MalWare Removal • View topic - Infected computer HJT log and combo fix log

	Advanced Search

Welcome to Omgili,
Omgili (Oh My God I Love It ;) is a search engine for discussions. With Omgili you can find answers and solutions, debates, discussions, personal experiences, opinions and more... To learn more about Omgili click here.

This is a complete preview of the discussion as it was indexed by Omgili crawlers. Use this preview if the original discussion is unavailable.
Click here to view the original discussion.


	Hi I am sorry to see your topic is over three days old and no one has been able to respond and help you. Unfortunately all the anti-malware forums are overloaded with victims of malware and we are no exception. If you still require assistance could you please post a link to your topic in our 72 hour bump room , and our staff will try to make an effort to assist you. Please do not reply to this topic. If you haven't posted within three days in the 72 hour bump room, we will assume you have been able to get assistance in other ways and this topic will be closed.


	Hi jmcguire Welcome to the Malware Removal forum. My name is Wingman , and I'll be helping you with your malware problems. I apologize for the delay, getting to your log(s), the forum has been very busy. HijackThis logs can take a while to research, so please be patient. I am currently under the guidance of the MRU teachers, everything I post to you, has been reviewed by them. This additional review process can add some extra time to my responses...but not too much . Before we begin...please note the following important guidelines. The instructions being given are for YOUR computer and system only!. Using these instructions on a different computer can cause damage to that computer and possibly render it inoperable ! Please, if you have questions about something... ASK, don't guess or assume. Please -only- post your problem at (1) one help site. Applying fixes from multiple help sites can cause problems. Please -only- reply to this thread, do not start another! Please do not run any other fix/removal tools unless instructed to do so! Print each set of instructions... If possible...your Internet connection will not be available during some fix processes. Please, continue responding, until I give you the "All Clean" If you follow these guidelines, things should proceed smoothly. I am currently reviewing your log and will return, as soon as possible, with additional instructions. In the meantime... Please perform the following steps. Step 1. HJT - Uninstall Manager Log Please run HijackThis If you are on the "scan & fix stuff" page... Press the "Main Menu" ...button. From the Main Menu...Press the "Open the Misc Tools" ...button. Press the "Open Uninstall Manager... Button. Press only the Save List ...button. Press the "Save" button. The file "uninstall_list.txt" will be saved in your HJT folder. Copy and Paste the contents of "uninstall_list.txt' in your next reply. Step 2. Please include in your next reply: HJT uninstall_list.txt file contents Thanks, Wingman


