WiredWX Christian Hobby Weather Tools
Would you like to react to this message? Create an account in a few clicks or log in to continue.

WiredWX Christian Hobby Weather ToolsLog in

 


descriptionSystem Security virus EmptySystem Security virus

more_horiz
I got the system security virus, and I have run Malwarebytes' Anti-Malware, numerous times, at first I forgot to update it so it only found 1 virus, but then I updated it and I got a lot more viruses, and I also ran all of this in safe. Then I restarted my computer in normal mode and after a short while a blue screen came up where I couldn't do anything and it said "a problem has been detected..." and a "dump of physical memory" has occurred. And I ran hijack this and here are the results, what should I do?

Logfile of HijackThis v1.99.1
Scan saved at 10:11:15 AM, on 8/2/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hijackthis\HijackThis.exe

O1 - Hosts: ::1 localhost
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LogitechSetup] D:\setup.exe /skip_all_checks /p /start /restart /l:enu
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Risk/Images/stg_drm.ocx
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} (OSAKit2.OSA_Kit) - http://www.newstarsoccer.com/OSAKit2.CAB
O16 - DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} (OSAKitPro.OSAKit) - http://www.newstarsoccer.com/OSAKitPro.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} (YYGInstantPlay Control) - http://www.yoyogames.com/downloads/activex/YoYo.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Risk/Images/armhelper.ocx
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: opnklkj - opnklkj.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: AlrtSys - {e6590784-c1d4-4361-b7aa-fec28725bf66} - C:\WINDOWS\Installer\{e6590784-c1d4-4361-b7aa-fec28725bf66}\AlrtSys.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

What should I do?

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Hello killerfoot0,

Welcome to Geek Police, my name is Origin and I will be helping you today. Please keep the following in mind:

  • If you do not get a reply from me or another helper within 2 days, please reply to your topic with the phrase BUMP
  • If you have any cracked/pirated software in your computer delete them or we will not help you.
  • Only follow advise from Geek Police Staff and not a regular member.
  • Do NOT run any tool without Geek Police supervision as it could hinder your system useless.


  • Open HijackThis.
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O1 - Hosts: ::1 localhost
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
    O20 - Winlogon Notify: opnklkj - opnklkj.dll (file missing)



  • Press "Fix Checked"
  • Close Hijack This.

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:

System Security virus CF_download_FF

System Security virus CF_download_rename

3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See HERE for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.

............................................................................................

While my help is always free, please consider donating to keep this site alive: Donate

System Security virus 2wg6fte

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Ok much obliged for the help Origin, so I followed all the steps and here's the report

