2a4-9a197ead45dc} - {cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95} - C:\WINDOWS\system32\yddwiq.dll
    O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
    O4 - HKLM\..\Run: [0cbfd446] rundll32.exe "C:\WINDOWS\system32\kkwghuok.dll",b
    O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
    O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
    O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
    O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
    O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
    O17 - HKLM\Software\..\Telephony: DomainName = monroe.ketsds.net
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
    See my note below on these 017 items

    O20 - AppInit_DLLs: yddwiq.dll
    O20 - Winlogon Notify: opnooLDV - C:\WINDOWS\SYSTEM32\opnooLDV.dll


  • Press "Fix Checked"
  • Close Hijack This.


Note: If monroe.ketsds.net is not your ISP and you do not know the domain, fix the item.


Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 28th December 2008, 10:34 pm

Malwarebytes' Anti-Malware 1.31
Database version: 1500
Windows 5.1.2600 Service Pack 2

12/14/2008 10:44:59 AM
mbam-log-2008-12-14 (10-44-59).txt

Scan type: Quick Scan
Objects scanned: 15068
Time elapsed: 2 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 28th December 2008, 10:35 pm

sorry --- wrong log...will post again

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 28th December 2008, 10:51 pm

Okay.
Standing by.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 28th December 2008, 11:36 pm

Malwarebytes' Anti-Malware 1.31
Database version: 1500
Windows 5.1.2600 Service Pack 2

2008-12-28 17:30:57
mbam-log-2008-12-28 (17-30-56).txt

Scan type: Quick Scan
Objects scanned: 64893
Time elapsed: 16 minute(s), 39 second(s)

Memory Processes Infected: 4
Memory Modules Infected: 4
Registry Keys Infected: 33
Registry Values Infected: 8
Registry Data Items Infected: 2
Folders Infected: 4
Files Infected: 23

Memory Processes Infected:
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe (Adware.Agent) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe (Trojan.Vundo) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\efccYRlI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kkwghuok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\opnooLDV.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnooldv (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Typelib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{80ef304a-b1c4-425c-8535-95ab6f1eefb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_MyJavaCore.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\extra antivir (Rogue.Extraantivir) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0cbfd446 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\speedrunner (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfkg6wip (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twain (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efccyrli -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efccyrli -> Delete on reboot.

Folders Infected:
C:\Program Files\Webtools (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\efccYRlI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\IlRYccfe.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IlRYccfe.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kkwghuok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kouhgwkk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\opnooLDV.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\__A.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\__B.tmp (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\IHKN2D2H\155[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\J1BGLFVG\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\J1BGLFVG\157[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner\config.cfg (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner\SRUninstall.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\prunnet.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccDWNHY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\xpre.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\winvsnet.tmp (Rogue.Installer) -> Quarantined and deleted successfully.

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 28th December 2008, 11:43 pm

Hello.
That should of taken the weight off, one last lookaround.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:17 am

-Virus Scan is still disabled and Popups here and there......

Here is the CmboFix log


ComboFix 08-11-18.03 - kbiggerstaff 2008-12-28 17:55:21.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1588 [GMT -6:00]
Running from: c:\documents and settings\kbiggerstaff\Desktop\-Combo-Fix-.exe
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\KBIGGE~1\LOCALS~1\Temp\tmp2.tmp
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))
.