	Wingman, Thasnk you first off and here is the unistall_list.txt: 3D Groove Playback Engine Ad-Aware Adobe Acrobat 5.0 Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Photoshop 7.0 Adobe Reader 8.1.4 Adobe Reader Korean Fonts Adobe Shockwave Player Adobe SVG Viewer 3.0 AIM 6 ALi USB2.0 Driver Apple Mobile Device Support Apple Software Update AVG 8.5 BitComet 0.63 Bonjour Canon Camera WIA Driver 6.1 Canon IJ Network Scan Utility Canon IJ Network Tool Canon MP Navigator EX 1.0 Canon MX700 series Canon MX700 series User Registration Canon My Printer Canon Utilities Easy-PhotoPrint EX Canon Utilities Solution Menu Choice Guard Corel Business Applications Corel WordPerfect Office - iFilter Critical Update for Windows Media Player 11 (KB959772) Cypress USB Mass Storage Driver Installation Diskeeper 2008 Pro Premier Disney Toontown Online Disney's Toontown Online DivX Player DivX Pro 5.0.3 Bundle Download Updater (AOL LLC) HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.0 (KB932471) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Format SDK (KB902344) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) HP Driver Diagnostics HyperBowl Arcade Edition: Plus! Edition Upgrade Intel Application Accelerator Intel(R) PRO Ethernet Adapter and Software InterVideo WinDVD 4 iTunes J2SE Runtime Environment 5.0 Update 3 J2SE Runtime Environment 5.0 Update 6 Java 2 Runtime Environment, SE v1.4.2_05 JumpStart Advanced 2nd Grade JumpStart Field Trip Adventure Junk Mail filter update Kid Pix Studio Deluxe LG USB Modem driver Logitech MouseWare 9.79.1 Macromedia Flash MX Madeline Rainy Day Activities Malwarebytes' Anti-Malware Match-Up! MetaFrame Presentation Server Web Client for Win32 Microsoft .NET Framework (English) Microsoft .NET Framework (English) v1.0.3705 Microsoft .NET Framework 1.0 Hotfix (KB928367) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Carioca Rummy Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft Entertainment PocketPak (Remove Only) Microsoft Internationalized Domain Names Mitigation APIs Microsoft Location Finder Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Premium Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office 2007 Service Pack 2 (SP2) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Live Add-in 1.3 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook Connector Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Sounds Microsoft Office Word MUI (English) 2007 Microsoft Plus! For Windows XP Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Streets & Trips 2006 Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Windows Journal Viewer Microsoft Windows Media Video 9 VCM Microsoft Windows XP Video Decoder Checkup Utility Miss Spider MobileMe Control Panel MSVCRT MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6.0 Parser (KB933579) Mystery Club Detective Academy Nero Network Magic Nortel Networks Contivity VPN Client NVIDIA Drivers Picasa 3 PIXMA Extended Survey Program Pocket PC Connection Wizard Presto! PageManager 7.15.16 QuickTime Reader Rabbit's Math 1 Reader Rabbit's Preschool RealPlayer Recover My Files Remove Hidden Data Tool Rhapsody Player Engine Roxio Easy Media Creator 7 ScanSoft OmniPage SE 4 Secret Agent(tm) Barbie(tm) Security Update for CAPICOM (KB931906) Security Update for CAPICOM (KB931906) Security Update for Microsoft Office PowerPoint 2007 (KB957789) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953155) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB961373) Segoe UI Sesame Street Elmo's Art Workshop Shockwave Snood 2.2R (Full Version) Snood for Windows version 3.52-W SoundMAX System Requirements Lab Update for 2007 Microsoft Office System (KB967642) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 Help (KB957246) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update for Outlook 2007 Junk Email Filter (kb968503) Update for Windows Internet Explorer 8 (KB968220) Update for Windows Internet Explorer 8 (KB969497) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951618-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955839) Update for Windows XP (KB967715) USB Storage Adapter FX (SM1) User Agent String Utility V CAST Music with Rhapsody Verizon Online DSL Viewpoint Manager (Remove Only) Viewpoint Media Player ViewSonic Monitor Drivers WD Diagnostics WD FAT32 Formatter WD Firewire HID Driver WebEx Support Manager for Internet Explorer Where in the USA is Carmen Sandiego? WildTangent Web Driver Windows Blaster Worm Removal Tool (KB833330) Windows Defender Windows Defender Signatures Windows Genuine Advantage v1.3.0254.0 Windows Imaging Component Windows Internet Explorer 8 Windows Live Communications Platform Windows Live Essentials Windows Live Essentials Windows Live Family Safety Windows Live Mail Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Toolbar Windows Live Upload Tool Windows Live Writer Windows Media Connect Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Format SDK Hotfix - KB891122 Windows Media Player 11 Windows Media Player 11 Windows Presentation Foundation Windows Rights Management Client Backwards Compatibility SP2 Windows Rights Management Client with Service Pack 2 Windows XP Service Pack 3 WinRAR archiver WinZip WordPerfect Lightning WordPerfect Lightning - EN WordPerfect Lightning - IPM WordPerfect Lightning - Messages WordPerfect Lightning - MSOM WordPerfect Office X4 WordPerfect Office X4 WordPerfect Office X4 - Common WordPerfect Office X4 - Content WordPerfect Office X4 - EN WordPerfect Office X4 - Filters WordPerfect Office X4 - Graphics WordPerfect Office X4 - ICA WordPerfect Office X4 - IPM WordPerfect Office X4 - IPM T EN WordPerfect Office X4 - MAIL WordPerfect Office X4 - Migration Manager WordPerfect Office X4 - PerfectExperts WordPerfect Office X4 - PR WordPerfect Office X4 - QP WordPerfect Office X4 - Skins WordPerfect Office X4 - System WordPerfect Office X4 - WP Yahoo! Messenger Explorer Bar Zuma Deluxe 1.0


