Iexplore.exe virus again!

davejess00 · #1 10th Oct 2008, 19:08

Hi I think I also have the iexplore virus and have tried many different programs to get rid of it but none work! I have seen that your site is helping a lot of ppl so maybe me too? Here is my hijack this log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:01:32 PM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\TP-LINK\TWCU\TWCU.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.limewire.com/inclient/?st...ows+XP&osv=5.1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EPSON Stylus CX3700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA CP.EXE /F "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Flag Owns Live Grim] C:\Documents and Settings\All Users\Application Data\Software rule flag owns\First obj.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx2\PXConsole.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MODE REAL] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\ATOM DASH.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
O16 - DPF: {96EEC7FF-106A-47F3-90D6-B4BB754AA40E} (POLi Pay Online) - https://autxn.paywithpoli.com/ewcust...iPayOnline.cab
O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PREVXAgent - Prevx - C:\Program Files\Prevx2\PXAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 10831 bytes

**evilfantasy** · #2 10th Oct 2008, 23:12

Download Lop S&D by Eric_71 and save it to your desktop.
Lop S&D will only run on Windows XP and Windows Vista

Disable your antivirus and antimalware programs so they do not interfere with the running of Lop S&D.
To see how to disable security programs visit this tutorial:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Double-click Lop S&D.exe
Choose the language by typing of the corresponding letter and press Enter
Click OK at the informative window
Type 1, to choose Option 1 (Search) then press Enter
Wait until the end of the scan
A report will be generated, post the contents of it in your next reply.

A copy of the report can be found at this location: %systemdrive%\lopR.txt, in most cases C:\lopR.txt

davejess00 · #3 11th Oct 2008, 00:15

Here is the results from the lop s&d search:

--------------------\\ Lop S&D 4.2.4-5 XP/Vista
Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Sempron(tm) Processor 3200+ )
BIOS : Phoenix - Award BIOS v6.00PG
USER : Compaq_Owner ( Administrator )
BOOT : Normal boot
Antivirus : AVG 7.5.524 7.5.524 (Not Activated)
Firewall : ZoneAlarm Firewall 7.0.483.000 (Not Activated)
C:\ (Local Disk) - NTFS - Total : 68 Go Free : 10 Go
D:\ (Local Disk) - FAT32 - Total : 5 Go Free : 1 Go
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
"C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
Option : [1] ( Sat 11/10/2008|18:11 )

