Infection help

[mhgy17]

OK. Ran the dds and kaspersky, logs attached. My AntiVir scanned yesterday and found some viruses, that log is also attached.

I am having a problem with the Adobe Reader download.
I don't see a button for Adobe Phototshop Album Starter Edition to untick, just Google taskbar, which I untick.

After I click the download button, I get a gold bar at the top of the browser, "This website wants to install the following add-on 'Adobe Systems Incorporated". If you trust the website...............click here.

I click the gold bar and the computer hangs until I get the error message "Dr. Watson Postmortem Debugger has encountered a problem and needs to close". The error details reference these files:
C:\Docume~1\Robert~1\Locals~1\Temp\WERd125.din00\DrWatson32.exe.mdmp
C:\Docume~1\Robert~1\Locals~1\Temp\WERd125.din00\appcompat.txt



Avira AntiVir Personal
Report file date: Tuesday, September 15, 2009 12:56

Scanning for 1710547 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : NEWMAIN

Version information:
BUILD.DAT : 9.0.0.408 17961 Bytes 8/26/2009 16:51:00
AVSCAN.EXE : 9.0.3.7 466689 Bytes 8/6/2009 02:22:42
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 14:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 15:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 14:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 16:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 19:30:30
ANTIVIR2.VDF : 7.1.5.201 3414528 Bytes 9/3/2009 02:23:40
ANTIVIR3.VDF : 7.1.5.242 394240 Bytes 9/14/2009 02:39:49
Engineversion : 8.2.1.14
AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 19:21:47
AESCRIPT.DLL : 8.1.2.31 475513 Bytes 9/15/2009 02:39:50
AESCN.DLL : 8.1.2.5 127346 Bytes 9/4/2009 02:24:14
AERDL.DLL : 8.1.2.4 430452 Bytes 7/15/2009 02:21:02
AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 19:12:57
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 6/17/2009 19:14:26
AEHEUR.DLL : 8.1.0.155 1921400 Bytes 8/19/2009 02:20:49
AEHELP.DLL : 8.1.7.0 237940 Bytes 9/4/2009 02:24:07
AEGEN.DLL : 8.1.1.62 364916 Bytes 9/15/2009 02:39:49
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 18:32:40
AECORE.DLL : 8.1.7.8 184692 Bytes 9/4/2009 02:23:43
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 18:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 12:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 9/15/2009 02:39:51
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 18:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 14:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 4/27/2009 22:15:35
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 14:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 19:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 12:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 14:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 6/9/2009 19:22:51
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/27/2009 22:15:35

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Tuesday, September 15, 2009 12:56

Starting search for hidden objects.
'36590' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'FDServer.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'McciTrayApp.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PhotoshopElementsDeviceConnect.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'McciCMService.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'PhotoshopElementsFileAgent.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
32 processes with 32 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!
Master boot sector HD5
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '52' files ).


Starting the file scan:

Begin scan in 'C:\' <OS>
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Documents and Settings\Robert Hoagland\Desktop\RootRepeal.exe
[WARNING] The file could not be opened!
C:\Qoobox\Quarantine\C\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe.vir
[DETECTION] Is the TR/FakeRean.A.71 Trojan
C:\Qoobox\Quarantine\C\Program Files\Protection System\coreext.dll.vir
[DETECTION] Is the TR/PCK.Tdss.Y.501 Trojan
C:\Qoobox\Quarantine\C\Program Files\Protection System\uninstall.exe.vir
[DETECTION] Is the TR/PCK.Tdss.Y.487 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\tajf83ikdmf.dll.vir
[DETECTION] Is the TR/Ertfor.B.13 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\tapi.nfo.vir
[DETECTION] Is the TR/Dldr.Small.anfh.9 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpdxcdqloyl.dll.vir
[DETECTION] Is the TR/Dldr.FraudLoa.WD Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACyxtlgwwyed.dll.vir
[DETECTION] Is the TR/Alureon.BF.2 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\wisdstr.exe.vir
[DETECTION] Is the TR/Dldr.FraudLoad.flk Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\_scui.cpl.vir
[DETECTION] Is the TR/FakeRean.A.70 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir
[DETECTION] Is the TR/PCK.Krap.X.127 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UAClyavymnadx.sys.vir
[DETECTION] Is the TR/Agent.50176.19 Trojan