ComboFix 09-08-01.09 - John 08/02/2009 21:58.1.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.247.130 [GMT -4:00]
Running from: c:\documents and settings\John\My Documents\Combo-Fix.exe
AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {C6EC0229-8E2C-4434-B342-9C188000D324}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ALLUSE~1\APPLIC~1\16291874
c:\docume~1\ALLUSE~1\APPLIC~1\16291874\16291874
c:\docume~1\ALLUSE~1\APPLIC~1\16291874\16291874.exe
c:\program files\Common Files\Companion Wizard
c:\windows\Help\SBSI\cdocr.bak1
c:\windows\Help\SBSI\cdocr.bak2
c:\windows\Help\SBSI\cdocr.ini2
c:\windows\Help\SBSI\cdocr.tmp
c:\windows\Installer\{e6590784-c1d4-4361-b7aa-fec28725bf66}\AlrtSys.dll
c:\windows\pack.epk
c:\windows\system32\adbvcxel.ini
c:\windows\SYSTEM32\ayadd.bak1
c:\windows\SYSTEM32\ayadd.bak2
c:\windows\system32\ayadd.ini
c:\windows\SYSTEM32\ayadd.ini2
c:\windows\SYSTEM32\ayadd.tmp
c:\windows\system32\bluaftye.ini
c:\windows\system32\bnittaaw.ini
c:\windows\system32\bshcowvo.ini
c:\windows\system32\btmxgwcw.ini
c:\windows\system32\cbbwhmpr.ini
c:\windows\system32\cbldtdbq.ini
c:\windows\system32\ciyewpfw.ini
c:\windows\system32\codhnxog.ini
c:\windows\system32\cwriqhwx.ini
c:\windows\system32\dcljedoo.ini
c:\windows\system32\ddmaofer.ini
c:\windows\system32\detjohjd.ini
c:\windows\system32\didnuaer.ini
c:\windows\system32\drivers\vsfocekyeqrrns.sys
c:\windows\system32\eflcbide.ini
c:\windows\system32\egjnoirv.ini
c:\windows\system32\eguywijy.ini
c:\windows\system32\fsxisudg.ini
c:\windows\system32\gmjapold.ini
c:\windows\system32\hkbyynxi.ini
c:\windows\system32\hrmuhtty.ini
c:\windows\system32\icrescmj.ini
c:\windows\system32\ieacybtm.ini
c:\windows\system32\ifapnjmy.ini
c:\windows\system32\ihgtltis.ini
c:\windows\system32\ijbelcxv.ini
c:\windows\system32\ipulivho.ini
c:\windows\system32\jsbhtwjy.ini
c:\windows\system32\jtnvqrif.ini
c:\windows\system32\kdywylcc.ini
c:\windows\system32\khmqkbfc.ini
c:\windows\system32\kxqqjaqm.ini
c:\windows\system32\laogdcgb.ini
c:\windows\system32\lfgaipwl.ini
c:\windows\system32\lrnfyjps.ini
c:\windows\system32\mjmwlgav.ini
c:\windows\system32\mmsrhpvd.ini
c:\windows\system32\negeqnqn.ini
c:\windows\system32\nfkosydf.ini
c:\windows\system32\nlsmhhnb.ini
c:\windows\system32\nxinnrlw.ini
c:\windows\system32\okoogoiv.ini
c:\windows\system32\ooarhanh.ini
c:\windows\system32\pajhyrfv.ini
c:\windows\system32\phmsrqce.ini
c:\windows\system32\plmaxqlx.ini
c:\windows\system32\pncuqtus.ini
c:\windows\system32\pwelbdpb.ini
c:\windows\system32\qennjkjd.ini
c:\windows\system32\qielrxxs.ini
c:\windows\system32\qiuilpox.ini
c:\windows\system32\qpffeaap.ini
c:\windows\system32\rbokmbpq.ini
c:\windows\system32\rokavrdd.ini
c:\windows\system32\rvpltckh.ini
c:\windows\system32\shxsajnj.ini
c:\windows\system32\sqodjpsy.ini
c:\windows\system32\ssemyceh.ini
c:\windows\system32\stera.log
c:\windows\system32\swnqiijj.ini
c:\windows\system32\taddcwjh.ini
c:\windows\system32\tlfbmthx.ini
c:\windows\system32\trsefaqx.ini
c:\windows\system32\uelxjyrc.ini
c:\windows\system32\uetostvc.ini
c:\windows\system32\umxocmcy.ini
c:\windows\system32\vhnggnbl.ini
c:\windows\system32\vleccwpl.ini
c:\windows\system32\vsfocemkvotqdb.dll
c:\windows\system32\vsfocemnjtbpwt.dat
c:\windows\system32\vsfocermlxdqwn.dat
c:\windows\system32\vsfocesqtoirkc.dll
c:\windows\system32\vtxpdkmr.ini
c:\windows\system32\wburbgre.ini
c:\windows\system32\wedmydyc.ini
c:\windows\system32\wgsfyugv.ini
c:\windows\system32\wijuqaoi.ini
c:\windows\system32\wkvxyaln.ini
c:\windows\system32\wojtbncv.ini
c:\windows\system32\wrqvpauk.ini
c:\windows\system32\xlwaefmt.ini
c:\windows\system32\xqsldgwd.ini
c:\windows\system32\xukovluj.ini
c:\windows\system32\xvwqpxwa.ini
c:\windows\system32\yemvtqqf.ini
c:\windows\system32\yftikbbt.ini
c:\windows\system32\ymqubhkv.ini
c:\windows\system32\yqmrxpgq.ini
c:\windows\system32\ysynigce.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_vsfoceixudovrj
-------\Legacy_DOMAINSERVICE
-------\Legacy_FOPN
-------\Legacy_IPRIP
-------\Legacy_VSPF
-------\Legacy_VSPF_HK
-------\Service_Iprip
-------\Service_vspf
-------\Service_vspf_hk

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
((((((((((((((((((((((((( Files Created from 2009-07-03 to 2009-08-03 )))))))))))))))))))))))))))))))
.