--------------------\\ Listing folders in APPLIC~1
[11/10/2008|04:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[03/10/2007|01:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple
[12/09/2005|09:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer
[28/08/2007|04:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Autodesk
[03/09/2008|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Avg7
[10/06/2008|12:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Avg8
[02/07/2006|01:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> DVD Shrink
[15/07/2006|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> EnterNHelp
[27/03/2007|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google
[18/08/2008|07:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Grisoft
[23/10/2007|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Installations
[12/09/2005|09:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> InstallShield
[11/10/2008|12:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> MailFrontier
[18/08/2008|04:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[10/09/2008|07:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft Help
[10/09/2007|04:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Nero
[11/10/2008|03:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> NOS
[21/05/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> PC Drivers HeadQuarters
[12/09/2005|09:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime
[24/11/2007|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Real
[12/09/2005|09:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SBSI
[02/02/2008|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Seagate
[09/10/2008|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Software rule flag owns
[01/11/2006|01:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Sophos
[14/09/2008|02:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy
[19/05/2008|07:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Symantec
[11/10/2008|06:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP
[15/02/2006|01:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> UDL
[15/07/2006|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Ultima_T15
[08/04/2006|02:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
[22/06/2008|11:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller
[17/03/2008|09:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Adobe
[11/10/2008|03:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> AdobeUM
[13/09/2007|05:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Ahead
[13/06/2008|07:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Apple Computer
[02/10/2007|12:55] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> ArcSoft
[18/06/2006|11:34] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Atari
[21/05/2007|07:47] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Autodesk
[11/10/2008|11:11] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> AVG7
[19/05/2008|02:40] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> AVGTOOLBAR
[08/10/2008|01:29] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> BitTorrent
[21/05/2007|12:09] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Command & Conquer 3 Tiberium Wars
[01/09/2006|08:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Datalayer
[28/05/2007|02:25] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> dvdcss
[13/08/2007|03:00] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> EPSON
[03/05/2007|02:12] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Google
[07/09/2006|02:08] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Help
[26/06/2008|12:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> HPQ
[16/12/2004|04:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Identities
[19/02/2006|05:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> InterVideo
[23/04/2008|11:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> iWin
[03/05/2008|03:20] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Joost
[28/01/2006|03:15] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Leadertech
[13/09/2008|08:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> LimeWire
[14/02/2006|05:22] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Macromedia
[24/11/2007|03:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Media Player Classic
[19/05/2008|06:44] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Microsoft
[09/04/2008|06:13] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Mozilla
[15/07/2006|12:31] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Nikon
[01/09/2006|08:52] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Nokia
[01/09/2006|08:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Nokia Multimedia Player
[01/09/2006|08:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> PC Suite
[19/05/2008|07:32] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Real
[12/09/2005|09:30] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> SampleView
[21/05/2007|12:07] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> SecuROM
[09/10/2008|11:54] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Soap lies love
[28/01/2006|03:16] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Sonic
[23/04/2008|11:45] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> SpinTop
[14/09/2008|06:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> SPORE
[15/04/2008|05:04] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Spybot - Search & Destroy
[14/02/2006|05:49] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Sun
[12/09/2005|09:41] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> Symantec
[16/04/2008|06:42] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> U3
[26/05/2008|11:14] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> uTorrent
[27/05/2006|09:46] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> vlc
[20/05/2008|10:26] C:\DOCUME~1\COMPAQ~1\APPLIC~1\<DIR> WinBatch
[12/09/2005|09:27] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Apple Computer
[16/12/2004|04:22] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Identities
[12/09/2005|09:51] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft
[12/09/2005|09:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Real
[12/09/2005|09:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> SampleView
[12/09/2005|09:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Symantec
[18/08/2008|07:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> AVG7
[18/08/2008|07:44] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft
[18/08/2008|07:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks
[11/10/2008 06:00 PM][--ah-----] C:\WINDOWS\tasks\A396018B9185B27B.job
[11/10/2008 06:11 PM][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job
[11/10/2008 05:00 PM][--a------] C:\WINDOWS\tasks\RegCure Program Check.job
[28/08/2008 04:00 AM][--a------] C:\WINDOWS\tasks\RegCure.job
[11/10/2008 04:07 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 05:00 AM][-rah-----] C:\WINDOWS\tasks\desktop.ini
( A396018B9185B27B.job )=( c:\docume~1\compaq~1\applic~1\soapli~1\Axisgreatex tra.exe )
--------------------\\ Listing Folders in C:\Program Files
[27/07/2008|05:02] C:\Program Files\<DIR> Activision
[11/10/2008|04:05] C:\Program Files\<DIR> Adobe
[15/06/2008|12:20] C:\Program Files\<DIR> Ahead
[20/05/2007|11:20] C:\Program Files\<DIR> Alcohol Soft
[03/06/2008|09:01] C:\Program Files\<DIR> Apple Software Update
[15/07/2006|12:27] C:\Program Files\<DIR> ArcSoft