Beginning disinfection:
C:\Qoobox\Quarantine\C\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe.vir
[DETECTION] Is the TR/FakeRean.A.71 Trojan
[NOTE] The file was moved to '4b23cb34.qua'!
C:\Qoobox\Quarantine\C\Program Files\Protection System\coreext.dll.vir
[DETECTION] Is the TR/PCK.Tdss.Y.501 Trojan
[NOTE] The file was moved to '4b21cb36.qua'!
C:\Qoobox\Quarantine\C\Program Files\Protection System\uninstall.exe.vir
[DETECTION] Is the TR/PCK.Tdss.Y.487 Trojan
[NOTE] The file was moved to '4b18cb35.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\tajf83ikdmf.dll.vir
[DETECTION] Is the TR/Ertfor.B.13 Trojan
[NOTE] The file was moved to '4b19cb28.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\tapi.nfo.vir
[DETECTION] Is the TR/Dldr.Small.anfh.9 Trojan
[NOTE] The file was moved to '4b1fcb28.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpdxcdqloyl.dll.vir
[DETECTION] Is the TR/Dldr.FraudLoa.WD Trojan
[NOTE] The file was moved to '4af2cb08.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACyxtlgwwyed.dll.vir
[DETECTION] Is the TR/Alureon.BF.2 Trojan
[NOTE] The file was moved to '4b77d2f1.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\wisdstr.exe.vir
[DETECTION] Is the TR/Dldr.FraudLoad.flk Trojan
[NOTE] The file was moved to '4b22cb30.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\_scui.cpl.vir
[DETECTION] Is the TR/FakeRean.A.70 Trojan
[NOTE] The file was moved to '4b12cb3a.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir
[DETECTION] Is the TR/PCK.Krap.X.127 Trojan
[NOTE] The file was moved to '4b14caf5.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\UAClyavymnadx.sys.vir
[DETECTION] Is the TR/Agent.50176.19 Trojan
[NOTE] The file was moved to '49a4f541.qua'!


End of the scan: Tuesday, September 15, 2009 13:11
Used time: 12:21 Minute(s)

The scan has been done completely.

5035 Scanned directories
209339 Files were scanned
11 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
11 Files were moved to quarantine
0 Files were renamed
3 Files cannot be scanned
209325 Files not concerned
7106 Archives were scanned
3 Warnings
13 Notes
36590 Objects were scanned with rootkit scan
0 Hidden objects were found

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, September 16, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, September 16, 2009 14:03:18
Records in database: 2834801
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
G:\
H:\
I:\
J:\

Scan statistics:
Objects scanned: 51194
Threats found: 6
Infected objects found: 11
Suspicious objects found: 0
Scan duration: 00:34:26


File name / Threat / Threats count
C:\Documents and Settings\All Users\Application Data\gra\wsav.exe Infected: not-a-virus:FraudTool.Win32.GreenAV.e 1
C:\Documents and Settings\Robert Hoagland\Application Data\Sun\Java\Deployment\cache\6.0\22\d1ed7d6-10331766 Infected: Trojan-Downloader.Java.OpenConnection.at 1
C:\Qoobox\Quarantine\C\WINDOWS\braviax.exe.vir Infected: Trojan.Win32.Vilsel.cnv 1
C:\Qoobox\Quarantine\C\WINDOWS\msb.exe.vir Infected: Trojan.Win32.FraudPack.tdc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\braviax.exe.vir Infected: Trojan.Win32.Vilsel.cnv 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\joyabihu.dll.vir Infected: Trojan-Downloader.Win32.Agent.bqxc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\nurofoyi.dll.vir Infected: Trojan-Downloader.Win32.Agent.bqxc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\parahuri.dll.vir Infected: Trojan-Downloader.Win32.Agent.bqxc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\sokazoya.dll.vir Infected: Packed.Win32.Tdss.c 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vakumene.dll.vir Infected: Trojan-Downloader.Win32.Agent.bqxc 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vorehuye.dll.vir Infected: Trojan-Downloader.Win32.Agent.bqxc 1

Selected area has been scanned.


