I have been hit by cpmsky. Cann you help me fix it?

[Bob4]

Let me look into it a bit. I do not want you to uninstall your anti virus program. That just would be the smart thing to do.

But to be sure. If you restarted the machine the resident shield would get turned back on. I'm sure you realize this but have to ask.

[jackie]

I think I was a little impatient as Kaspersky scan ran eventually ...

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, June 17, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, June 16, 2008 23:08:02
Records in database: 875027
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Files scanned: 204887
Threat name: 10
Infected objects: 18
Suspicious objects: 0
Duration of the scan: 04:28:17


File name / Threat name / Threats count
C:\PROGRA~1\ONSPEE~1\ONSPEE~1.DLL/C:\PROGRA~1\ONSPEE~1\ONSPEE~1.DLL Infected: not-a-virus:AdWare.Win32.MegaSearch.v 1
C:\Documents and Settings\All of Us\Shared\little spanish flea.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z 4
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe Infected: not-a-virus:AdWare.Win32.NewDotNet 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe Infected: not-a-virus:AdWare.Win32.WebHancer 5
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe Infected: not-a-virus:Server-Proxy.Win32.MarketScore.h 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe Infected: not-a-virus:Server-Proxy.Win32.MarketScore.i 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\4thofjulysw.exe Infected: not-a-virus:AdWare.Win32.SaveNow.bf 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\4thofjulysw.exe Infected: not-a-virus:AdWare.Win32.SaveNow.au 1
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\bearinst.exe Infected: not-a-virus:AdWare.Win32.OnFlow 1
C:\Program Files\onspeed_toolbar\onspeed_toolbar.dll Infected: not-a-virus:AdWare.Win32.MegaSearch.v 1

The selected area was scanned.


Thanks
Jackie

[Bob4]

________________________________________
Open notepad and copy/paste the text in the quotebox below into it:

Code: Select all

 
File:: 
C:\WINDOWS\system32\ogezfokdmporjccud.dll 
C:\Documents and Settings\All of Us\Shared\little spanish flea.mp3 	
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe 	
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\4thofjulysw.exe 	
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\bearinst.exe 	
 	
 

NOTE: This script was done for this user specifically.
DO NOT ATTEMPT TO USE IT IF YOU ARE NOT THIS USER
YOU WILL HURT THE WORKINGS OF YOUR COMPUTER !!.

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:ComboFix.txt which I will need in your next reply.




_________________________
In your next reply I would like to see:

• A new HJT log
• The report from ComboFix
• Let me know how things seem to be running
  

[jackie]

ComboFix 08-06-12.2 - John 2008-06-17 23:27:18.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.534 [GMT 1:00]
Running from: C:\Documents and Settings\John\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\John\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\Documents and Settings\All of Us\Shared\little spanish flea.mp3
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\4thofjulysw.exe
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\bearinst.exe
C:\WINDOWS\system32\ogezfokdmporjccud.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All of Us\Shared\little spanish flea.mp3
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\Johns Folder\Xmas screensavers\snowycottagefree.exe
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\4thofjulysw.exe
C:\Documents and Settings\All Users\Documents\Files from W98 Dell\TIDY\downloads\bearinst.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))
.