[12/09/2005|09:13] C:\Program Files\<DIR> ATI Technologies
[21/05/2007|07:36] C:\Program Files\<DIR> Autodesk
[27/05/2008|04:42] C:\Program Files\<DIR> AVG
[20/06/2008|04:54] C:\Program Files\<DIR> BitTorrent
[11/10/2008|04:05] C:\Program Files\<DIR> Common Files
[24/11/2004|01:06] C:\Program Files\<DIR> ComPlus Applications
[21/05/2008|12:51] C:\Program Files\<DIR> DAP
[08/11/2006|02:07] C:\Program Files\<DIR> DivX
[30/09/2008|09:12] C:\Program Files\<DIR> DominateGame
[21/05/2007|10:35] C:\Program Files\<DIR> Drug Lord 2
[18/08/2008|03:56] C:\Program Files\<DIR> D-Tools
[08/11/2006|12:56] C:\Program Files\<DIR> DVD Shrink
[19/05/2008|07:12] C:\Program Files\<DIR> Easy Internet signup
[14/09/2008|06:02] C:\Program Files\<DIR> Electronic Arts
[15/02/2006|01:11] C:\Program Files\<DIR> epson
[26/05/2008|11:15] C:\Program Files\<DIR> eToro
[30/09/2008|09:12] C:\Program Files\<DIR> EV Nova
[13/11/2006|09:39] C:\Program Files\<DIR> FLVPlayer
[26/06/2008|12:13] C:\Program Files\<DIR> GameSpy Arcade
[12/09/2005|09:37] C:\Program Files\<DIR> Google
[27/11/2006|10:19] C:\Program Files\<DIR> Graph
[08/11/2007|06:44] C:\Program Files\<DIR> Griffin Technology
[18/08/2008|07:44] C:\Program Files\<DIR> Grisoft
[27/03/2006|09:17] C:\Program Files\<DIR> GustoSoft
[29/09/2008|04:41] C:\Program Files\<DIR> Hp
[05/12/2007|01:09] C:\Program Files\<DIR> Infogrames Interactive
[14/09/2008|06:03] C:\Program Files\<DIR> InstallShield Installation Information
[17/08/2008|09:45] C:\Program Files\<DIR> Internet Explorer
[12/09/2005|09:23] C:\Program Files\<DIR> InterVideo
[03/06/2008|09:04] C:\Program Files\<DIR> iPod
[14/02/2006|05:20] C:\Program Files\<DIR> iPrimus
[03/06/2008|09:05] C:\Program Files\<DIR> iTunes
[30/09/2008|08:51] C:\Program Files\<DIR> Java
[14/09/2008|05:43] C:\Program Files\<DIR> John Deere American Farmer Deluxe
[09/04/2008|06:13] C:\Program Files\<DIR> Joost
[24/11/2007|02:56] C:\Program Files\<DIR> K-Lite Codec Pack
[20/03/2008|05:13] C:\Program Files\<DIR> LimeWire
[31/08/2008|05:28] C:\Program Files\<DIR> Maxis
[18/08/2008|02:14] C:\Program Files\<DIR> Messenger
[15/05/2007|11:48] C:\Program Files\<DIR> Microsoft CAPICOM 2.1.0.2
[12/09/2005|09:19] C:\Program Files\<DIR> Microsoft Encarta
[16/12/2004|04:23] C:\Program Files\<DIR> microsoft frontpage
[26/06/2008|12:17] C:\Program Files\<DIR> Microsoft Games
[12/09/2005|09:25] C:\Program Files\<DIR> Microsoft Money 2005
[29/06/2008|10:10] C:\Program Files\<DIR> Microsoft Office
[15/02/2006|12:29] C:\Program Files\<DIR> Microsoft Visual Studio
[03/06/2008|03:51] C:\Program Files\<DIR> Microsoft Works
[14/02/2008|10:22] C:\Program Files\<DIR> Microsoft.NET
[14/03/2008|09:22] C:\Program Files\<DIR> MindArk
[18/08/2008|02:11] C:\Program Files\<DIR> Movie Maker
[11/10/2008|11:09] C:\Program Files\<DIR> Mozilla Firefox
[16/12/2004|04:23] C:\Program Files\<DIR> MSN
[16/12/2004|04:23] C:\Program Files\<DIR> MSN Gaming Zone
[18/10/2006|01:19] C:\Program Files\<DIR> MSXML 4.0
[02/02/2008|05:16] C:\Program Files\<DIR> MSXML 6.0
[10/09/2007|04:25] C:\Program Files\<DIR> Nero
[18/08/2008|02:10] C:\Program Files\<DIR> NetMeeting
[15/07/2006|12:30] C:\Program Files\<DIR> Nikon
[11/10/2008|03:51] C:\Program Files\<DIR> NOS
[15/02/2006|12:42] C:\Program Files\<DIR> OfficeUpdate11
[14/09/2008|02:59] C:\Program Files\<DIR> Online Services
[18/08/2008|02:10] C:\Program Files\<DIR> Outlook Express
[26/06/2007|09:29] C:\Program Files\<DIR> PartyGaming
[12/09/2005|09:34] C:\Program Files\<DIR> PC-Doctor for DOS
[17/06/2007|08:43] C:\Program Files\<DIR> PokerRoom.com
[31/05/2007|01:55] C:\Program Files\<DIR> PokerStars
[03/06/2008|09:04] C:\Program Files\<DIR> QuickTime
[21/04/2008|08:30] C:\Program Files\<DIR> RegCure
[02/02/2008|05:17] C:\Program Files\<DIR> Seagate
[23/04/2008|01:20] C:\Program Files\<DIR> Sean O'Connor's Windows Games
[24/07/2008|06:08] C:\Program Files\<DIR> SEGA
[18/08/2008|03:56] C:\Program Files\<DIR> Sierra Entertainment
[08/02/2007|11:24] C:\Program Files\<DIR> SLD Codec Pack
[09/10/2008|11:53] C:\Program Files\<DIR> Soap lies love
[14/03/2008|06:16] C:\Program Files\<DIR> Sophos
[15/04/2008|09:22] C:\Program Files\<DIR> Spybot - Search & Destroy
[24/11/2007|02:59] C:\Program Files\<DIR> StrongDC++
[19/05/2008|07:41] C:\Program Files\<DIR> Symantec
[13/09/2008|10:03] C:\Program Files\<DIR> TeaTimer (Spybot - Search & Destroy)
[14/02/2006|05:39] C:\Program Files\<DIR> Telstra
[19/06/2007|09:45] C:\Program Files\<DIR> TexasCalculatem
[30/05/2008|01:43] C:\Program Files\<DIR> Theorica Divx ;-) Codecs
[29/02/2008|06:25] C:\Program Files\<DIR> TP-LINK
[11/10/2008|12:33] C:\Program Files\<DIR> Trend Micro
[03/04/2008|12:17] C:\Program Files\<DIR> Trymedia
[24/11/2004|01:07] C:\Program Files\<DIR> Uninstall Information
[27/05/2006|08:19] C:\Program Files\<DIR> VideoLAN
[10/09/2008|01:44] C:\Program Files\<DIR> VUGames
[11/10/2008|05:57] C:\Program Files\<DIR> Warcraft III
[05/06/2008|01:07] C:\Program Files\<DIR> Weatherzone Tracker
[13/09/2006|12:25] C:\Program Files\<DIR> WinAVI VideoConverter
[14/03/2008|06:35] C:\Program Files\<DIR> Windows Live
[10/10/2007|11:18] C:\Program Files\<DIR> Windows Media Connect 2
[25/08/2008|06:37] C:\Program Files\<DIR> Windows Media Player
[14/09/2008|02:59] C:\Program Files\<DIR> Windows NT
[03/10/2007|03:00] C:\Program Files\<DIR> Windows XP Fun Pack
[24/11/2004|01:07] C:\Program Files\<DIR> WindowsUpdate
[14/09/2008|05:41] C:\Program Files\<DIR> WinRAR
[16/12/2004|04:24] C:\Program Files\<DIR> xerox
[11/10/2008|12:29] C:\Program Files\<DIR> Zone Labs
[11/10/2008|12:31] C:\Program Files\<DIR> ZoneAlarmSB
--------------------\\ Listing Folders in C:\Program Files\Common Files
[11/10/2008|04:05] C:\Program Files\Common Files\<DIR> Adobe
[11/10/2008|04:05] C:\Program Files\Common Files\<DIR> Adobe AIR
[10/09/2007|04:28] C:\Program Files\Common Files\<DIR> Ahead
[03/10/2007|01:28] C:\Program Files\Common Files\<DIR> Apple
[28/08/2007|04:28] C:\Program Files\Common Files\<DIR> Autodesk Shared
[03/06/2008|03:50] C:\Program Files\Common Files\<DIR> DESIGNER
[12/09/2005|09:27] C:\Program Files\Common Files\<DIR> InstallShield
[12/09/2005|09:06] C:\Program Files\Common Files\<DIR> Java
[19/05/2008|07:25] C:\Program Files\Common Files\<DIR> Microsoft Shared
[16/12/2004|04:23] C:\Program Files\Common Files\<DIR> MSSoap
[15/07/2006|12:30] C:\Program Files\Common Files\<DIR> muvee Technologies
[15/07/2006|12:31] C:\Program Files\Common Files\<DIR> Nikon
[16/12/2004|04:23] C:\Program Files\Common Files\<DIR> ODBC
[19/05/2008|07:32] C:\Program Files\Common Files\<DIR> Real
[20/05/2008|11:24] C:\Program Files\Common Files\<DIR> Services
[16/12/2004|04:23] C:\Program Files\Common Files\<DIR> SpeechEngines
[19/05/2008|07:41] C:\Program Files\Common Files\<DIR> Symantec Shared
[18/08/2008|02:10] C:\Program Files\Common Files\<DIR> System
[11/03/2007|11:10] C:\Program Files\Common Files\<DIR> Thraex Software
[14/03/2008|06:34] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller
--------------------\\ Process
( 41 Processes )
IEXPLORE.EXE ~ [PID:2612]
IEXPLORE.EXE ~ [PID:2640]
iexplore.exe ~ [PID:3160]
IEXPLORE.EXE ~ [PID:2940]
--------------------\\ Searching with S_Lop
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\bis9A.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\ATOM DASH.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\Axis great extra.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\ilouimpk.ex e
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\jvuyskje.ex e
C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\lfbsabiw.ex e