DDS (Ver_09-07-30.01) - NTFSx86
Run by Robert Hoagland at 9:08:05.23 on Wed 09/16/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3061.2153 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\ATT-SST\McciTrayApp.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATTToolbar\FDServer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\ACI32\Applications\Report32.exe
C:\Documents and Settings\Robert Hoagland\Local Settings\temp\jkos-Robert Hoagland\binaries\ScanningProcess.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Robert Hoagland\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.google.com
BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRunOnce: [RunNarrator] Narrator.exe
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: doccentral.com
Trusted Zone: fnismls.com
Trusted Zone: getmedianow.com
Trusted Zone: live.com
Trusted Zone: motive.com\patttbc.att
Trusted Zone: rdesk.com
Trusted Zone: rexplorer.net
Trusted Zone: showingtime.com
Trusted Zone: sitexdata.com
Trusted Zone: spellchecker.net
Trusted Zone: transactionpoint.com
Trusted Zone: trpoint.com
Trusted Zone: virtualearth.net
Trusted Zone: xmlsweb.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {4E330863-6A11-11D0-BFD8-006097237877} - hxxp://support.rexplorer.net/iftw_install//iftwclix.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: igfxcui - igfxdev.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-9-6 130936]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-4-16 24064]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-4-23 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 72944]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-4-23 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-4-23 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-23 55656]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
R3 k57w2k;Broadcom NetLink (TM) Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [2009-4-16 176640]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-9-6 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-9-6 1097096]

=============== Created Last 30 ================

2009-09-15 23:27 73,728 a------- c:\windows\system32\javacpl.cpl
2009-09-15 11:21 50,176 ac------ c:\windows\system32\dllcache\proquota.exe
2009-09-15 11:21 50,176 a------- c:\windows\system32\proquota.exe
2009-09-15 11:03 <DIR> a-dshr-- C:\cmdcons
2009-09-15 11:03 <DIR> --d----- C:\Combo-Fix
2009-09-14 22:36 <DIR> --d----- c:\program files\ATTToolbar
2009-09-14 22:36 <DIR> --d----- c:\docume~1\robert~1\applic~1\ATTToolbar
2009-09-14 22:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ATTToolbar
2009-09-14 22:35 <DIR> --d----- c:\program files\ATT-SST
2009-09-14 22:28 153,088 -c------ c:\windows\system32\dllcache\triedit.dll
2009-09-14 22:26 <DIR> --d----- c:\program files\ATT-HSI
2009-09-14 22:25 <DIR> --d----- c:\program files\common files\Motive
2009-09-14 21:53 229,888 a------- c:\windows\PEV.exe
2009-09-14 21:53 161,792 a------- c:\windows\SWREG.exe
2009-09-14 21:53 98,816 a------- c:\windows\sed.exe
2009-09-07 13:25 13,123 a------- c:\windows\fybig._sy
2009-09-06 03:10 <DIR> --d----- c:\docume~1\alluse~1\applic~1\gra
2009-09-06 01:17 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-09-06 01:17 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-09-06 01:17 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-09-06 01:17 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-09-06 01:17 <DIR> --d----- c:\program files\common files\PC Tools
2009-09-06 01:17 <DIR> --d----- c:\program files\Spyware Doctor
2009-09-06 01:17 <DIR> --d----- c:\docume~1\robert~1\applic~1\PC Tools
2009-09-06 01:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-09-06 01:16 <DIR> --d----- c:\docume~1\robert~1\applic~1\GetRightToGo

==================== Find3M ====================

2009-09-15 23:26 411,368 a------- c:\windows\system32\deploytk.dll
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-08-05 22:22 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-12 12:21 233,472 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\wininet.dll
2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-04-29 14:28 2,172,080 a------- c:\program files\ptreplicator-setup.exe

============= FINISH: 9:08:13.51 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 4/23/2009 2:33:22 PM
System Uptime: 9/16/2009 7:55:32 AM (2 hours ago)

Motherboard: Dell Inc. | | 0T656F
Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz | CPU | 2659/1066mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 298 GiB total, 278.776 GiB free.
D: is CDROM ()
E: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 9/15/2009 10:51:32 AM - System Checkpoint
RP2: 9/15/2009 11:24:45 PM - Removed Java(TM) 6 Update 11
RP3: 9/15/2009 11:26:48 PM - Installed Java(TM) 6 Update 16
RP4: 9/16/2009 3:00:13 AM - Software Distribution Service 3.0
RP5: 9/16/2009 7:52:52 AM - Removed Adobe Reader 6.0.1