2009-08-03 01:39 . 2009-08-03 01:39 -------- dc----w- c:\windows\LastGood
2009-08-02 02:50 . 2009-06-19 18:37 46864 -c--a-w- c:\windows\system32\drivers\TfSysMon.sys
2009-08-02 02:50 . 2009-06-19 18:37 33552 -c--a-w- c:\windows\system32\drivers\TfNetMon.sys
2009-08-02 02:50 . 2009-06-19 18:37 51984 -c--a-w- c:\windows\system32\drivers\TfFsMon.sys
2009-08-02 02:50 . 2009-08-02 02:50 -------- dc----w- c:\program files\ThreatFire
2009-08-02 02:50 . 2009-08-02 02:50 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\PC Tools
2009-07-27 23:04 . 2009-07-27 23:04 -------- dc----w- c:\windows\system32\wbem\Repository
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- C:\ELECTION
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Atari-Infogrames
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Acclaim Entertainment
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Encore
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\iTunes
2009-07-27 22:41 . 2009-08-01 22:54 -------- dc----w- c:\program files\GameBiz2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\MDickie
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\iWin.com
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 3
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Games
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Entertainment
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Nuance
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Osiris Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\NetZeroInstallers
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\PopCap Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Rhapsody
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Sensational Soccer
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\The File Splitter 1.31
2009-07-27 22:38 . 2009-07-27 22:39 -------- dc----w- c:\program files\Valve
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Veoh Networks
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Verizon Games on Demand Player
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VolleyballManager
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VideoLAN
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\WCM2002
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\vgastrat
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\map
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\scenarios
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\ADDINS
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.jagex_cache_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.file_store_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Config
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\CodeBlue
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\BBSTORE
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Desktop
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Cursors
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Connection Wizard
2009-07-27 22:28 . 2009-07-27 22:29 -------- dc----w- c:\windows\Downloaded Installations
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\JAVA
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Intuit
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Expert
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Driver Cache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\PlayOnline
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Sun
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\solcache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Simpsons Jeopardy!
2009-07-27 15:34 . 2009-07-27 22:16 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\12772344
2009-07-16 00:38 . 2009-08-02 15:54 664 -c--a-w- c:\windows\system32\d3d9caps.dat