--------------------\\ Searching for Lop Files - Folders
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\First obj.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Software rule flag owns\Skip proc.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1\ATOM DASH.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1\Axis great extra.exe
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1\ilouimpk.ex e
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1\jvuyskje.ex e
C:\DOCUME~1\COMPAQ~1\APPLIC~1\soapli~1\lfbsabiw.ex e
C:\Program Files\soapli~1
C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\TorrentSpeeder. zip
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@adultfri endfinder[1].txt
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@advertis ing[2].txt
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@ero-advertising[1].txt
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@adopt.eu roclick[2].txt
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@partypok er[1].txt
C:\DOCUME~1\COMPAQ~1\Cookies\compaq_owner@888[2].txt
C:\WINDOWS\Tasks\A396018B9185B27B.job

--------------------\\ Searching within the Registry
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall\Hold wma ref]
"DisplayName"="CiD Help"
"UninstallString"="C:\\DOCUME~1\\COMPAQ~1\\APPLIC~ 1\\SOAPLI~1\\ATOM DASH.exe -uninstall"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"MODE REAL"="C:\\DOCUME~1\\COMPAQ~1\\APPLIC~1\\SOAPLI~1\ \ATOM DASH.exe"
"MODE REAL"="C:\\DOCUME~1\\COMPAQ~1\\APPLIC~1\\SOAPLI~1\ \ATOM DASH.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Flag Owns Live Grim"="C:\\Documents and Settings\\All Users\\Application Data\\Software rule flag owns\\First obj.exe"
--------------------\\ Checking the Hosts file
Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-11 18:12:47
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections
--------------------\\ Cracks & Keygens ..
C:\DOCUME~1\COMPAQ~1\Local Settings\Temp\Rar$EX02.922\Crack
C:\DOCUME~1\COMPAQ~1\Local Settings\Temp\Rar$EX02.922\Crack\rld-spor.exe
C:\DOCUME~1\COMPAQ~1\Local Settings\Temp\Rar$EX02.922\Crack\SporeApp.exe
C:\DOCUME~1\COMPAQ~1\Recent\Spore.GENERIC_KEYGEN-FFF.lnk