==== Installed Programs ======================

32 Bit HP CIO Components Installer
7500_7600_7700_Help
ACI Collection 32
ACI Desktop Additional Components
Adobe Flash Player 10 ActiveX
Adobe Photoshop Elements 3.0
Alarm Clock v1.0
AT&T Self Support Tool
AT&T Toolbar
Avira AntiVir Personal - Free Antivirus
BPD_HPSU
BPD_Scan
BPDfax
BPDSoftware
BPDSoftware_Ini
Broadcom Management Programs
BufferChm
Choice Guard
CleanUp!
Computer Alarm Clock
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
CustomerResearchQFolder
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
eSupportQFolder
FullDPAppQFolder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB953955)
Hotfix for Windows XP (KB954434)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB958347)
Hotfix for Windows XP (KB959252)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Officejet Pro All-In-One Series
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Product Assistant
HP Solution Center 7.0
HP Update
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Intel(R) Graphics Media Accelerator Driver
Java(TM) 6 Update 16
Karen's Replicator
L7500
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office 2000 SR-1 Disc 2
Microsoft Office 2000 SR-1 Small Business
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MPM
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB927977)
OCR Software by I.R.I.S 7.0
PanoStandAlone
PC Access for Windows
PhotoGallery
PowerDVD
ProductContext
RandMap
REXplorer Component Upgrade
Scan
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SkinsHP1
SlideShow
SolutionCenter
Sonic CinePlayer Decoder Pack
Sonic_PrimoSDK
Spyware Doctor 6.1
Status
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB898461)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Live Sync
Windows Live Upload Tool
Windows Presentation Foundation
Windows Search 4.0
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

9/16/2009 7:34:38 AM, error: DCOM [10000] - Unable to start a DCOM Server: {FB7199AB-79BF-11D2-8D94-0000F875C541}. The error: "%2" Happened while starting this command: "C:\Program Files\Messenger\msmsgs.exe" -Embedding
9/14/2009 9:53:52 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the AntiVirSchedulerService service.
9/14/2009 9:53:52 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Adobe Active File Monitor service to connect.
9/14/2009 9:53:52 PM, error: Service Control Manager [7001] - The Windows Firewall/Internet Connection Sharing (ICS) service depends on the Windows Management Instrumentation service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/14/2009 9:53:52 PM, error: Service Control Manager [7000] - The Adobe Active File Monitor service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
9/14/2009 9:53:40 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service winmgmt with arguments "" in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
9/14/2009 9:46:40 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
9/14/2009 9:46:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/14/2009 9:46:12 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
9/14/2009 10:11:09 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/14/2009 10:08:46 PM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
9/14/2009 10:08:46 PM, error: Service Control Manager [7001] - The Fax service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/14/2009 10:08:37 PM, error: SRService [104] - The System Restore initialization process failed.
9/14/2009 10:07:56 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the PEVSystemStart service to connect.
9/14/2009 10:07:52 PM, error: PlugPlayManager [11] - The device Root\LEGACY_ROOTREPEAL\0000 disappeared from the system without first being prepared for removal.
9/14/2009 10:07:42 PM, information: Windows File Protection [64004] - The protected system file beep.sys could not be restored to its original, valid version. The file version of the bad file is unknown The specific error code is 0x00000000 [The operation completed successfully. ].
9/14/2009 10:07:42 PM, information: Windows File Protection [64003] - File replacement was attempted on the protected system file beep.sys. This file was restored to the original version to maintain system stability. The file version of the bad file is unknown.
9/14/2009 10:07:36 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file beep.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.0.
9/14/2009 10:05:06 PM, error: Service Control Manager [7034] - The Photoshop Elements Device Connect service terminated unexpectedly. It has done this 1 time(s).
9/14/2009 10:05:06 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
9/14/2009 10:05:06 PM, error: Service Control Manager [7034] - The Adobe Active File Monitor service terminated unexpectedly. It has done this 1 time(s).
9/13/2009 11:50:03 AM, error: Dhcp [1002] - The IP address lease 192.168.0.4 for the Network Card with network address 0023AE84BA0C has been denied by the DHCP server 0.0.0.0 (The DHCP Server sent a DHCPNACK message).
9/13/2009 10:36:00 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
9/13/2009 10:36:00 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

==== End Of File ===========================

[km2357]

I click the gold bar and the computer hangs until I get the error message "Dr. Watson Postmortem Debugger has encountered a problem and needs to close". The error details reference these files:
C:\Docume~1\Robert~1\Locals~1\Temp\WERd125.din00\DrWatson32.exe.mdmp
C:\Docume~1\Robert~1\Locals~1\Temp\WERd125.din00\appcompat.txt

Dr. Watson is a debugging tool used by Microsoft for Windows XP. Has this error ever showed up before? Or has it onlys showed up when you try to download Adobe Reader?