	I see you ran ComboFix earlier... This is a very powerful program and should only be run under the supervision, of one trained in malware removal. Your ComboFix log indicates that you unfortunately, have been infected with : a rootkit. Rootkit Warning A rootkit is a set of software tools intended for concealing running processes, files or system data from the operating system. You are strongly advised to do the following : Disconnect the computer from the Internet and from any networked computers until it is cleaned. Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers. From a clean computer, change all your passwords (Internet login, your email address(es), financial accounts, PayPal, eBay, Amazon...any online activities you carry out which require a username and password). Do NOT change your passwords from this computer, the attacker can still get all the new passwords and transaction records. Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net. Due to its rootkit functionality , your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and re-installation of the operating system (OS) . This decision will have to be made by you... To help you understand more, please take some time to read the following articles: When should I re-format and reinstall my OS What are Remote Access Trojans and why are they dangerous How do I respond to a possible identity theft and how do I prevent it Where to backup your files How to backup your files in Windows XP Restoring your backups We can attempt to clean this machine but we will not guarantee that it won't still be compromised, afterwards. Please let me know how you wish to proceed. If you decide that your want to try to clean your computer, there is something else I must make you aware of... P2P Warning! IMPORTANT There are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer. BitComet 0.63 Please note that as long as you are using any form of P2P networking to download files you can anticipate infestations of malware to occur. P2P file sharing used to be fairly safe. This is no longer true...continue to use P2P sharing ...at your own risk! Keep in mind that this practice may be the source of your current malware infestation. References... Siting the risk factors, of using P2P programs: Malware: Help prevent the Infection How to Prevent the Online Invasion of Spyware and Adware I strongly recommend that you uninstall: BitComet 0.63 You can do so using the Control Panel >> Add or Remove Programs function . If you choose NOT to remove these programs...indicate that in your next reply. As long as you have the P2P program(s) installed, per Malware Removal Forum Policy , I can offer you no further assitance . If you choose to remove this programs, when finished...run another HJT scan and copy/paste it in your next reply. Thanks, Wingman


	So I have several questions 1. This computer has been connected to my network for a long time. I have 2 laptops and 1 other computer that are connected to this network. What should I do with those computers, should I format them? 2. I recently set up a new router on my computer using this computer to do it so I would have to change all those passwords and I f I remember correctly I also recently bought a book on line at amazon but did not enter my credit card but did enter my password for amazon so I have to call my credit card company correct. 3. I would like to back up photos and documents on this computer before I would format it. Is that OK? 4. What virus software and malware etc would you recommend installing on my computers? I have 2 computers that run windows XP and 2 that run Vista. Infact one of the laptops gave me the blue screen of death a few times and it was acting very weird. Thanks Joe


	New HJT scan I removed Bitcomet. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:10:18 PM, on 5/17/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\WDBtnMgr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files\Pure Networks\Network Magic\nmapp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apple Software Update\SoftwareUpdate.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customi ... .yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe" O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe O4 - HKLM\..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MRT] "C:\WINDOWS\system32\MRT.exe" /R O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing) O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing) O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU) O16 - DPF: Cab-package - http://uphsnet.uphs.upenn.edu/medview/p ... V_cert.CAB O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} - http://www.comcastsupport.com/sdccommon ... Gctlcm.cab O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... Oader5.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... VSniff.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://sln.lasalle.edu/iNotes6W.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200 ... Taller.exe O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/29.57/uploader2.cab O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} (FixController Control) - http://h30155.www3.hp.com/ediags/dd/ins ... _v01_5.cab O16 - DPF: {541AEDD4-20E8-4E6F-B12B-0FDD38BB712F} (Centricity Web ViewApp Control 3.0 SPa02) - http://cenweb.uphs.upenn.edu/ami/install/amiviewer.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0365d8fa3fa ... XIE601.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... Eqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 7885491994 O16 - DPF: {6FE450DC-AD32-48D4-A366-01EE7E0B1374} - http://uphsnet.uphs.upenn.edu/medview/p ... Apicom.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/viru ... Ebscan.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.31.5/ttinst.cab O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://www.verizon.net/checkmypc/includ ... ReQual.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... Wflash.cab O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - http://sln.lasalle.edu/dwa7W.cab O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 13435 bytes


