Need Help, not sure what the problem is.

[continuumcomplex]

Hi all. I've come here because i'm in desperate need of help with my fiance's laptop. It's infected with something, but i'm blasted if I can figure out exactly what or how to remove it. I've tried everything I could think of, but I have been rather unsuccessful.

Her system details:
Dell inspiron ME051
Intel Celeron M 1.4 GHz
1 GB RAM

Windows XP Home
Version 2002
Service Pack 2 Installed

-She had McAfee Security System installed. (It wouldn't work, and was annoying us so I removed it.)
-Has ZoneAlarm antivirus: Found nothing on computer.
-Ad-Aware: Found several things once: but removal of these did not fix the comp.
-AVG Antivirus: Found nothing on her comp.
-Spybot Search and Destroy: Found several things in the Immunize phase, but I could not scan the computer because I could not update it. (See why below)

Symptoms:
- No internet Access: She is receiving a signal from our router, but under connection status it says "Limited or no Connectivity, This problem occured because the network signal did not assign a network address to the computer."

- McAfee Virus scan no longer accessible. (We hated that problem anyway, so I uninstalled it.)

- Replaced Desktop background with adware warning and advertisement. (I've somehow managed to get rid of this entirely. Though, i'm not sure how I did it, I think it was after I used Ad-Aware.)

- Windows Security Alerts icon appears on taskbar.

- Ad-Aware was finding some files. (I don't remember which ones, it stopped finding them.)

- Changed (Changes it back to that anytime I change it) IExplorer homepage to http://gomyron.com/NjU2NA==12/3560/homepage/

- Put Privacy Protector icon on desktop. Also put icons called "ErrorCleaner and Spyware & Malware Protection." These all link to a website address: http://onlinesecurityworld.com/shandler.php?sg=1

- Pop up message appears frequently on desktop titled Malware Alert. Message says "Trojan adware.w32.ExpDwndlr.spyware detected" (This message often pops up and opens IExplorer.


If anyone could help me that would be wonderful. I've been working on the problem myself for over a week now, but I can't figure out anything else to try.

[CBMatt]

Welcome, continuumcomplex.  It definitely sounds like SmitFraud has infected your fiancé's computer.  Although you managed to fix the background, there are probably still traces of the infection.  Go ahead and check out these steps for SmitFraudFix: http://www.bleepingcomputer.com/files/smitfraudfix.php

Follow the instructions there.  Let me know how everything goes and post a HijackThis log for me to take a look at.  Good luck!

[continuumcomplex]

Thanks for your help! I ran smitfraudfix (which actually, i'd already run once) and the problem (or most of it anyway) appears to be gone. The icons on the desktop are gone. I am no longer getting any pop up messages. However, i'm still unable to access the internet on her comp.

Here is the hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:30:57 PM, on 6/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kelly Garrick\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Cleanup] c:\program files\mcafee.com\shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - Unknown owner - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (file missing)
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[CBMatt]

Open HijackThis and close all other windows and select the following entry...

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab

Click on Fix Checked and close HijackThis.


Other than that, nothing too bad is showing up in your log.  Using another computer, try downloading AVG Free (not the same as the Anti-Spyware on her computer), along with its updates, which are also available on that site.  Install it on your sister's computer, install it, and scan with it in Safe Mode.  Let it clean whatever it finds.

Download ComboFix and save it to your desktop.  Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says.  Follow the prompts and when finished, it will produce a log at C:\ComboFix.txt.  Go ahead and post that here.  Note: Don't click on the window while it's running; this may cause stalls.


Post back with that log and an update on how things are going.

[continuumcomplex]

Alrighty, I did all of that. The virus scan found nothing, and nothing appears different on the computer. Still no more signs of the popups and advertisements, but still no internet access either.

Here's the long from ComboFix: (Also, i'm posting a different log after this one):

"Kelly Garrick" - 2007-07-01  2:03:28 - ComboFix 07-06-27.7 - Service Pack 2  NTFS  [SAFE MODE]


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\companion wizard\WapCHK.dll
C:\Program Files\Common Files\drivecleaner free
C:\Program Files\Common Files\drivecleaner free\dcsm.exe
C:\WINDOWS\dat.txt
C:\WINDOWS\rs.txt
C:\WINDOWS\search_res.txt


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\nm


(((((((((((((((((((((((((   Files Created from 2007-06-01 to 2007-07-01  )))))))))))))))))))))))))))))))


2007-07-01 02:02   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-06-30 15:18   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-06-30 15:18   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-06-30 15:18   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-06-29 21:51   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-23 01:23   2,100   --a------   C:\WINDOWS\system32\tmp.reg
2007-06-23 00:38   4,245,280   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2007-06-23 00:38   17,952   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2007-06-22 23:49   512   --a------   C:\ScanSectorLog.dat
2007-06-22 23:41   4,212   ---h-----   C:\WINDOWS\system32\zllictbl.dat
2007-06-22 23:28   <DIR>   d--------   C:\WINDOWS\Internet Logs
2007-06-22 23:27   <DIR>   d--------   C:\VundoFix Backups
2007-06-22 14:56   <DIR>   d--------   C:\DOCUME~1\KELLYG~1\APPLIC~1\DriveCleaner Free
2007-06-22 14:46   <DIR>   d--------   C:\Program Files\Windows Media Connect 2
2007-06-22 14:41   <DIR>   d--------   C:\WINDOWS\system32\drivers\UMDF
2007-06-22 14:40   <DIR>   d--hs----   C:\UWA7P
2007-06-22 14:39   24,064   --a------   C:\WINDOWS\system32\msxml3a.dll
2007-06-21 17:05   <DIR>   d--------   C:\Program Files\City of Heroes
2007-06-14 19:01   <DIR>   d--------   C:\Program Files\Lavasoft
2007-06-14 19:01   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-14 19:00   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-06-14 18:43   23,600   --a------   C:\WINDOWS\system32\drivers\TVICHW32.SYS
2007-06-14 16:31   <DIR>   d--------   C:\WINDOWS\McAfee.com
2007-06-14 15:54   <DIR>   d--------   C:\Program Files\PCPitstop
2007-06-14 15:36   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\APPLIC~1\McAfee.com Personal Firewall
2007-06-14 15:28   933,888   --a------   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-14 15:28   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\APPLIC~1\Gtek
2007-06-14 15:28   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\APPLIC~1\Google
2007-06-14 15:09   438,272   ---------   C:\WINDOWS\system32\sc.dll
2007-06-14 15:09   2,326,528   ---------   C:\WINDOWS\system32\LaunchPad.exe
2007-06-14 15:09   11,264   ---------   C:\WINDOWS\system32\lp_plugin.exe
2007-06-13 11:33   <DIR>   d--------   C:\WINDOWS\system32\Skins
2007-06-10 15:05   <DIR>   d--------   C:\Program Files\Common Files\SWF Studio
2007-06-04 15:18   9,344   --a------   C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17   8,320   --a------   C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14   6,272   --a------   C:\WINDOWS\system32\drivers\AWRTPD.sys


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-23 04:19:43   --------   d-----w   C:\Program Files\BFG
2007-06-22 23:31:11   --------   d---a-w   C:\Program Files\MyWebSearch
2007-06-22 20:19:37   --------   d-----w   C:\Program Files\LimeWire
2007-06-22 20:17:02   --------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-06-20 04:46:29   --------   d-----w   C:\Program Files\World of Warcraft
2007-06-15 00:01:43   --------   d-----w   C:\DOCUME~1\KELLYG~1\APPLIC~1\Lavasoft
2007-06-14 20:09:23   940,032   ------w   C:\WINDOWS\system32\dbghelp.dll
2007-06-10 18:40:48   --------   d-----w   C:\Program Files\Starcraft
2007-05-22 01:33:50   98,304   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2007-05-22 01:15:35   --------   d-----w   C:\DOCUME~1\KELLYG~1\APPLIC~1\BFGTOOLBAR
2007-05-21 22:31:12   --------   d-----w   C:\Program Files\LucasArts
2007-05-17 18:58:06   --------   d-----w   C:\Program Files\Activision
2007-05-16 15:12:02   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-04-25 14:21:15   144,896   ----a-w   C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23   2,854,400   ----a-w   C:\WINDOWS\system32\msi.dll
2007-04-17 03:47:36   33,624   ----a-w   C:\WINDOWS\system32\wups.dll
2007-04-17 03:45:54   1,710,936   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:48   549,720   ----a-w   C:\WINDOWS\system32\wuapi.dll
2007-04-17 03:45:42   325,976   ----a-w   C:\WINDOWS\system32\wucltui.dll
2007-04-17 03:45:36   203,096   ----a-w   C:\WINDOWS\system32\wuweb.dll
2007-04-17 03:45:28   92,504   ----a-w   C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20   53,080   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20   43,352   ----a-w   C:\WINDOWS\system32\wups2.dll
2007-04-13 20:19:52   7,680   ----a-w   C:\WINDOWS\system32\lsdelete.exe
2006-01-21 23:54:02   56   -csh--r   C:\WINDOWS\system32\6A67D9D77F.sys
2006-01-21 23:54:03   3,766   -csha-w   C:\WINDOWS\system32\KGyGaAvL.sys


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 02:05]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar3.dll [2007-01-20 00:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" []
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-03 11:10]
"Cleanup"="c:\program files\mcafee.com\shared\mcappins.exe" []
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" []
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-06-10 11:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-30 23:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-01 20:21]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"combofix"=C:\WINDOWS\system32\cmd.exe /c C:\ComboFix\Combobatch.bat

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kelly Garrick^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\Kelly Garrick\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kelly Garrick^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\Kelly Garrick\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WINDOWS\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlfaCleaner]
C:\Program Files\AlfaCleaner\AlfaCleaner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BuildBU]
c:\dell\bldbubg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
C:\Program Files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
"C:\Program Files\Dell Support\DSAgnt.exe" /startup

[continuumcomplex]

The log from ComboFix was too long for one post, so I am pasting the rest of it below. Also, I have a different long that I will post below this one. It is another log that ComboFix created titled "Quarantined Files". I assumed that it might be useful, but that if it isn't..well it's really short and so it doesn't hurt anything.


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
"C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\intell321.exe]
C:\WINDOWS\system32\intell321.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\License Manager]
"C:\Program Files\License_Manager\license_manager.exe " /silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
C:\Program Files\NetWaiting\netWaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPSExe]
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Fax"=2 (0x2)


Contents of the 'Scheduled Tasks' folder
2007-06-23 04:12:27  C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (KELLYMARIE-Kelly Garrick).job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-01 02:14:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-01  2:16:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-01 02:16

   --- E O F ---



(The following is the log titled Quarantined Files)

Code: [Select]

2007-05-21 19:35      618496    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\DriveCleaner Free\dcsm.exe.vir
2007-05-30 14:05      657104    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\compwiz.exe.vir
2007-06-22 14:20      18250    --a------    C:\Qoobox\Quarantine\C\WINDOWS\rs.txt.vir
2007-06-22 14:43      48128    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\Companion Wizard\WapCHK.dll.vir
2007-06-22 15:10      188    --a------    C:\Qoobox\Quarantine\C\WINDOWS\search_res.txt.vir
2007-06-30 13:34      940    --a------    C:\Qoobox\Quarantine\C\WINDOWS\dat.txt.vir
2007-07-01 02:06      352    --a------    C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf


Folder PATH listing
Volume serial number is 409C-4AFA
C:\QOOBOX
\---Quarantine
    +---C
    |   +---Program Files
    |   |   \---Common Files
    |   |       +---Companion Wizard
    |   |       |       compwiz.exe.vir
    |   |       |       WapCHK.dll.vir
    |   |       |       
    |   |       \---DriveCleaner Free
    |   |               dcsm.exe.vir
    |   |               
    |   \---WINDOWS
    |           dat.txt.vir
    |           rs.txt.vir
    |           search_res.txt.vir
    |           
    \---Registry_backups
            services_nm.reg.cf
           


[CBMatt]

ComboFix shows a little bit more than I expected.

Download CCleaner (install without Yahoo! toolbar) and configure it according to this guide.

Once you have cleaned up a bit with CCleaner, reboot into Safe Mode.  Make sure you enable hidden files and folders.

Open up Add/Remove Programs and uninstall the following if found...
AlfaCleaner
Big Fish Games Toolbar
DriveCleaner Free
License Manager
MyWebSearch

Navigate to and delete the following files...
C:\WINDOWS\system32\6A67D9D77F.sys
C:\WINDOWS\system32\intell321.exe
C:\WINDOWS\system32\sc.dll
C:\WINDOWS\system32\SrchSTS.exe

Then navigate to and delete the following folders...
C:\Documents and Settings\Kelly Garrick\Application Data\BFGTOOLBAR
C:\Documents and Settings\Kelly Garrick\Application Data\DriveCleaner Free
C:\Program Files\AlfaCleaner
C:\Program Files\License_Manager
C:\Program Files\MyWebSearch
C:\UWA7P



Once you have done that, download the zip file attached to this post.  It contains badentries.reg and BFGscan.bat.  Unzip it, then right-click on badentries.reg and click on Merge.  When prompted, choose yes.

Then, go ahead and run BFGscan.bat, which will open up a results.txt file.  Copy everything from that file and paste it here.  I believe the folder may be related to Big Fish Games, but I'm not sure.

You can delete the zip, reg, bat, and txt now if you wish.




It's a bit of work, but it's very important.  After all of this, restart the computer.  If it still can't get online, download LSPFix and run it.  Check the I know what I'm doing box.  In the Keep box, there should be a list of files.  Please write those down and tell me what they are.  Do not remove anything yet.

[continuumcomplex]

I'm at the portion where you instructed me to download the zip file attached to your post. Did you remember to attach it? I admit I am new to this forum, but I can't seem to find it.

Also: CCleaner seemed to run without a problem.
And for the other actions you instructed me to take...

I wasn't able to find any of these to remove:
AlfaCleaner
Big Fish Games Toolbar
DriveCleaner Free
License Manager
MyWebSearch

C:\WINDOWS\system32\6A67D9D77F.sys
C:\WINDOWS\system32\intell321.exe


C:\Documents and Settings\Kelly Garrick\Application Data\BFGTOOLBAR
C:\Documents and Settings\Kelly Garrick\Application Data\DriveCleaner Free
C:\Program Files\MyWebSearch
C:\UWA7P


I was able to locate and get rid of the rest of them.

[CBMatt]

My apologies!  It was very early (late for me) and I guess I posted without actually attaching the file.  Sorry about that.  It's definitely attached to this post.

Are you able to see hidden files and folders right now?

Just to be on the safe side, I also added a delete.bat...go ahead and run that as well.  If the files are there, they won't be anymore.

[Saving disk space -  old attachment deleted by admin]

[continuumcomplex]

It's alright. I downloaded the zip and will be running those now. And yes, I can see hidden files.

[continuumcomplex]

Alright, I ran everything. (Ran BFG scan last). However, the results text file from the BFG scan doesn't contain anything at all. It's an empty txt file.

[continuumcomplex]

Heh, I almost forgot to run the thing about the internet. It's still unable to connect, so I ran the program. The following appears in the Keep box:

mswsock.dll
winrnr.dll
nwprovau.dll
mclsp.dll
rsvpsp.dll

[CBMatt]

If the text file was blank, then the folder must not exist anymore.

Those LSP files all check out.

Go ahead and post a new HijackThis log and I'll see if there's anything else.

So far, I'm not seeing anything that would be blocking the internet connection...  Have you contacted her ISP about this matter?

[continuumcomplex]

No, I haven't contacted her ISP because 1. her problem with internet connected began at the same time as her problem with the adware advert popups, etc. and 2. Because i'm on the same network with her, running through the same router and my internet connection works fine.


Logfile of HijackThis v1.99.1
Scan saved at 8:47:39 PM, on 7/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kelly Garrick\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - Unknown owner - c:\program files\mcafee.com\agent\mcdetect.exe (file missing)
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - Unknown owner - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe (file missing)
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

[CBMatt]

The log looks clean to me.  Out of curiosity...did this problem start around the same time that McAfee started acting up?  This is just a hunch, but there's a possibility that McAfee could be a cause.  I've seen something similar happen with McAfee SecurityCenter a couple of times.  In fact, it seems like I've been getting disconnected quite often since disabling a few services.  Since you don't appear to want McAfee anyway, go ahead and take a look here...
http://forums.mcafeehelp.com/viewtopic.php?t=71943

Also, how long has Skype been on her computer?  It could possibly be related as well.