If it happens again anywhere else, it'd be best to post in a Windows XP forum

(such as Computer Trouble here: http://forum.computertrouble.co.uk/index.php
or
TechSupportGuy here : http://forums.techguy.org/21-windows-nt-2000-xp/
or
VirtualDr here: http://discussions.virtualdr.com/forumdisplay.php?f=48
or
PCPitStop here : http://forums.pcpitstop.com/index.php?showforum=3)

as its not malware-related. Try downloading the Adobe Reader 9.1.3 one more time and if you get the Dr. Watson error again, you can download the Foxit Reader in its place:

You can get Foxit 3.1 instead from http://www.foxitsoftware.com/pdf/rd_intro.php

When installing Foxit 3.1 do the following during Foxit's Setup/Installation process:

Uncheck the following boxes:

I accept the License Terms and want to install Foxit Toolbar

Make Ask.com my default search

Create desktop, quick launch and start menu icon to eBay

My AntiVir scanned yesterday and found some viruses, that log is also attached.

What Avira found and quarantined were files in the Qoobox folder, which is where ComboFix keeps its quarantined files. Kaspersky also found some Qoobox folders, I'll show you how to remove those and ComboFix in an upcoming post.



Reconfigure Windows XP/2003 to show hidden files:
To enable the viewing of Hidden files follow these steps:

• Close all programs so that you are at your desktop.
• Double-click on the My Computer icon.
• Select the Tools menu and click Folder Options.
• After the new window appears select the View tab.
• Put a checkmark in the checkbox labeled Display the contents of system folders.
• Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
• Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
• Remove the checkmark from the checkbox labeled Hide protected operating system files.
• Press the Apply button and then the OK button and shutdown My Computer.
• Now your computer is configured to show all hidden files.

Be sure to re-hide your files once you are finished cleaning your computer.


Step # 1: Deleting Files/Folders

I need you to delete the file and folder I have marked in Red(if found):

c:\windows\fybig._sy

C:\Documents and Settings\All Users\Application Data\gra


Step # 2 Clear Java's Cache

Click Start > Control Panel

• Double-click the Java icon in the control panel. (coffeecup icon)
• Click Settings under Temporary Internet Files.
  
  -The Temporary Files Settings dialog box appears.
  
• Click Delete Files.
  
  -The Delete Temporary Files dialog box appears.
  -There are three options on this window to clear the cache.
  
• Delete Files
• View Applications
• View Applets

Click OK on Delete Temporary Files window.

-Note: This deletes all the Downloaded Applications and Applets from the cache.

Click OK on Temporary Files Settings window.
Close the Java Control Panel

You can view those instructions along with graphics here


Let me know how things went and how is your computer doing? Are all the problems you mentioned in your first post fixed?

[mhgy17]

OK. Cleared the items you mentioned. Everything seems to be back to normal, thank you!

Do I keep all of the scanning tools and scan texts used in the removal process?
And do I delete all of the items from the c:\qoobox quarantine folder?

[km2357]

Do I keep all of the scanning tools and scan texts used in the removal process?
And do I delete all of the items from the c:\qoobox quarantine folder?

In this post, I'll let you know what tools and scan texts to delete and I'll also tell you how to remove ComboFix (thus removing the items in the Qoobox folder).

Since you report no more problems, you are good to go.

You can delete the following from your computer:

exeHelper.exe
The exeHelper Log
DDS.scr
The two DDS Logs
GMER.zip
GMER.exe
RSIT.exe
RootRepeal.exe
The RootRepeal Log
Win32kdiag.exe
The Win32kdiag Log


To remove ComboFix, do the following:

Go to Start > Run - type in ComboFix /u & click OK

Empty your Recycle Bin.


Please take the time to read my All Clean Post.

Please follow these simple steps in order to keep your computer clean and secure:

This is a good time to clear your existing system restore points and establish a new clean restore point

• Go to Start > All Programs > Accessories > System Tools > System Restore
• Select Create a restore point, and Ok it.
• Next, go to Start > Run and type in cleanmgr
• Make sure the C:\ drive is selected and click OK. If your computer's Hard Drive is not located on C:, change it to the correct drive letter then click OK.
• Select the More options tab
• Choose the option to clean up system restore and OK it.
• This will remove all restore points except the new one you just created.