2008-06-11 07:11 . 2008-04-14 12:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 07:11 . 2008-04-14 12:01 272,128 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 16:16 . 2008-06-10 16:16 90,923 --a------ C:\WINDOWS\system32\ogezfokdmporjccud.dll-uninst.exe
2008-06-07 12:51 . 2008-06-07 12:51 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVGTOOLBAR
2008-06-07 10:06 . 2008-06-17 09:24 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-06-07 10:06 . 2008-06-07 10:06 <DIR> d-------- C:\Documents and Settings\John\Application Data\PC Tools
2008-06-07 10:06 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-06-07 10:06 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-06-07 10:06 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-07 10:06 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-06-07 10:02 . 2008-06-17 23:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-06-05 15:24 . 2008-06-05 15:24 <DIR> d-------- C:\Program Files\PowerISO
2008-06-04 13:26 . 2008-06-04 13:27 <DIR> d-------- C:\Documents and Settings\Iain\Application Data\AVGTOOLBAR
2008-06-01 16:45 . 2008-06-01 16:57 <DIR> d-------- C:\Documents and Settings\Gavin\Shared
2008-06-01 16:42 . 2008-06-01 16:52 <DIR> d-------- C:\Documents and Settings\Gavin\Incomplete
2008-06-01 16:42 . 2008-06-01 16:50 <DIR> d-------- C:\Documents and Settings\Gavin\Application Data\FrostWire
2008-06-01 15:55 . 2008-06-01 16:30 <DIR> d-------- C:\Documents and Settings\Gavin\Application Data\AVGTOOLBAR
2008-06-01 15:54 . 2008-06-01 15:54 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Teleca
2008-05-31 23:43 . 2008-05-31 23:43 <DIR> d-------- C:\Documents and Settings\John\Application Data\NCH Swift Sound
2008-05-31 13:57 . 2008-05-31 13:57 <DIR> d-------- C:\Documents and Settings\John\Application Data\AVGTOOLBAR
2008-05-31 13:27 . 2008-06-02 16:15 <DIR> d-------- C:\Documents and Settings\Catriona\Application Data\AVGTOOLBAR
2008-05-31 11:10 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-31 11:10 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-05-31 11:10 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-05-31 11:10 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-05-31 11:10 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-05-31 09:28 . 2008-06-10 16:16 <DIR> d--h----- C:\$AVG8.VAULT$
2008-05-31 09:06 . 2008-05-31 09:06 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-05-31 09:06 . 2008-05-31 09:06 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-05-31 09:05 . 2008-06-17 08:54 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-05-31 09:05 . 2008-05-31 09:05 <DIR> d-------- C:\Program Files\AVG
2008-05-31 09:05 . 2008-05-31 09:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-05-31 09:05 . 2008-05-31 11:12 <DIR> d-------- C:\Documents and Settings\All of Us\Application Data\AVGTOOLBAR
2008-05-28 19:20 . 2008-06-15 17:17 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-28 19:20 . 2008-05-28 19:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-26 19:24 . 2008-05-26 19:24 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\{5553977E-AF8B-4870-AEB6-53B6C1BC822D}
2008-05-26 19:19 . 2008-05-26 19:19 <DIR> d-------- C:\Program Files\Stardock Games
2008-05-26 17:03 . 2008-05-26 17:04 <DIR> d-------- C:\Documents and Settings\John\Application Data\Creative
2008-05-26 15:38 . 2008-05-26 15:38 <DIR> d-------- C:\Program Files\PrettyMay
2008-05-26 15:34 . 2008-05-26 15:34 <DIR> d-------- C:\Program Files\PrettyMayCallRecorder
2008-05-26 15:34 . 2008-05-26 15:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrettyMay
2008-05-26 15:34 . 2008-05-26 15:34 <DIR> d-------- C:\Documents and Settings\All of Us\Application Data\PrettyMay
2008-05-21 20:41 . 2008-05-21 20:46 <DIR> d-------- C:\Documents and Settings\All of Us\Application Data\eBookPro6
2008-05-20 16:57 . 2008-05-31 23:43 <DIR> d-------- C:\Program Files\NCH Swift Sound
2008-05-20 16:57 . 2008-05-31 23:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-17 22:16 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-17 22:03 --------- d-----w C:\Documents and Settings\All of Us\Application Data\Skype
2008-06-17 17:27 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-17 17:27 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-17 15:45 --------- d-----w C:\Documents and Settings\All of Us\Application Data\skypePM
2008-06-15 22:38 2,622 ----a-w C:\Documents and Settings\John\Application Data\wklnhst.dat
2008-06-14 16:31 --------- d-----w C:\Program Files\Steam
2008-06-12 17:08 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-07 09:02 --------- d-----w C:\Program Files\Google
2008-06-06 18:23 --------- d-----w C:\Program Files\Modem Helper
2008-06-06 10:18 --------- d-----w C:\Program Files\EA SPORTS
2008-06-05 18:33 --------- d-----w C:\Program Files\FrostWire
2008-06-01 14:59 5,548 ----a-w C:\Documents and Settings\Gavin\Application Data\wklnhst.dat
2008-05-31 11:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-25 15:26 --------- d-----w C:\Program Files\Medieval II Total War
2008-05-24 11:37 --------- d-----w C:\Documents and Settings\Catriona\Application Data\ONSPEED_TOOLBAR
2008-05-21 16:26 --------- d-----w C:\Documents and Settings\All of Us\Application Data\Sports Interactive
2008-05-21 16:25 --------- d-----w C:\Program Files\Sports Interactive
2008-05-12 20:47 --------- d-----w C:\Program Files\Skype
2008-05-12 20:47 --------- d-----w C:\Program Files\Common Files\Skype