2008-12-28 17:54 . 2008-12-28 17:56 d-------- C:\-Combo-Fix-
2008-12-27 12:53 . 2008-12-28 17:30 d-------- c:\documents and settings\kbiggerstaff\Application Data\Twain
2008-12-27 12:44 . 2008-12-27 12:44 134,656 --a------ c:\windows\system32\yddwiq.dll
2008-12-27 12:44 . 2008-12-27 12:44 134,656 --a------ c:\windows\system32\ohpfhxtq.dll
2008-12-26 11:54 . 2008-12-26 11:54 1,299,082 ---hs---- c:\windows\system32\eqvotfvf.ini
2008-12-26 11:48 . 2008-12-26 11:48 135,680 --a------ c:\windows\system32\urogvn.dll
2008-12-26 11:48 . 2008-12-26 11:48 135,680 --a------ c:\windows\system32\ttvmckgf.dll
2008-12-22 21:51 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-22 21:51 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-22 21:48 . 2008-12-22 21:48 d-------- c:\program files\Bonjour
2008-12-22 21:46 . 2008-12-22 22:37 d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-22 21:43 . 2008-12-22 21:43 d-------- c:\program files\Apple Software Update
2008-12-22 21:42 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-22 21:41 . 2008-12-22 22:37 d-------- c:\program files\Common Files\Apple
2008-12-22 21:37 . 2008-12-22 21:38 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-22 21:37 . 2008-12-22 21:38 1,409 --a------ c:\windows\QTFont.for
2008-12-22 21:30 . 2004-08-04 00:56 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-22 21:30 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-22 21:30 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-22 21:30 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-14 15:13 . 2008-12-14 15:12 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-14 11:29 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\kbiggerstaff\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-14 10:21 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 09:00 . 2008-12-14 09:00 d-------- c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2008-12-14 08:59 . 2008-12-14 08:59 19,136 --a------ c:\documents and settings\kbiggerstaff\Application Data\lojo.reg
2008-12-14 08:26 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-12-13 22:50 . 2008-12-13 22:50 d-------- c:\documents and settings\kbiggerstaff\Application Data\s_6002_fHx8fHx8fDEyNDE4MTMwNTZ8_

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 03:54 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Apple Computer
2008-12-23 03:48 --------- d-----w c:\program files\QuickTime
2008-12-22 18:03 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Video DVD Maker PRO
2008-12-14 21:12 --------- d-----w c:\program files\Java
2008-11-04 20:21 --------- d-----w c:\program files\Google
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-23 03:43:35 27,136 ----a-r c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2008-12-23 03:48:47 86,016 ----a-r c:\windows\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe
- 2006-09-27 12:50:12 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-28 22:01:41 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-09-27 12:50:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-28 22:01:41 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-27 12:50:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-28 22:01:41 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-29 16:18:58 87,336 ----a-w c:\windows\system32\dns-sd.exe
+ 2008-08-29 15:53:50 61,440 ----a-w c:\windows\system32\dnssd.dll
+ 2008-04-17 19:12:54 107,368 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspi.dll
+ 2008-04-17 19:12:54 15,464 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspiWDM.sys
+ 2008-11-07 20:23:30 32,000 -c--a-w c:\windows\system32\DRVSTORE\usbaapl_246F92BBD6449C86FC3F3F28C40D59AC1F69C558\usbaapl.sys
- 2007-09-25 04:30:28 135,168 ----a-w c:\windows\system32\java.exe
+ 2008-12-14 21:12:28 144,792 ----a-w c:\windows\system32\java.exe
- 2007-09-25 04:30:30 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2008-12-14 21:12:28 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-09-25 05:31:42 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2008-12-14 21:12:28 148,888 ----a-w c:\windows\system32\javaws.exe
- 2008-12-14 18:38:42 116,097 ----a-w c:\windows\system32\nvModes.dat
+ 2008-12-24 23:37:58 116,097 ----a-w c:\windows\system32\nvModes.dat
- 2008-12-14 19:04:12 40,836 ----a-w c:\windows\system32\perfc009.dat
+ 2008-12-28 23:37:03 41,238 ----a-w c:\windows\system32\perfc009.dat
- 2008-12-14 19:04:12 314,508 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-28 23:37:03 315,076 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-28 23:32:59 16,384 ----atw c:\windows\temp\Perflib_Perfdata_7dc.dat
+ 2006-12-02 04:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 04:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 04:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}]
2008-12-27 12:44 134656 --a------ c:\windows\system32\yddwiq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-21 7557120]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"WinVNC"="c:\program files\RealVNC\WinVNC\WinVNC.exe" [2003-03-05 335872]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-06-15 135224]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"nwiz"="nwiz.exe" [2006-03-21 c:\windows\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 c:\windows\system32\nvhotkey.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

c:\documents and settings\kbiggerstaff\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-06-18 147456]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-11 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\0\0]
"script"=checkuser.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\1\0]
"script"=MONROEDSA.VBS

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\0]
"script"=Create_TrackUsrDir.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [2006-09-29 9817]
R3 IPSECSHM;Nortel IPSECSHM Adapter;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ba23b58-5d14-11dd-aad8-444553544200}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-28 c:\windows\Tasks\fvsuezwh.job
- c:\windows\system32\rundll32.exe [2004-08-04 06:00]