.

Clearing your restore points is not something you should do on a regular basis. Normally, this process only needs to be done after clearing out an infestation of malware.


Make your Internet Explorer more secure This can be done by following these simple instructions:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
   
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Change the Initialize and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub frames across different domains to Prompt
5. When all these settings have been made, click on the OK button.
6. If it asks you if you want to save the settings, press the Yes button.
7. Next press the Apply button and then the OK to exit the Internet Properties page.

Set correct settings for files that should be hidden in Windows XP

• Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
• Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
• If unchecked please checkHide protected operating system files (Recommended)
• If necessary check "Display content of system folders"
• If necessary Uncheck Hide file extensions for known file types.
• Click OK

• Use An Antivirus Software and Keep It Updated - It is very important that your computer has an antivirus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a day. If you do not update your antivirus software, then it will not be able to catch any of the new variants that may come out.
• Visit Microsoft's Update Site Frequently It is important that you visit Microsoft Updates regularly. This will ensure your computer has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
• Install SpywareBlaster SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. An article on anti-malware products with links for this program and others can be found here:
  Computer Safety on line Anti Malware
• Use the hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate web pages. We can customize a hosts file so that it blocks certain web pages. However, it can slow down certain computers. This is why using a hosts file is optional. Download mvps hosts file Make sure you read the instructions on how to install the hosts file. There is a good tutorial HERE If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  
  1. Click the start button on the task bar at the bottom of your screen
  2. Click run
  3. In the dialog box, type services.msc
  4. hit enter, then locate dns client
  5. Highlight it, then doubleclick it.
  6. On the dropdown box, change the setting from automatic to manual.
  7. Click ok..
• Use an alternative instant messenger program.Trillian and Miranda IM These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
• Please read Tony Klein's excellent article: How I got Infected in the First Place
• Please read Understanding Spyware, Browser Hijackers, and Dialers
• Please read Simple and easy ways to keep your computer safe and secure on the Internet
• If you are using Internet Explorer, please consider using an alternate browser: Mozilla's Firefox or
  Opera.
  If you decide to use either FireFox or Opera, it is very important that you keep them up to date and check frequently for updates of the browser of your choice.
• Update all these programs regularly Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
• If your computer was infected by a website, a program, IM, MSN, or p2p, check this site because it is Time To Fight Back.

Follow these steps and your potential for being infected again will reduce dramatically.

Here's a good website to read about Malware prevention:

http://users.telenet.be/bluepatchy/miek ... ntion.html

If your computer is running slow, click here for instructions on how to help speed up your computer.

Good luck!

Please reply one last time so that I know you have read my post and this thread can be closed.

[mhgy17]

I started with some of the tools and scan deleting. While waiting on a search request, I took a look at some of my temp files to see what was in there. While looking for an online definition of Perflib_perfdata, I opened a website and Windows PC Defender popped-up and tried to load all kinds of fake anti-spyware programs. Is there one last scan I can perform to make sure that I am not infected again?

I haven't finished the list from your last post. I can't find;

exeHelper.exe
GMER.zip
GMER.exe
RSIT.exe
RootRepeal.exe
Win32kdiag.exe

Where are they located? I tried the Windows Search but these were not found!

[km2357]

I started with some of the tools and scan deleting. While waiting on a search request, I took a look at some of my temp files to see what was in there. While looking for an online definition of Perflib_perfdata, I opened a website and Windows PC Defender popped-up and tried to load all kinds of fake anti-spyware programs. Is there one last scan I can perform to make sure that I am not infected again?

Go ahead and redownload DDS and run it again and post the logs in your next post. I'd also like to update MBAM and run that as well.

Step # 1 Download and run DDS

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

Step # 2 Run Malwarebytes' Anti-Malware

• Launch Malwarebytes' Anti-Malware.
• Before running a scan, click the Update tab, next click Check for Updates to download any updates, if available.
• Next click the Scanner tab and select Perform Quick Scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• You can also access the log by doing the following:
  
• Click on the Malwarebytes' Anti-Malware icon to launch the program.
• Click on the Logs tab.
• Click on the log at the bottom of those listed to highlight it.
• Click Open.

I haven't finished the list from your last post. I can't find;

exeHelper.exe
GMER.zip
GMER.exe
RSIT.exe
RootRepeal.exe
Win32kdiag.exe

Where are they located? I tried the Windows Search but these were not found!