2009-07-13 12:24 . 2009-07-27 22:43 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\11350464
2009-07-07 21:08 . 2009-07-07 21:08 -------- dc----w- c:\documents and settings\Lenny\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 02:27 . 2009-01-25 00:51 0 -c--a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-03 01:38 . 2009-01-11 03:45 67424 -c--a-w- c:\windows\system32\drivers\CDAVFS.sys
2009-08-02 17:03 . 2007-10-19 23:05 -------- dc--a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-08-02 17:02 . 2009-01-25 00:52 0 -c--a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-02 15:10 . 2008-11-30 22:59 -------- dc----w- c:\documents and settings\John\Application Data\Skype
2009-08-02 14:13 . 2008-11-30 23:14 -------- dc----w- c:\documents and settings\John\Application Data\skypePM
2009-08-02 03:32 . 2009-01-11 22:56 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 03:20 . 2008-04-20 18:52 -------- dc----w- c:\docume~1\ALLUSE~1\APPLIC~1\Google Updater
2009-07-27 22:45 . 2007-07-30 16:42 -------- dc----w- c:\documents and settings\Lenny\Application Data\U3
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WebCyberCoach
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Wesnoth
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WildGames
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Windows Media Connect 2
2009-07-13 17:36 . 2009-01-11 22:56 38160 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-01-11 22:56 19096 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:55 . 2004-08-04 10:00 82432 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-04 10:00 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:27 . 2004-08-04 10:00 1290752 -c--a-w- c:\windows\system32\quartz.dll
2009-05-07 15:44 . 2004-08-04 10:00 344064 -c--a-w- c:\windows\system32\localspl.dll
2008-04-06 22:57 . 2008-04-06 22:57 0 -c--a-w- c:\program files\temp01
2009-08-03 00:36 . 2009-01-14 23:53 134648 -c--a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2007-08-07 04:20 . 2007-08-06 19:39 1742217 -csh--w- c:\windows\INF\bcadcm.tmp
2007-08-13 18:41 . 2007-08-13 18:41 295 -csha-w- c:\windows\SYSTEM32\egjnoirv.tmp
2006-07-11 00:39 . 2006-07-11 00:39 757273 -csha-w- c:\windows\SYSTEM32\hhhkj.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2009-06-19 259344]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ stera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\SYSTEM32\\FXSCLNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\eu2.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPLAYSVR.EXE"=
"c:\\Program Files\\Sports Interactive\\Worldwide Soccer Manager 2007\\fm.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\java.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 TfFsMon;TfFsMon;c:\windows\SYSTEM32\DRIVERS\TfFsMon.sys [8/1/2009 10:50 PM 51984]
R0 TfSysMon;TfSysMon;c:\windows\SYSTEM32\DRIVERS\TfSysMon.sys [8/1/2009 10:50 PM 46864]
S2 bclwcb;bclwcb;c:\windows\system32\drivers\dolrbds.sys --> c:\windows\system32\drivers\dolrbds.sys [?]
S2 bqapwsb;bqapwsb;c:\windows\system32\drivers\prjqfx.sys --> c:\windows\system32\drivers\prjqfx.sys [?]
S3 CDAVFS;CDAVFS;c:\windows\SYSTEM32\DRIVERS\CDAVFS.sys [1/10/2009 11:45 PM 67424]
S3 gkmixern;gkmixern;\??\c:\docume~1\John\LOCALS~1\Temp\gkmixern.sys --> c:\docume~1\John\LOCALS~1\Temp\gkmixern.sys [?]
S3 TfNetMon;TfNetMon;c:\windows\SYSTEM32\DRIVERS\TfNetMon.sys [8/1/2009 10:50 PM 33552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
dttxqush
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-LogitechSetup - D:\setup.exe
HKCU-Run-CyberDefender Early Detection Center - c:\program files\CyberDefender\AntiSpyware\cdas250.exe