	Last thing I promise for these postings I have transfered files from this computer .exe files on a regular basis to other computers on my network. Just let me know what I need to do so I may clean all computers should I post a report from all computers with HJT from each of these computers? Or should I just go and reformat them? I have a ton of exe files that I have placed on another computer so that I can have back up files from this one? Thanks


	Hello jmcguire, My recommendation to you would be to backup all your personal files, documents, photographs, music, videos, etc... And then reformat and reinstall your Operating System. Because of the nature of the infection and sharing of files with other computers on your network, all of them could be compromised. Reformatting and reinstalling your OS, will be th best action you can take at this point. There are some thing you can do in the future to avoid having to do this again: Prevention and Protection Tips 1. Keep Windows and Internet Explorer current with the latest security updates from Microsoft. If you have not done so, go to: Microsoft Windows Update and download all the " critical updates " for Windows. Visit these sites regularly: Calendar Of Updates Microsoft Security Bulletin Summaries For information on Microsoft Advisories and other important security update notifications. 2. Be careful what you download... These types of downloads that may contain malware: Free games, animated characters, and screen savers. Music, movies, and file-sharing programs. Instant Messaging (IM) attachments. Toolbars for your Internet browser. Unknown email files and attachments. 3. Avoid certain types of web sites: Online gaming sites. Online gambling sites. P2P (peer-to-peer) file sharing sites. Online gaming and gambling sites can lead to other sites containing more malware which you can inadvertently download without knowledge or consent. Users visiting such sites may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. (P2P) peer-to-peer or file sharing programs are a security risk which can make your system susceptible to a smörgåsbord of malware infections: Remote attacks, exposure of personal information, identity theft, fraud, and phishing. Many malicious worms and Trojans target P2P files sharing networks. 4. Be wary of URL addresses and Files: Scan a URL address before going there: Go to LinkScanner Copy and paste a suspicious url address... Into the " URL to scan :" box. Click " Scan ". Scan a file before you download it: Go to Dr.Webb Check URL Scan Copy and paste the download URL link for the file into the "white box". Click " Scan " - (the restriction of the checked file is 12 Mb) . 5. Be wary of freeware products . Always read the EULA (End User License Agreement) carefully. Some "freeware" programs come bundled with malware. Use EULAlyzer ...Copyright (C) 2002-2007 Javacool Software LLC. All Rights Reserved. To analyze license agreements for interesting words and phrases before installing software. Always scan the downloads with your anti-virus program because even trusted sites have being known to be compromised. Scanners and Software Here are some of the many "suggested" programs available to help protect your computer: 1. Prevent spyware, homepage hijacking and increase your browser security by using these free programs: SpywareGuard SpywareBlaster ZonedOut Comodo BOClean Anti-Malware 2. Run weekly scans with free spyware cleaning tools such as: (be sure to update the definitions before scanning) : SUPERAntiSpyware Free (Vista compatible) Spybot S&D 1.6 (Vista compatible) DrWeb-CureIt (Vista compatible) Windows Defender 3. Perform free online Virus scans regularly: BitDefender Online Scanner Trend Micro Housecall Trend Micro Housecall Scan for Firefox <- Internet Explorer not required; Does not use ActiveX F-Secure Online Scanner ESET Nod32 Online Scanner (Vista compatible but Internet Explorer must be Run as Administrator.) 4. Install a 3rd party firewall: A firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Comodo ZoneAlarm (uncheck ZoneAlarm Spy Blocker during installation if you choose this one) Ashampoo Agnitum Sunbelt/Kerio ... (30 day free trial) If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a very basic firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time. Wingman


	Wingman, Thanks for your help. Should I format all my computers? I did attempt to back up my .jpg, movie and music files but kept on getting an error that you cannot read from the disk. I will format and reinstall when I can take off all my pictures etc. Thank you, Joe


	Hi jmcguire, Yes, all computers that were on your network and/or you shared files with, should be reformatted and the OS reinstalled. That's the best thing to do. Wingman

Discussion Title: Infected computer HJT log and combo fix log
Title Keywords: MalWare Removal View topic Infected computer combo

Omgili Home

About

FAQ

Plugins

Usenet