For GMER.zip and GMER.exe, I don't know where they are located on your computer. You mentioned in your first post in the thread that you tried GMER before and that it failed. Do you remember where you downloaded/saved it to? Perhaps you saved it to your Flash/USB Disk?

And for exeHelper, RSIT, RootRepeal and Win32kDiag, my instructions for downloading those four files say to save them to your Desktop. Did you save them to the Desktop? If they aren't there, do you remember where you saved them to? They also could be on your Flash/USB Disk.

[km2357]

mhgy17? How are things coming along?

[mhgy17]

OK. Followed your advice, things are running fine. Thanks again!

dds and malwarebytes log attached.


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 4/23/2009 2:33:22 PM
System Uptime: 9/21/2009 10:28:27 PM (1 hours ago)

Motherboard: Dell Inc. | | 0T656F
Processor: Intel(R) Core(TM)2 Duo CPU E7300 @ 2.66GHz | CPU | 2660/1066mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 298 GiB total, 279.487 GiB free.
D: is CDROM ()
E: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 9/17/2009 7:55:04 PM - System Checkpoint
RP2: 9/21/2009 10:30:14 PM - Software Distribution Service 3.0

==== Installed Programs ======================

32 Bit HP CIO Components Installer
7500_7600_7700_Help
ACI Collection 32
ACI Desktop Additional Components
Adobe Flash Player ActiveX
Adobe Photoshop Elements 3.0
Adobe Reader 6.0.1
Alarm Clock v1.0
AT&T Self Support Tool
AT&T Toolbar
Avira AntiVir Personal - Free Antivirus
BPD_HPSU
BPD_Scan
BPDfax
BPDSoftware
BPDSoftware_Ini
Broadcom Management Programs
BufferChm
Choice Guard
CleanUp!
Computer Alarm Clock
CP_CalendarTemplates1
cp_OnlineProjectsConfig
CP_Package_Basic1
CP_Panorama1Config
cp_PosterPrintConfig
CueTour
CustomerResearchQFolder
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
DocumentViewer
DocumentViewerQFolder
eSupportQFolder
FullDPAppQFolder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB953955)
Hotfix for Windows XP (KB954434)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB958347)
Hotfix for Windows XP (KB959252)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Officejet Pro All-In-One Series
HP Photosmart Essential
HP Photosmart Premier Software 6.5
HP Product Assistant
HP Solution Center 7.0
HP Update
HPPhotoSmartExpress
HPProductAssistant
InstantShareDevices
InstantShareDevicesMFC
Intel(R) Graphics Media Accelerator Driver
Java(TM) 6 Update 16
Karen's Replicator
L7500
Malwarebytes' Anti-Malware
MarketResearch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office 2000 SR-1 Disc 2
Microsoft Office 2000 SR-1 Small Business
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MPM
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB927977)
OCR Software by I.R.I.S 7.0
PanoStandAlone
PC Access for Windows
PhotoGallery
PowerDVD
ProductContext
RandMap
REXplorer Component Upgrade
Scan
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SkinsHP1
SlideShow
SolutionCenter
Sonic CinePlayer Decoder Pack
Sonic_PrimoSDK
Spyware Doctor 6.1
SpywareBlaster 4.2
Status
SUPERAntiSpyware Free Edition
Toolbox
TrayApp
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB898461)
Update for Windows XP (KB951618-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
WebFldrs XP
WebReg
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Live Sync
Windows Live Upload Tool
Windows Presentation Foundation
Windows Search 4.0
XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

9/21/2009 10:29:02 PM, error: Service Control Manager [7001] - The Fax service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/16/2009 8:49:23 AM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/16/2009 7:34:38 AM, error: DCOM [10000] - Unable to start a DCOM Server: {FB7199AB-79BF-11D2-8D94-0000F875C541}. The error: "%2" Happened while starting this command: "C:\Program Files\Messenger\msmsgs.exe" -Embedding
9/15/2009 8:32:46 AM, error: Service Control Manager [7023] - The System Restore Service service terminated with the following error: The system cannot find the file specified.
9/15/2009 8:32:43 AM, error: SRService [104] - The System Restore initialization process failed.

==== End Of File ===========================


DDS (Ver_09-07-30.01) - NTFSx86
Run by Robert Hoagland at 23:30:26.98 on Mon 09/21/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3061.2608 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATT-SST\McciTrayApp.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Robert Hoagland\Desktop\dds.pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.google.com
BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRunOnce: [RunNarrator] Narrator.exe
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: doccentral.com
Trusted Zone: fnismls.com
Trusted Zone: getmedianow.com
Trusted Zone: live.com
Trusted Zone: motive.com\patttbc.att
Trusted Zone: rdesk.com
Trusted Zone: rexplorer.net
Trusted Zone: showingtime.com
Trusted Zone: sitexdata.com
Trusted Zone: spellchecker.net
Trusted Zone: transactionpoint.com
Trusted Zone: trpoint.com
Trusted Zone: virtualearth.net
Trusted Zone: xmlsweb.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-9-6 130936]
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-4-16 24064]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-4-23 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-3-23 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 74480]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-4-23 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-4-23 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-23 55656]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
R3 k57w2k;Broadcom NetLink (TM) Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [2009-4-16 176640]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsauxs.exe --> c:\program files\spyware doctor\pctsAuxs.exe [?]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctssvc.exe --> c:\program files\spyware doctor\pctsSvc.exe [?]

=============== Created Last 30 ================

2009-09-17 19:36 <DIR> --d----- c:\program files\SpywareBlaster
2009-09-17 18:50 <DIR> --ds---- C:\Combo-Fix24958C
2009-09-16 16:03 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-09-15 23:27 73,728 a------- c:\windows\system32\javacpl.cpl
2009-09-15 11:21 50,176 ac------ c:\windows\system32\dllcache\proquota.exe
2009-09-15 11:21 50,176 a------- c:\windows\system32\proquota.exe
2009-09-15 11:03 <DIR> a-dshr-- C:\cmdcons
2009-09-15 11:03 <DIR> --d----- C:\Combo-Fix
2009-09-14 22:36 <DIR> --d----- c:\program files\ATTToolbar
2009-09-14 22:36 <DIR> --d----- c:\docume~1\robert~1\applic~1\ATTToolbar
2009-09-14 22:36 <DIR> --d----- c:\docume~1\alluse~1\applic~1\ATTToolbar
2009-09-14 22:35 <DIR> --d----- c:\program files\ATT-SST
2009-09-14 22:28 153,088 -c------ c:\windows\system32\dllcache\triedit.dll
2009-09-14 22:26 <DIR> --d----- c:\program files\ATT-HSI
2009-09-14 22:25 <DIR> --d----- c:\program files\common files\Motive
2009-09-06 01:17 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-09-06 01:17 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-09-06 01:17 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-09-06 01:17 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-09-06 01:17 <DIR> --d----- c:\program files\common files\PC Tools
2009-09-06 01:17 <DIR> --d----- c:\docume~1\robert~1\applic~1\PC Tools
2009-09-06 01:17 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-09-06 01:16 <DIR> --d----- c:\docume~1\robert~1\applic~1\GetRightToGo

==================== Find3M ====================

2009-09-15 23:26 411,368 a------- c:\windows\system32\deploytk.dll
2009-09-10 14:54 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 14:53 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-08-05 22:22 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-12 12:21 233,472 a------- c:\windows\system32\wmpdxm.dll
2009-07-03 13:09 915,456 -------- c:\windows\system32\wininet.dll
2009-06-25 04:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 04:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 04:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 04:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 04:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 04:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-04-29 14:28 2,172,080 ac------ c:\program files\ptreplicator-setup.exe

============= FINISH: 23:30:44.23 ===============

Malwarebytes' Anti-Malware 1.41
Database version: 2840
Windows 5.1.2600 Service Pack 3

9/21/2009 11:34:49 PM
mbam-log-2009-09-21 (23-34-49).txt

Scan type: Quick Scan
Objects scanned: 100035
Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[km2357]

Both logs look good.

You can go ahead and delete DDS and its two Logs.

Also, if you haven't yet go ahead and uninstall ComboFix:

Go to Start > Run - type in ComboFix /u & click OK

Empty your Recycle Bin.

Once you've done these things, let me know and we can close the thread.

[mhgy17]

OK. All good. Thanks again! Close the thread.
Where do I make a donation?

[km2357]

You're welcome. I'm glad I was able to help you out.

If you'd like to make a donation, you can go to the following website for more info:

http://www.malwareremoval.com/donations.php

Good luck and safe surfing!

[Gary R]

As your problems appear to have been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.