2008-05-12 20:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-09 21:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 17:54 --------- d-----w C:\Documents and Settings\All of Us\Application Data\AdobeUM
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:18 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-05-03 13:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Valve
2008-05-01 10:53 --------- d-----w C:\Documents and Settings\Catriona\Application Data\123 Free Solitaire
2008-04-27 18:43 --------- d-----w C:\Program Files\UBISOFT
2008-04-27 18:41 --------- d-----w C:\Program Files\Call of Duty
2008-04-27 18:37 --------- d-----w C:\Program Files\Activision
2008-04-27 18:32 --------- d-----w C:\Program Files\EA GAMES
2008-04-24 23:08 --------- d-----w C:\Documents and Settings\John\Application Data\vlc
2008-04-24 17:49 --------- d-----w C:\Documents and Settings\Catriona\Application Data\vlc
2008-04-24 13:51 --------- d-----w C:\Documents and Settings\All of Us\Application Data\vlc
2008-04-24 11:25 --------- d-----w C:\Program Files\VideoLAN
2008-04-23 21:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-04-19 18:03 --------- d-----w C:\Program Files\123 Free Solitaire
2008-04-19 18:02 --------- d-----w C:\Documents and Settings\All of Us\Application Data\123 Free Solitaire
2008-04-19 12:39 --------- d-----w C:\Documents and Settings\All of Us\Application Data\FrostWire
2008-03-30 18:43 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-30 18:43 114,688 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-26 22:06 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\system32\dllcache\win32k.sys
2007-12-25 19:57 22,328 ----a-w C:\Documents and Settings\All of Us\Application Data\PnkBstrK.sys
2007-09-06 20:48 320 ----a-w C:\Documents and Settings\Iain\Application Data\wklnhst.dat
2007-06-07 20:13 1,656 ----a-w C:\Documents and Settings\Catriona\Application Data\wklnhst.dat
2007-04-26 21:45 1 ----a-w C:\Documents and Settings\All of Us\SI.bin
2007-01-13 15:59 15,850 ----a-w C:\Documents and Settings\All of Us\Application Data\wklnhst.dat
2005-09-29 16:38 64,400 ----a-w C:\Documents and Settings\All of Us\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( snapshot@2008-06-14_ 8.23.42.42 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-14 07:12:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-17 22:14:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-06-13 18:09:01 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-06-14 19:09:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-06-13 18:09:01 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-14 19:09:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-06-13 18:09:01 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 19:09:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-04 23:39 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 339968 C:\WINDOWS\stsystra.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-14 21:05 344064]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12 221184]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 16:19 53248]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-09-19 13:55 26112]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05 127035]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 17:15 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 17:15 81920]
"POINTER"="point32.exe" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 16:49 49152]
"SlipStream"="C:\Program Files\ONSPEED\onspeedcore.exe" [2006-12-21 05:18 258048]
"JOYTECH USB Neo S Controller"="C:\Program Files\JoyTechEurope\JOYTECHUSBNeoSController\JoytechNeoSTrayIcon.exe" [2004-11-08 11:02 233472]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17 159744]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-09-02 20:05 155648]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-05-31 09:05 1177368]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 00:50 233472]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 09:48 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 20:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 20:50:52 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\Steam\\steamapps\\common\\defcon\\defcon.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\BugReport\\BugReport.exe"=
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\half-life 2 deathmatch\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\source dedicated server\\srcds.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\garrysmod\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.4\\cnc3game.dat"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.5\\cnc3game.dat"=
"C:\\Program Files\\2K Games\\Firaxis Games\\Sid Meier's Railroads!\\RailRoads.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.6\\cnc3game.dat"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.7\\cnc3game.dat"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.8\\cnc3game.dat"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\team fortress 2\\hl2.exe"=
"C:\\Program Files\\FrostWire\\FrostWire.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Steam\\steamapps\\dawson342\\sin 1 multiplayer\\sin.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.9\\cnc3game.dat"=
"C:\\Program Files\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Stardock Games\\Sins of a Solar Empire Demo\\Sins of a Solar Empire.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-05-31 09:06]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-31 09:05]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
S3 bfastfao;bfastfao;C:\DOCUME~1\ALLOFU~1\LOCALS~1\Temp\bfastfao.sys []