[F:343][D:29]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp
[F:200][D:0]-> C:\DOCUME~1\COMPAQ~1\Cookies
[F:18285][D:24]-> C:\DOCUME~1\COMPAQ~1\LOCALS~1\TEMPOR~1\content.IE5
1 - "C:\Lop SD\LopR_1.txt" - Sat 11/10/2008|18:07 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Sat 11/10/2008|18:14 - Option : [1]
--------------------\\ Scan completed at 18:14:22

**evilfantasy** · #4 11th Oct 2008, 22:29

Download NoLop to your Desktop. NoLop.exe

Close any programs you have running since a reboot is required
Double click NoLop.exe to run it
Next, click the button labeled: Search and Destroy
- Your computer will now be scanned for infected files
When the scan finishes, if infected, you are prompted to reboot
Click OK
Now click: REBOOT
A Message should popup from NoLop. If not, double click the program again and it will finish.
Post the contents of C:\NoLop.log in the next reply.

Note: If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program.

Also run a new HijackThis scan and post the log.

davejess00 · #5 11th Oct 2008, 22:46

Ok here are the logs:

Nolop

NoLop! Log by Skate_Punk_21

Fix running from: C:\Documents and Settings\Compaq_Owner\Desktop
[12/10/2008]
[4:33:52 PM]

---Infection Files Found/Removed---
C:\WINDOWS\tasks\A396018B9185B27B.job

Beginning Removal...
Rebooting...
Removing Lop's Leftover Files/Folders...
Editing Registry...
**Fix Complete!**