.
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: musicmatch.com\online
DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} - hxxp://www.newstarsoccer.com/OSAKit2.CAB
DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} - hxxp://www.newstarsoccer.com/OSAKitPro.CAB
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
FF - ProfilePath - c:\docume~1\John\APPLIC~1\Mozilla\Firefox\Profiles\n11iic3e.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.blackle.com/
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-02 22:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\scg726.acm
.
Completion time: 2009-08-03 22:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-03 02:37

Pre-Run: 29,205,958,656 bytes free
Post-Run: 32,277,442,560 bytes free

318 --- E O F --- 2009-08-02 04:02

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Hello.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\INF\bcadcm.tmp
c:\windows\SYSTEM32\egjnoirv.tmp
c:\windows\SYSTEM32\hhhkj.tmp

Driver::
bclwcb
bqapwsb
gkmixern

NetSvc::
dttxqush

DDS::
uStart Page = about:blank
mStart Page = about:blank


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:
System Security virus Sfxdaw

This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

............................................................................................

Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
System Security virus DXwU4
System Security virus VvYDg

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Here are the results

ComboFix 09-08-03.A2 - John 08/04/2009 11:03.2.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.247.147 [GMT -4:00]
Running from: c:\documents and settings\John\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\John\Desktop\CFScript.txt
AV: CyberDefender Internet Security *On-access scanning enabled* (Updated) {C6EC0229-8E2C-4434-B342-9C188000D324}

FILE ::
"c:\windows\INF\bcadcm.tmp"
"c:\windows\SYSTEM32\egjnoirv.tmp"
"c:\windows\SYSTEM32\hhhkj.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\My Documents\(DGEmu[1].com)Mario Kart 64 (U) .zip
c:\windows\INF\bcadcm.tmp
c:\windows\SYSTEM32\egjnoirv.tmp
c:\windows\SYSTEM32\hhhkj.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BCLWCB
-------\Legacy_BQAPWSB
-------\Legacy_GKMIXERN
-------\Service_bclwcb
-------\Service_bqapwsb
-------\Service_gkmixern


((((((((((((((((((((((((( Files Created from 2009-07-04 to 2009-08-04 )))))))))))))))))))))))))))))))
.

2009-08-03 01:39 . 2009-08-03 01:39 -------- dc----w- c:\windows\LastGood
2009-08-02 03:32 . 2009-08-02 03:32 3775175 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-27 23:04 . 2009-07-27 23:04 -------- dc----w- c:\windows\system32\wbem\Repository
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- C:\ELECTION
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Atari-Infogrames
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Acclaim Entertainment
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\Encore
2009-07-27 22:42 . 2009-07-27 22:42 -------- dc----w- c:\program files\iTunes
2009-07-27 22:41 . 2009-08-01 22:54 -------- dc----w- c:\program files\GameBiz2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\MDickie
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\iWin.com
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 3
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\New Star Soccer 2
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Games
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Myrtilus Entertainment
2009-07-27 22:41 . 2009-07-27 22:41 -------- dc----w- c:\program files\Nuance
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Osiris Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\NetZeroInstallers
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\PopCap Games
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Rhapsody
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\Sensational Soccer
2009-07-27 22:39 . 2009-07-27 22:39 -------- dc----w- c:\program files\The File Splitter 1.31
2009-07-27 22:38 . 2009-08-04 01:14 -------- dc----w- c:\program files\Valve
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Veoh Networks
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\Verizon Games on Demand Player
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VolleyballManager
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\VideoLAN
2009-07-27 22:38 . 2009-07-27 22:38 -------- dc----w- c:\program files\WCM2002
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\vgastrat
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\map
2009-07-27 22:30 . 2009-07-27 22:30 -------- dc----w- C:\scenarios
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\ADDINS
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.jagex_cache_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\.file_store_32
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Config
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\CodeBlue
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\BBSTORE
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Desktop
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Cursors
2009-07-27 22:29 . 2009-07-27 22:29 -------- dc----w- c:\windows\Connection Wizard
2009-07-27 22:28 . 2009-07-27 22:29 -------- dc----w- c:\windows\Downloaded Installations
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\JAVA
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Intuit
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Expert
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Driver Cache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\PlayOnline
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Sun
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\solcache
2009-07-27 22:28 . 2009-07-27 22:28 -------- dc----w- c:\windows\Simpsons Jeopardy!
2009-07-27 15:34 . 2009-07-27 22:16 -------- dc----w- c:\documents and settings\All Users\Application Data\12772344
2009-07-16 00:38 . 2009-08-04 13:01 664 -c--a-w- c:\windows\system32\d3d9caps.dat
2009-07-13 12:24 . 2009-07-27 22:43 -------- dc----w- c:\documents and settings\All Users\Application Data\11350464
2009-07-07 21:08 . 2009-07-07 21:08 -------- dc----w- c:\documents and settings\Lenny\Local Settings\Application Data\Mozilla