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-17 19:00:02 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job"
- C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 23:34:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-17 23:37:48
ComboFix-quarantined-files.txt 2008-06-17 22:37:45
ComboFix2.txt 2008-06-14 07:24:07

Pre-Run: 26,034,180,096 bytes free
Post-Run: 26,686,083,072 bytes free

247 --- E O F --- 2008-06-11 06:38:28


Logfile of HijackThis v1.99.1
Scan saved at 23:41, on 2008-06-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ONSPEED\onspeedcore.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.co.uk/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ONSPEED\PBHelper.dll
O2 - BHO: ONSPEED Toolbar - {4E7BD74F-2B8D-469E-84BA-B830E8D4E122} - C:\PROGRA~1\ONSPEE~1\ONSPEE~1.DLL
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\ONSPEED\components\NOWImaging.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: ONSPEED Toolbar - {4E7BD74F-2B8D-469E-84BA-B830E8D4E122} - C:\PROGRA~1\ONSPEE~1\ONSPEE~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ONSPEED\onspeedcore.exe"
O4 - HKLM\..\Run: [JOYTECH USB Neo S Controller] C:\Program Files\JoyTechEurope\JOYTECHUSBNeoSController\JoytechNeoSTrayIcon.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 6143658265
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crl ... crlocx.ocx
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: application/x-internet-signup - {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe



The system is generally running much faster, particularly when logging on and off which we do as different logins for members of the family, as it was sometimes taking a very long time 'saving your settings'. Now is much quicker. The pop up advertising has gone which is great. We are still getting the occasional crash (blue screen with a lot of tech information which means nothing to me) when logging out one user and logging in another - all that can be done is manual switch off and reboot when that happens.

Thanks
Jackie

[Bob4]

Well your logs seem to be free of Malware. As far as the blue screen crashed (BSOD) are concerned I will recommend another forum more suited to that sort of repair.

But first lets do a something to clean up what we have done.





________________________________
Go to start > run and copy and paste this in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the
system/hidden files and resets System Restore again.

______________________________



A few things to help with possible threats

These are optional . But will help protect you further.
___________________________________

SpywareBlaster

Install SpywareBlaster

SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.


______________________________
SiteHound

http://www.firetrust.com/firetrustsitehound.html

This tool bar will help protect you from.

Over 4,000 fake bank and credit sites.
Tens of thousands of pornographic
and adult sites.
The never ending fake phishing sites.
Malicious sites, which can infect you
with spyware and adware if you visit
them.
Sites to download software which
may infect your computer with
spyware, a virus or adware


___________________________________
Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.


___________________________________
Make your Internet Explorer more secure
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

6. Next press the Apply button and then the OK to exit the Internet Properties page.


Here's a site with great advise on how to AVOID malware. Much easier to do than removing it.



You can go to this site and register as you have done here and post your user switching problem with as much detail as you can.

http://forums.whatthetech.com/Microsoft ... _f119.html





Safe and Happy surfing.

[NonSuch]

As this issue is resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.