---Listing AppData sub directories---

C:\Documents and Settings\All Users\Application Data\Adobe
C:\Documents and Settings\All Users\Application Data\Apple
C:\Documents and Settings\All Users\Application Data\Apple Computer
C:\Documents and Settings\All Users\Application Data\Autodesk
C:\Documents and Settings\All Users\Application Data\Avg7
C:\Documents and Settings\All Users\Application Data\Avg8 -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Dvd Shrink
C:\Documents and Settings\All Users\Application Data\Enternhelp
C:\Documents and Settings\All Users\Application Data\Google
C:\Documents and Settings\All Users\Application Data\Grisoft
C:\Documents and Settings\All Users\Application Data\Installations
C:\Documents and Settings\All Users\Application Data\Installshield
C:\Documents and Settings\All Users\Application Data\Mailfrontier -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Microsoft
C:\Documents and Settings\All Users\Application Data\Microsoft Help
C:\Documents and Settings\All Users\Application Data\Nero
C:\Documents and Settings\All Users\Application Data\Nos
C:\Documents and Settings\All Users\Application Data\Pc Drivers Headquarters
C:\Documents and Settings\All Users\Application Data\Quicktime
C:\Documents and Settings\All Users\Application Data\Real -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Sbsi
C:\Documents and Settings\All Users\Application Data\Seagate
C:\Documents and Settings\All Users\Application Data\Software Rule Flag Owns
C:\Documents and Settings\All Users\Application Data\Sophos
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\All Users\Application Data\Symantec
C:\Documents and Settings\All Users\Application Data\Temp -- EMPTY Directory
C:\Documents and Settings\All Users\Application Data\Udl
C:\Documents and Settings\All Users\Application Data\Ultima_t15
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
C:\Documents and Settings\All Users\Application Data\Wlinstaller
C:\Documents and Settings\Compaq_owner\Application Data\Adobe
C:\Documents and Settings\Compaq_owner\Application Data\Adobeum
C:\Documents and Settings\Compaq_owner\Application Data\Ahead
C:\Documents and Settings\Compaq_owner\Application Data\Apple Computer
C:\Documents and Settings\Compaq_owner\Application Data\Arcsoft
C:\Documents and Settings\Compaq_owner\Application Data\Atari
C:\Documents and Settings\Compaq_owner\Application Data\Autodesk
C:\Documents and Settings\Compaq_owner\Application Data\Avg7
C:\Documents and Settings\Compaq_owner\Application Data\Avgtoolbar
C:\Documents and Settings\Compaq_owner\Application Data\Bittorrent
C:\Documents and Settings\Compaq_owner\Application Data\Command & Conquer 3 Tiberium Wars
C:\Documents and Settings\Compaq_owner\Application Data\Datalayer
C:\Documents and Settings\Compaq_owner\Application Data\Dvdcss
C:\Documents and Settings\Compaq_owner\Application Data\Epson
C:\Documents and Settings\Compaq_owner\Application Data\Google
C:\Documents and Settings\Compaq_owner\Application Data\Help -- EMPTY Directory
C:\Documents and Settings\Compaq_owner\Application Data\Hpq
C:\Documents and Settings\Compaq_owner\Application Data\Identities
C:\Documents and Settings\Compaq_owner\Application Data\Intervideo
C:\Documents and Settings\Compaq_owner\Application Data\Iwin
C:\Documents and Settings\Compaq_owner\Application Data\Joost
C:\Documents and Settings\Compaq_owner\Application Data\Leadertech
C:\Documents and Settings\Compaq_owner\Application Data\Limewire
C:\Documents and Settings\Compaq_owner\Application Data\Macromedia
C:\Documents and Settings\Compaq_owner\Application Data\Media Player Classic
C:\Documents and Settings\Compaq_owner\Application Data\Microsoft
C:\Documents and Settings\Compaq_owner\Application Data\Mozilla
C:\Documents and Settings\Compaq_owner\Application Data\Nikon
C:\Documents and Settings\Compaq_owner\Application Data\Nokia
C:\Documents and Settings\Compaq_owner\Application Data\Nokia Multimedia Player
C:\Documents and Settings\Compaq_owner\Application Data\Pc Suite
C:\Documents and Settings\Compaq_owner\Application Data\Real
C:\Documents and Settings\Compaq_owner\Application Data\Sampleview -- EMPTY Directory
C:\Documents and Settings\Compaq_owner\Application Data\Securom
C:\Documents and Settings\Compaq_owner\Application Data\Soap Lies Love
C:\Documents and Settings\Compaq_owner\Application Data\Sonic
C:\Documents and Settings\Compaq_owner\Application Data\Spintop
C:\Documents and Settings\Compaq_owner\Application Data\Spore
C:\Documents and Settings\Compaq_owner\Application Data\Spybot - Search & Destroy
C:\Documents and Settings\Compaq_owner\Application Data\Sun
C:\Documents and Settings\Compaq_owner\Application Data\Symantec -- EMPTY Directory
C:\Documents and Settings\Compaq_owner\Application Data\U3
C:\Documents and Settings\Compaq_owner\Application Data\Utorrent
C:\Documents and Settings\Compaq_owner\Application Data\Vlc
C:\Documents and Settings\Compaq_owner\Application Data\Winbatch
C:\Documents and Settings\Default User\Application Data\Apple Computer
C:\Documents and Settings\Default User\Application Data\Identities
C:\Documents and Settings\Default User\Application Data\Microsoft
C:\Documents and Settings\Default User\Application Data\Real
C:\Documents and Settings\Default User\Application Data\Sampleview -- EMPTY Directory
C:\Documents and Settings\Default User\Application Data\Symantec -- EMPTY Directory
C:\Documents and Settings\Localservice\Application Data\Avg7 -- EMPTY Directory
C:\Documents and Settings\Localservice\Application Data\Microsoft
C:\Documents and Settings\Networkservice\Application Data\Microsoft