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-04 15:24 . 2009-01-25 00:51 0 -c--a-w- c:\windows\system32\drivers\logiflt.iad
2009-08-04 01:15 . 2006-06-19 00:29 -------- dc----w- c:\program files\eMusic Download Manager
2009-08-03 01:38 . 2009-01-11 03:45 67424 -c--a-w- c:\windows\system32\drivers\CDAVFS.sys
2009-08-02 17:03 . 2007-10-19 23:05 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-02 17:02 . 2009-01-25 00:52 0 -c--a-w- c:\windows\system32\drivers\lvuvc.hs
2009-08-02 15:10 . 2008-11-30 22:59 -------- dc----w- c:\documents and settings\John\Application Data\Skype
2009-08-02 14:13 . 2008-11-30 23:14 -------- dc----w- c:\documents and settings\John\Application Data\skypePM
2009-08-02 03:32 . 2009-01-11 22:56 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-02 03:20 . 2008-04-20 18:52 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-27 22:45 . 2007-07-30 16:42 -------- dc----w- c:\documents and settings\Lenny\Application Data\U3
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WebCyberCoach
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Wesnoth
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\WildGames
2009-07-27 22:37 . 2009-07-27 22:37 -------- dc----w- c:\program files\Windows Media Connect 2
2009-07-13 17:36 . 2009-01-11 22:56 38160 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 17:36 . 2009-01-11 22:56 19096 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:55 . 2004-08-04 10:00 82432 -c--a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:55 . 2004-08-04 10:00 119808 -c--a-w- c:\windows\system32\t2embed.dll
2009-06-03 19:27 . 2004-08-04 10:00 1290752 -c--a-w- c:\windows\system32\quartz.dll
2009-05-07 15:44 . 2004-08-04 10:00 344064 -c--a-w- c:\windows\system32\localspl.dll
2008-04-06 22:57 . 2008-04-06 22:57 0 -c--a-w- c:\program files\temp01
2009-08-03 00:36 . 2009-01-14 23:53 134648 -c--a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-18 21633320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ stera

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Halo\\halo.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\SYSTEM32\\FXSCLNT.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPVSETUP.EXE"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\eu2.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\WINDOWS\\SYSTEM32\\DPLAYSVR.EXE"=
"c:\\Program Files\\Sports Interactive\\Worldwide Soccer Manager 2007\\fm.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"c:\\WINDOWS\\SYSTEM32\\java.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLAcsd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R3 CDAVFS;CDAVFS;c:\windows\system32\DRIVERS\CDAVFS.sys [2009-08-03 67424]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder

2009-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 17:42]

2009-08-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 21:26]
.
.
------- Supplementary Scan -------
.
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: musicmatch.com\online
DPF: {197F8FE3-8DF6-4755-B925-B94A1FF2F58E} - hxxp://www.newstarsoccer.com/OSAKit2.CAB
DPF: {2D0280B1-DC42-4DFA-9525-09BD48838539} - hxxp://www.newstarsoccer.com/OSAKitPro.CAB
DPF: {C49134CC-B5EF-458C-A442-E8DFE7B4645F} - hxxp://www.yoyogames.com/downloads/activex/YoYo.cab
FF - ProfilePath - c:\documents and settings\John\Application Data\Mozilla\Firefox\Profiles\n11iic3e.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.blackle.com/
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 11:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\scg726.acm
.
Completion time: 2009-08-04 11:38 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-04 15:38
ComboFix2.txt 2009-08-03 02:38

Pre-Run: 32,277,729,280 bytes free
Post-Run: 32,269,819,904 bytes free

205 --- E O F --- 2009-08-02 04:02

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

System Security virus CF_Cleanup

This will also reset your restore points.

How is the machine running now?

............................................................................................

Site Admin / Security Administrator

Virus Removal ~ OS Support ~ Have we helped you? Help us! ~ GeekChat
- Please PM me if I fail to respond within 24hrs.
System Security virus DXwU4
System Security virus VvYDg

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
I restarted my computer normally, not in safe mode. And everything seems to be great, it seems to even be running faster. I am much obliged to you guys, I was really panicking when I first got this problem, thanks a lot Belahzur and Origin, I read some real scary stuff about how people actually had to scrap there computers cause of this virus, and I don't know where I'd be without you guys.

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck. Big Grin

............................................................................................

While my help is always free, please consider donating to keep this site alive: Donate

System Security virus 2wg6fte

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
Yeah I already have some of things, but I do need something for spyware and a better fireware. Once again much obliged guys.

descriptionSystem Security virus EmptyRe: System Security virus

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum