[sportygirl]

Everytime I boot up my computer this box pops up over an over again:

Mcafee Active Shield has found a suspect file on your computer.Mcafee strongly recommends that you scan your computer now.

I have scanned and nothing has changed

I use Aol 9.0 security edition....

Below is my log from HijackThis

HELP!!!!! I can not take it any more. I have tried everything....

Logfile of HijackThis v1.99.1
Scan saved at 8:53:43 PM, on 1/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\America Online 9.0b\shellmon.exe
c:\program files\common files\aol\1136864626\ee\anotify.exe
c:\program files\common files\aol\1136864626\ee\aolsoftware.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Common Files\AOL\1136864626\ee\SSCEvtHdlr.exe
C:\Program Files\HijackThis.exe

O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136864626\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1136864626\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/installers/cab/WinAntiVirusPro2006FreeInstall.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

 

[Byteman]

Hi, First go to Add/Remove Programs on the Control Panel and remove WinAntiVirus (2006).

If it is not there, or
If you have any problems trying to remove it don't worry about it and just continue with this fix.

Please download VundoFix.exe to your desktop.
Double-click VundoFix.exe to run it.
Put a check next to Run VundoFix as a task.
You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
When VundoFix re-opens, click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

_ _ _ _ _ _ _

After you post those, do this and post what it asks for.

Download AVG Anti-Spyware from HERE and save that file to your desktop.

When the trial period expires it becomes feature-limited freeware but is still worth keeping as a good on-demand scanner.

1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double click it to launch the set up program.
2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
3. On the main screen select the icon "Update" then select the "Update now" link.
   • Next select the "Start Update" button. The update will start and a progress bar will show the updates being installed.
4. Once the update has completed, select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
6. Under "Reports"
   • Select "Automatically generate report after every scan"
   • Un-Select "Only if threats were found"

Close AVG Anti-Spyware. Do Not run a scan just yet, we will run it in safe mode.

1. 
   
   Next, you will need the directions saved that are posted below, since you will be doing part of the work
   in Safe Mode where this forum and the Internet are not available! Print them out, or you can copy and paste the steps into a text file with Notepad and save it as steps.txt (or something else you'd like to call it) to your desktop.
   
2. Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
   
   IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning as it may interfere with the scanning process:
   
3. Launch AVG Anti-Spyware by double clicking the icon on your desktop.
4. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
5. AVG will now begin the scanning process. Please be patient as this may take a little time.
   Once the scan is complete, do the following:
6. If you have any infections you will be prompted. Then select "Apply all actions."
7. Next select the "Reports" icon at the top.
8. Select the "Save report as" button in the lower lef- hand of the screen and save it to a text file on your system (make sure to remember where you saved that file. This is important).
9. Close AVG Anti-Spyware and reboot your system back into Normal Mode.

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Come back here and post a new HijackThis log along with the logs from the AVG and Panda scans.

 

[sportygirl]

THANKS FOR THE HELP...HERE IS THE VUNDOFIX.TXT AND HIJACKTHIS LOG
VundoFix V6.2.13

Checking Java version...

Java version is 1.4.2.3

Logfile of HijackThis v1.99.1
Scan saved at 8:51:17 PM, on 1/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\Common Files\AOL\1136864626\ee\SSCEvtHdlr.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\HijackThis.exe

O2 - BHO: RawExecAction Object - {18898424-E3AB-4BA9-8E8D-5434B1CECA75} - C:\WINDOWS\system32\vtuts.dll (file missing)
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136864626\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1136864626\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/installers/cab/WinAntiVirusPro2006FreeInstall.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Scan started at 8:31:42 PM 1/9/2007

Listing files found while scanning....

C:\WINDOWS\system32\aieamdfd.dll
C:\WINDOWS\system32\bfierhnt.dll
C:\WINDOWS\system32\bhidpbqw.dll
C:\WINDOWS\system32\gpclkhiu.dll
C:\WINDOWS\system32\kbdcxasq.dll
C:\WINDOWS\system32\rigywyqf.dll
C:\WINDOWS\system32\rkylesik.dll
C:\WINDOWS\system32\totrsmtt.dll
C:\WINDOWS\system32\xggiikxp.dll
C:\WINDOWS\system32\vtuts.dll
C:\WINDOWS\system32\stutv.ini
C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.ini2
C:\WINDOWS\system32\stutv.tmp

Beginning removal...

Attempting to delete C:\WINDOWS\system32\aieamdfd.dll
C:\WINDOWS\system32\aieamdfd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bfierhnt.dll
C:\WINDOWS\system32\bfierhnt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\bhidpbqw.dll
C:\WINDOWS\system32\bhidpbqw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gpclkhiu.dll
C:\WINDOWS\system32\gpclkhiu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kbdcxasq.dll
C:\WINDOWS\system32\kbdcxasq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rigywyqf.dll
C:\WINDOWS\system32\rigywyqf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\rkylesik.dll
C:\WINDOWS\system32\rkylesik.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\totrsmtt.dll
C:\WINDOWS\system32\totrsmtt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xggiikxp.dll
C:\WINDOWS\system32\xggiikxp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtuts.dll
C:\WINDOWS\system32\vtuts.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\stutv.ini
C:\WINDOWS\system32\stutv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\stutv.bak1
C:\WINDOWS\system32\stutv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\stutv.bak2
C:\WINDOWS\system32\stutv.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\stutv.ini2
C:\WINDOWS\system32\stutv.ini2 Has been deleted!

Performing Repairs to the registry.
Done!

 

[sportygirl]

here are avg anti-spyware and panda reports

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 9:56:01 PM 1/9/2007

+ Scan result:

C:\WINDOWS\system32\ctceyjyb.exe -> Adware.Searchcolor : Cleaned.
C:\WINDOWS\system32\lfrdhnvl.exe -> Adware.Searchcolor : Cleaned.
C:\WINDOWS\system32\auxuxskr.dll -> Adware.Winfixer : Cleaned.
C:\WINDOWS\system32\ciwplont.dll -> Logger.VBStat.c : Cleaned.
C:\VundoFix Backups\aieamdfd.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\bfierhnt.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\bhidpbqw.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\gpclkhiu.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\kbdcxasq.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\rigywyqf.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\rkylesik.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\totrsmtt.dll.bad -> Logger.VBStat.e : Cleaned.
C:\VundoFix Backups\xggiikxp.dll.bad -> Logger.VBStat.e : Cleaned.
C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream : Cleaned.
C:\WINDOWS\system32\fomewhni.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Addynamix : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Clickbank : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected]alfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt -> TrackingCookie.Valueclick : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt -> TrackingCookie.Zedo : Cleaned.
C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt -> TrackingCookie.Zedo : Cleaned.

PANDA
::Report end

Incident Status Location

Spyware:spyware/virtumonde Not disinfected Windows Registry
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][2].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Brian Doherty\Cookies\brian [email protected][1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt
Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][2].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Lynette Doherty\Cookies\lynette [email protected][1].txt

 

[Byteman]

Hi,

Download and install SpyBot Search and Destroy 1.4

http://www.safer-networking.org/index.php?page=spybotsd

The main program is all you need, it updates when you install it...just put it on the desktop, or your favorite place to store downloads.

Here is a short guide with pics to help you install the program:

http://www.safer-networking.org/en/tutorial/index.html

When you have downloaded the program, double click on the downloaded file to start the installation. Follow the default selections, agreeing to the user agreements, and pressing the Next button until you get to the Select Additional Tasks screen.

Put a check into "Use Internet Explorer Protection--SDHelper"

Do NOT elect TeaTimer, you have a protective program running that will possibly conflict with TeaTimer and prevent you from making changes we need to do.

You can create a Registry backup, always a good idea....it may take a couple of minutes so wait until
it has finished if you do backup.

Click on the Search for updates button, as shown in the red box in figure 4 above. This will make Spybot connect to a server on the Internet and determine if there are any available updates for Spybot. If there are no updates available it will tell you so, and then you can click on the Next button.

If updates are available then the Download all available updates button will become available and you should click on that following the prompts. You can use the TDS (US) server by using the black drop down little arrow next to the Server name> you have to do this as the program is made in Europe the default server is usually one over there, not that it matters much...

When the updates are installed click on the Next button.

Immunize Internet Explorer-- Click on "Immunize" and you will see the number of protections it will add,
run Immunize twice until it says "All known products are already blocked" and OK.

Click "Check for Problems" and let it scan, then hav eit remove all items in RED it finds.

You can post the results of SpyBot after you have fixed anything it finds> just re-start SpyBot,

up at the top of it's window select "Mode" and click Advanced then Tools and finally click
View Report and copy and paste that into your reply here.

What I am looking for is an entry like this:

(Name of malware, should be Winfixer or WinantivirusPro): User settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-2052111302-562591055-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A}

It you get that in your SpyBot report we have just a bit more to do.

_ _ _ _ _

I don't see any detected items found in System Restore, so you must have turned that off already? It's OK, but if you want to turn that back on after we are done, let me know, I will post the steps for you anyhow at the end.
\Next:

Run hijackthis again, scan only> put checks next to these items if you see them, then, close this and all other browser windows so that nothing is open on screen but Hijackthis> then, when you have items I list checked, click "Fix Checked".

O2 - BHO: RawExecAction Object - {18898424-E3AB-4BA9-8E8D-5434B1CECA75} - C:\WINDOWS\system32\vtuts.dll (file missing)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime <<optional

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/installers/cab/WinAntiVirusPro2006FreeInstall.cab

Empty the Recycle Bin.

The reason Vundo got in was the older version of Java you are using, you need the latest update> and recently, it's been updating often.

www.java.com Just hit the "Download Java" arrow button.

It may take awhile but it will finish.

Run VundoFix once again, save the log and post it.

Post a new Hijackthis log.

 

[sportygirl]

the spybot report is too long....this forum will not let me post it because of the length...do you have an email address i could send it to?

 

[sportygirl]

ok...a few things...when I did the hijackthis scan only and check the items you told me to, the only one not on the list was the 02-BHO etc... the other to were there....
i ran VundoFix again and it found no infected files....
what else do you want me to do after this...run hijackthis again and post the log?

 

[Byteman]

Hi, For the SpyBot log, can you post it in 2 or 3 parts and post as separate replies.

Yes, post a new Hijackthis log.

After that, about all we need to do is update Java,

Did you understand this below?

I don't see any detected items found in System Restore, so you must have turned that off already? It's OK, but if you want to turn that back on after we are done, let me know, I will post the steps for you anyhow at the end.

If you have System Restore turned on, and have not flushed the Restore Points, we need to do that. If you have any doubts or questions, post in next reply. I will post the steps to do the System Restore Point work as a last step when you reply.

Were you able to update Java?

 

[sportygirl]

Logfile of HijackThis v1.99.1
Scan saved at 5:35:56 PM, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
C:\Program Files\mcafee.com\personal firewall\MPFService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\mcafee.com\antivirus\oasclnt.exe
C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
C:\Program Files\Common Files\AOL\1136864626\ee\SSCEvtHdlr.exe
C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\Program Files\America Online 9.0b\waol.exe
C:\Program Files\America Online 9.0b\shellmon.exe
C:\Program Files\Common Files\AOL\1136864626\ee\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1136864626\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [sscRun] C:\Program Files\Common Files\AOL\1136864626\ee\SSCRun.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\mcafee.com\antivirus\oasclnt.exe
O4 - HKLM\..\Run: [EmailScan] C:\Program Files\mcafee.com\antivirus\mcvsescn.exe
O4 - HKLM\..\Run: [MPFExe] C:\Program Files\mcafee.com\personal firewall\MPfTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AOLSPScheduler] C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0b\AOL.EXE" -b
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Antivirus Update Service (aolavupd) - AOL LLC - C:\Program Files\Common Files\AOL\1136864626\ee\services\safetyCore\ver210_5_2_1\aolavupd.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: McAfee McShield (McShield) - McAfee Inc. - C:\PROGRA~1\mcafee.com\ANTIVI~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\mcafee.com\personal firewall\MPFService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

 

[sportygirl]

--- Report generated: 2007-01-10 21:55 ---

Smitfraud-C.Toolbar888: Settings (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan

VirtuMonde: Class ID (Registry key, fixed)
HKEY_CLASSES_ROOT\CLSID\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}

VirtuMonde: User settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-2457602204-2058530417-1820168162-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}

VirtuMonde: Browser helper object (Registry key, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18898424-E3AB-4BA9-8E8D-5434B1CECA75}


--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2007-01-10 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2007-01-05 Includes\Cookies.sbi (*)
2006-12-08 Includes\Dialer.sbi (*)
2007-01-05 Includes\DialerC.sbi (*)
2006-11-24 Includes\Hijackers.sbi (*)
2007-01-05 Includes\HijackersC.sbi (*)
2006-10-27 Includes\Keyloggers.sbi (*)
2007-01-05 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2006-12-22 Includes\Malware.sbi (*)
2007-01-05 Includes\MalwareC.sbi (*)
2003-03-15 Includes\plugin-ignore.ini
2006-10-20 Includes\PUPS.sbi (*)
2007-01-05 Includes\PUPSC.sbi (*)
2007-01-05 Includes\Revision.sbi (*)
2006-12-08 Includes\Security.sbi (*)
2007-01-05 Includes\SecurityC.sbi (*)
2006-10-13 Includes\Spybots.sbi (*)
2007-01-05 Includes\SpybotsC.sbi (*)
2003-03-15 Includes\Temporary.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-12-08 Includes\Trojans.sbi (*)
2007-01-05 Includes\TrojansC.sbi (*)

 

[sportygirl]

the last post was from spybot not hijack this

 

[sportygirl]

i updated java....tell me what to do with the system restore

 

[Byteman]

Hi, Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.Wait for hourglass to stop and it says
"Turned Off"

Restart your computer, turn System Restore back on and create a restore point.

To create a restore point:

Single-click Start and point to All Programs.
Mouse over Accessories, then System Tools, and select System Restore.
In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done.

 

[sportygirl]

Hello...
I tried to do the System Restore, but no System Restore wizard came up...did I do something wrong...or do I not have this....

 

[Byteman]

Hi, System Restore is either not running, or something else is wrong, but All XP machines have it.

Do this> Right click "MY Computer" and select Properties> then look at the System Restore tab, see what it says>

If "Monitoring" then Restore is on.

If "Turned Off" then someone at some time has turned off System Restore, you need to turn it back on, and then you can create the first new Restore Point as I posted above.

Let me know if it was found turned off, and do others use the computer??