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:44:14 PM, on 12/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\TP-LINK\TWCU\TWCU.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.limewire.com/inclient/?st...ows+XP&osv=5.1
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EPSON Stylus CX3700 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA CP.EXE /F "C:\WINDOWS\TEMP\E_SC4.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Flag Owns Live Grim] C:\Documents and Settings\All Users\Application Data\Software rule flag owns\First obj.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MODE REAL] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\ATOM DASH.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
O16 - DPF: {96EEC7FF-106A-47F3-90D6-B4BB754AA40E} (POLi Pay Online) - https://autxn.paywithpoli.com/ewcust...iPayOnline.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 10505 bytes

**evilfantasy** · #6 11th Oct 2008, 22:53

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Flag Owns Live Grim] C:\Documents and Settings\All Users\Application Data\Software rule flag owns\First obj.exe
O4 - HKCU\..\Run: [MODE REAL] C:\DOCUME~1\COMPAQ~1\APPLIC~1\SOAPLI~1\ATOM DASH.exe

Important: Close all windows except for HijackThis and then click Fix checked.

Exit HijackThis.

----------

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Go to Start > Run and type notepad.exe then click OK

Copy and paste the below into Notepad and save as fixme.reg to Your Desktop

Code:

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"AlcxMonitor"=-
"Flag Owns Live Grim"=-

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
"MODE REAL"=-

Locate fixme.reg on your Desktop and double-click it. Answer Yes when prompted to merge with the Registry.

Make sure that you tell me if you receive a success message about adding the above to the registry. If you do not get a success message, it did not work.

Delete the fixme.reg from the Desktop.

Restart the computer

----------

Download CCleaner Slim and save it to your Desktop.
When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.
Complete the installation then:

Double-click the CCleaner shortcut on the desktop to start the program.
Click on the Options block on the left, then choose Cookies.
- Under Cookies to Delete, highlight any cookies you would like to retain permanently
- Click the right arrow > to move them to the Cookies to Keep window.
Go into Options > Advanced uncheck Only delete files in Windows Temp folders older than 48 hours
Click Cleaner on the left then Run Cleaner on the right to run the program.
Important: Make sure that ALL browser windows are closed before selecting Run Cleaner
Caution: It is not recommended that you use the 'Registry' feature unless you are very familiar with the registry.
Exit CCleaner after it has completed its process.

----------

Download Malwarebytes' Anti-Malware (MBAM)

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

davejess00 · #7 11th Oct 2008, 23:26

I received the success message from the fixme.reg file and here is the MBAM log:

Malwarebytes' Anti-Malware 1.28
Database version: 1259
Windows 5.1.2600 Service Pack 3

12/10/2008 5:24:27 PM
mbam-log-2008-10-12 (17-24-27).txt

Scan type: Quick Scan
Objects scanned: 45849
Time elapsed: 2 minute(s), 43 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

**evilfantasy** · #8 11th Oct 2008, 23:29

How is everything now?

davejess00 · #9 11th Oct 2008, 23:33

Running faster but in task manager in processes iexplore.exe is still there and whenever i end it it comes back. For about 5 minutes it uses nearly 99% cpu then after awhile it drops down to 0 but mem usage stays up around 100,000K.

**evilfantasy** · #10 12th Oct 2008, 11:41

Download ComboFix by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note: It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.