2008-12-28 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-08-11 06:29]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\kbiggerstaff\Application Data\Mozilla\Firefox\Profiles\dqcqp3ui.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - [You must be registered and logged in to see this link.]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-12-28 17:56:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: c:\windows\system32\winlogon.exe
-> c:\windows\system32\yddwiq.dll

PROCESS: c:\windows\system32\lsass.exe
-> c:\windows\system32\yddwiq.dll
.
Completion time: 2008-12-28 18:00:01
ComboFix-quarantined-files.txt 2008-12-28 23:59:51
ComboFix2.txt 2008-12-14 20:54:14
ComboFix3.txt 2008-12-14 20:30:07

Pre-Run: 87,903,477,760 bytes free
Post-Run: 88,091,160,576 bytes free

204

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 12:21 am

- REDUCED FUNCTIONALITY MODE -

Were you not able to access the top links of the combofix page?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:24 am

No....it would come up " can not open combo fix numerically....

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:25 am

Antivirus popup just happened agian....dang it

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 12:29 am

Okay, please do not use combofix now.
The next tool we are gonna use maybe flagged as "riskware" by Mcafee because of the script blocking feature, if Mcafee warns you about a script trying to run, please allow it to.

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :processes
    explorer.exe

    :files
    c:\documents and settings\kbiggerstaff\Application Data\Twain
    c:\windows\system32\yddwiq.dll
    c:\windows\system32\ohpfhxtq.dll
    c:\windows\system32\eqvotfvf.ini
    c:\windows\system32\urogvn.dll
    c:\windows\system32\ttvmckgf.dll
    c:\windows\Tasks\fvsuezwh.job

    :reg
    [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}]

    :commands
    [purity]
    [emptytemp]
    [start explorer]
    [reboot]



  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:33 am

I did....but it is froze at the moment and I can't paste ....hold on

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:34 am

PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\documents and settings\kbiggerstaff\Application Data\Twain moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yddwiq.dll
c:\windows\system32\yddwiq.dll NOT unregistered.
c:\windows\system32\yddwiq.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\ohpfhxtq.dll
c:\windows\system32\ohpfhxtq.dll NOT unregistered.
c:\windows\system32\ohpfhxtq.dll moved successfully.
c:\windows\system32\eqvotfvf.ini moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\urogvn.dll
c:\windows\system32\urogvn.dll NOT unregistered.
c:\windows\system32\urogvn.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\ttvmckgf.dll
c:\windows\system32\ttvmckgf.dll NOT unregistered.
c:\windows\system32\ttvmckgf.dll moved successfully.
c:\windows\Tasks\fvsuezwh.job moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}\\ not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\KBIGGE~1\LOCALS~1\Temp\hsperfdata_kbiggerstaff\2836 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7dc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12282008_183131

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 12:37 am

Hello.
What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 12:55 am

My VirusScan is still disbaled...should I reboot after the OTMoveit3?

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 12:58 am


  • Now open a new notepad file.
  • Input this into the notepad file:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000000
    "UpdatesDisableNotify"=dword:00000000
    "AntiVirusOverride"=dword:00000000
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"=dword:00000001

  • Save this as fix.reg, save it to your desktop.
  • Double click fix.reg to run it.
  • Select yes to the registry merge prompt.


Reboot now.
Is virus scan still disabled?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 2:05 am

I did....yep it is still disabled. Sad tearing

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 2:06 am

Is there anyway to enable manually in the AV control panel?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 2:10 am

I try but it is blank when I open it up from the icon on the bottom of my screen....I can't find it in my programs

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 2:11 am

Is your AV Mcafee?

Try uninstalling it and re-install it.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by kcbiggerstaff on 29th December 2008, 2:20 am

I have a thing in my programs called Wave Systems Corp...Embassy Security Center is in this program file...I have no idea what it is??

kcbiggerstaff
Novice
Novice

Posts Posts : 24
Joined Joined : 2008-12-14
OS OS : Windows XP
Points Points : 29170
# Likes # Likes : 0

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Belahzur on 29th December 2008, 12:55 pm

In the C:\Program Files folder?
Uninstall it if you don't use it.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

  • Wave system corp security


Did you try uninstalling your AV and installing it again?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245101
# Likes # Likes : 1

View user profile

Back to top Go down

Re: HELP Antivirus 2009 AGAIN

Post by Doctor Inferno on 14th February 2009, 3:58 am

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 11976
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104630
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum