Computer Hope

Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: Alvarezz on December 29, 2010, 04:48:45 AM

Title: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on December 29, 2010, 04:48:45 AM

I've also received the Win 32 host process error. I thought i removed the virus with Malware bytes, but apparently not. Ive completed the steps from here :http://www.computerhope.com/forum/index.php/topic,46313.0.html (http://www.computerhope.com/forum/index.php/topic,46313.0.html). The logs are shown below.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/29/2010 at 01:39 AM

Application Version : 4.47.1000

Core Rules Database Version : 6090
Trace Rules Database Version: 3902

Scan type       : Complete Scan
Total Scan Time : 01:11:42

Memory items scanned      : 465
Memory threats detected   : 0
Registry items scanned    : 6134
Registry threats detected : 0
File items scanned        : 51085
File threats detected     : 105

Adware.Tracking Cookie
   C:\Documents and Settings\Administrator\Cookies\[email protected][1].txt
   C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
   C:\Documents and Settings\Administrator\Cookies\administrator@revsci[1].txt
   C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@2o7[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\system@adbrite[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@adecn[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@advertise[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@advertising[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@adxpose[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@apmebf[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\system@atdmt[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@bizzclick[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\system@clicksense[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@collective-media[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\system@doubleclick[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@enhance[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@fastclick[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@insightexpressai[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@interclick[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@invitemedia[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@media6degrees[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@mediaplex[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@mediatraffic[1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][2].txt
   C:\Documents and Settings\LocalService\Cookies\system@overture[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@pointroll[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@questionmarket[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@realmedia[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@ru4[1].txt
   C:\Documents and Settings\LocalService\Cookies\system@serving-sys[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@technoratimedia[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@trafficmp[2].txt
   C:\Documents and Settings\LocalService\Cookies\system@tribalfusion[2].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\[email protected][1].txt
   C:\Documents and Settings\LocalService\Cookies\system@yieldmanager[1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@accounts[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@accounts[3].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@advertise[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@advertising[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@apmebf[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@atdmt[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@bizzclick[1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@chitika[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@collective-media[1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@doubleclick[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@enhance[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@fastclick[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@interclick[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@invitemedia[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@liveperson[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@lucidmedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@media6degrees[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@mediaplex[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@pointroll[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@pro-market[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@realmedia[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@revsci[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@ru4[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@serving-sys[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@specificclick[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@technoratimedia[2].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@trafficmp[2].txt
   C:\Documents and Settings\NetworkService\Cookies\system@tribalfusion[1].txt
   C:\Documents and Settings\NetworkService\Cookies\system@yieldmanager[1].txt

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on December 29, 2010, 04:49:15 AM

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5414

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512

12/28/2010 10:58:30 PM
mbam-log-2010-12-28 (22-58-30).txt

Scan type: Full scan (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Objects scanned: 204163
Time elapsed: 21 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{549B5CA7-4A86-11D7-A4DF-000874180BB3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdjyajfg (Trojan.Dropper) -> Value: wdjyajfg -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\my computer\local settings\Temp\cahxiovdx\sicynwvlajb.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\my computer\local settings\Temp\0.06013954096114127.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\my computer\local settings\Temp\0.959417049883194.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\system volume information\_restore{babf27af-98b1-46ad-8aee-3507e0dee2fa}\RP198\A0036333.exe (Rogue.SystemTool) -> Quarantined and deleted successfully.
c:\system volume information\_restore{babf27af-98b1-46ad-8aee-3507e0dee2fa}\RP201\A0041389.exe (Rogue.SystemTool) -> Quarantined and deleted successfully.

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on December 29, 2010, 04:50:08 AM

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:27:56 AM, on 12/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Emsisoft\Online Armor\OAcat.exe
C:\Program Files\Emsisoft\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\eM\Bay Reader\Shwicon2k.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Emsisoft\Online Armor\oaui.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Emsisoft\Online Armor\OAhlp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\My Computer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\My Computer\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = facebook.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [showicon2k] C:\Program Files\\eM\Bay Reader\Shwicon2k.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Emsisoft\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\My Computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Emsisoft\Online Armor\OAcat.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Emsisoft\Online Armor\oasrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7679 bytes

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on December 30, 2010, 01:10:15 PM

Hello and welcome to

Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

Download Disable/Remove Windows Messenger  (http://www.majorgeeks.com/DisableRemove_Windows_Messenger_d2327.html) to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.
**********************************************
P2P - I see you have P2P software installed on your machine (LimeWire). We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
***********************************************

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8074
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.
*****************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
**************************************************
Please download ComboFix (http://img7.imageshack.us/img7/4930/combofix.gif) from BleepingComputer.com (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)

Alternate link: GeeksToGo.com (http://subs.geekstogo.com/ComboFix.exe)

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here (http://www.bleepingcomputer.com/forums/topic114351.html)
Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console[/list]
(http://img.photobucket.com/albums/v666/sUBs/Query_RC.gif)
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
(http://img.photobucket.com/albums/v666/sUBs/RC_successful.gif)

Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see  How to use ComboFix (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 01, 2011, 07:57:12 AM

Log for security check:


 Results of screen317's Security Check version 0.99.8 
 Windows XP Service Pack 3 
 Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
 Windows Security Center service is not running! This report may not be accurate!
 Avira AntiVir Personal - Free Antivirus
 Online Armor 4.0   
 Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 CCleaner     
 Java(TM) 6 Update 23 
 Adobe Flash Player 10.0.45.2 
````````````````````````````````
Process Check: 
objlist.exe by Laurent
``````````End of Log````````````

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 01, 2011, 07:58:46 AM

ComboFix log:


ComboFix 10-12-31.02 - My Computer 01/01/2011   6:13.2.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.447.171 [GMT -8:00]
Running from: c:\documents and settings\My Computer\My Documents\Downloads\commy.exe.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Online Armor Firewall *Enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe

.
(((((((((((((((((((((((((   Files Created from 2010-12-01 to 2011-01-01  )))))))))))))))))))))))))))))))
.

2011-01-01 14:02 . 2011-01-01 14:04   --------   d-----w-   C:\32788R22FWJFW
2010-12-29 17:20 . 2010-12-29 17:20   --------   d-s---w-   c:\documents and settings\LocalService\UserData
2010-12-29 11:26 . 2010-12-29 11:26   388096   ----a-r-   c:\documents and settings\My Computer\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-29 11:26 . 2010-12-29 11:26   --------   d-----w-   c:\program files\Trend Micro
2010-12-29 11:07 . 2010-12-29 11:07   --------   d-----w-   c:\program files\Common Files\Java
2010-12-29 11:06 . 2010-11-13 02:53   472808   ----a-w-   c:\windows\system32\deployJava1.dll
2010-12-29 08:18 . 2010-12-29 08:18   --------   d-----w-   c:\documents and settings\My Computer\Application Data\SUPERAntiSpyware.com
2010-12-29 08:18 . 2010-12-29 08:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-12-29 08:16 . 2010-12-29 08:17   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-12-29 07:57 . 2010-12-29 07:57   --------   d-----w-   c:\program files\CCleaner
2010-12-29 07:18 . 2010-12-13 16:40   61960   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2010-12-29 07:18 . 2010-12-13 16:40   135096   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2010-12-29 07:18 . 2010-06-17 22:27   45416   ----a-w-   c:\windows\system32\drivers\avgntdd.sys
2010-12-29 07:18 . 2010-06-17 22:27   22360   ----a-w-   c:\windows\system32\drivers\avgntmgr.sys
2010-12-29 07:18 . 2010-12-29 07:18   --------   d-----w-   c:\program files\Avira
2010-12-29 07:18 . 2010-12-29 07:18   --------   d-----w-   c:\documents and settings\All Users\Application Data\Avira
2010-12-29 06:17 . 2010-12-21 02:09   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-29 06:17 . 2010-12-21 02:08   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-12-29 05:14 . 2010-12-29 07:37   --------   d-----w-   c:\documents and settings\All Users\Application Data\OnlineArmor
2010-12-29 05:14 . 2010-12-29 05:18   --------   d-----w-   c:\documents and settings\My Computer\Application Data\OnlineArmor
2010-12-29 05:13 . 2010-07-07 20:25   22600   ----a-w-   c:\windows\system32\drivers\OAmon.sys
2010-12-29 05:13 . 2010-07-07 20:25   28232   ----a-w-   c:\windows\system32\drivers\OAnet.sys
2010-12-29 05:13 . 2010-07-07 20:25   236104   ----a-w-   c:\windows\system32\drivers\OADriver.sys
2010-12-29 05:13 . 2010-12-29 05:13   --------   d-----w-   c:\program files\Emsisoft
2010-12-29 05:08 . 2010-12-29 05:47   --------   d-----w-   c:\documents and settings\All Users\Application Data\Alwil Software
2010-12-29 05:08 . 2010-12-29 05:08   --------   d-----w-   c:\program files\Alwil Software
2010-12-29 03:39 . 2010-12-29 03:39   --------   d-----w-   c:\windows\system32\wbem\Repository
2010-12-29 03:34 . 2010-12-29 03:34   --------   d-----w-   c:\program files\Common Files\HP
2010-12-29 03:34 . 2010-12-29 03:34   --------   d-----w-   c:\program files\Hewlett-Packard
2010-12-29 03:32 . 2010-12-29 03:32   --------   d-----w-   c:\documents and settings\My Computer\Local Settings\Application Data\Apple
2010-12-29 03:32 . 2010-12-29 03:38   --------   d-----w-   c:\windows\system32\DRVSTORE
2010-12-29 03:31 . 2010-12-29 03:31   --------   d-----w-   c:\documents and settings\All Users\Application Data\Apple
2010-12-22 20:59 . 2010-12-29 03:38   --------   d-----w-   c:\program files\Safari
2010-12-16 22:48 . 2010-12-16 22:48   --------   d-----w-   c:\documents and settings\My Computer\Application Data\Malwarebytes
2010-12-16 22:28 . 2010-12-16 22:28   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-16 22:28 . 2010-12-29 06:17   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-12-16 22:10 . 2010-12-29 03:38   --------   d-s---w-   c:\documents and settings\Administrator
2010-12-16 10:58 . 2010-12-29 03:38   --------   d-----w-   c:\documents and settings\All Users\Application Data\bDeIn06307

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-30 01:38 . 2010-11-30 01:38   94208   ----a-w-   c:\windows\system32\QuickTimeVR.qtx
2010-11-30 01:38 . 2010-11-30 01:38   69632   ----a-w-   c:\windows\system32\QuickTime.qts
2010-11-13 00:34 . 2010-06-16 08:17   73728   ----a-w-   c:\windows\system32\javacpl.cpl
2010-11-03 12:59 . 2010-06-16 03:41   369664   ------w-   c:\windows\system32\html.iec
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\My Computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-16 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-02 4640768]
"nwiz"="nwiz.exe" [2003-05-02 323584]
"CHotkey"="zHotkey.exe" [2003-06-03 496640]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-02 65536]
"RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-06-25 868352]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-06-24 319488]
"showicon2k"="c:\program files\\eM\Bay Reader\Shwicon2k.exe" [2003-07-04 135168]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-09-24 159472]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 49152]
"@OnlineArmor GUI"="c:\program files\Emsisoft\Online Armor\oaui.exe" [2010-07-07 6854984]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

c:\documents and settings\My Computer\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-5-26 503808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\BigFix.exe [2003-4-23 1742384]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-11 282624]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\Emsisoft\ONLINE~1\oaevent.dll" [2010-07-07 924488]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [12/28/2010 9:13 PM 236104]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [12/28/2010 9:13 PM 22600]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [12/28/2010 9:13 PM 28232]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 10:25 AM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 10:41 AM 67656]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/28/2010 11:18 PM 135336]
R2 OAcat;Online Armor Helper Service;c:\program files\Emsisoft\Online Armor\oacat.exe [12/28/2010 9:13 PM 1283400]
R2 SvcOnlineArmor;Online Armor;c:\program files\Emsisoft\Online Armor\oasrv.exe [12/28/2010 9:13 PM 3364680]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [9/24/2010 12:19 PM 268528]
.
Contents of the 'Scheduled Tasks' folder

2010-12-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 18:50]

2010-12-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416578812-2000117343-1721848206-1005Core.job
- c:\documents and settings\My Computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-06-16 03:51]

2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416578812-2000117343-1721848206-1005UA.job
- c:\documents and settings\My Computer\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-06-16 03:51]

2010-06-18 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-04-24 00:17]
.
.
------- Supplementary Scan -------
.
uStart Page = facebook.com
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = <local>
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-WudfPf
SafeBoot-WudfRd



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-01 06:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(464)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL

- - - - - - - > 'explorer.exe'(2836)
c:\program files\Emsisoft\Online Armor\OAwatch.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\System32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\windows\System32\MsPMSPSv.exe
c:\windows\zHotkey.exe
c:\program files\eM\Bay Reader\Shwicon2k.exe
c:\windows\system32\ZuneBusEnum.exe
c:\program files\Emsisoft\Online Armor\OAhlp.exe
c:\program files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2011-01-01  06:36:13 - machine was rebooted
ComboFix-quarantined-files.txt  2011-01-01 14:36

Pre-Run: 131,572,326,400 bytes free
Post-Run: 131,819,802,624 bytes free

- - End Of File - - F78B4FB3575AE802677DF8A84655B920

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 01, 2011, 04:23:00 PM

SysProt Antirootkit

Download
SysProt Antirootkit from the link below (you will find it at the bottom
of the page under attachments, or you can get it from one of the
mirrors).

http://sites.google.com/site/sysprotantirootkit/ (http://sites.google.com/site/sysprotantirootkit/)

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
• Click on the Log tab.
• In the Write to log box select the following items.
• Process << Selected
  
• Kernel Modules << Selected
  
• SSDT << Selected
  
• Kernel Hooks << Selected
  
• IRP Hooks << NOT Selected
  
• Ports << NOT Selected
  
• Hidden Files << Selected
  
• At the bottom of the page
• Hidden Objects Only << Selected
  
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The

log will be saved automatically in the same folder Sysprot.exe was
extracted to. Open the text file and copy/paste the log here.
[/list].

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 03, 2011, 06:59:46 AM

I had trouble using the antirootkit program at first. When I clicked create a log it would restart my computer. I had to do it in safe mode. I am not sure if this is important information.



SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
No Hidden Kernel Modules found

******************************************************************************************
******************************************************************************************
No SSDT Hooks found

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
No hidden files/folders found

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 03, 2011, 01:18:02 PM

Ok. Let's try another one.

Download the GMER Rootkit Scanner (http://www.gmer.net/gmer.zip). Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
• Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 03, 2011, 03:58:19 PM

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-03 14:57:36
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD1600AB-00DYA0 rev.15.05R15
Running: gmer.exe; Driver: C:\DOCUME~1\MYCOMP~1\LOCALS~1\Temp\fxaoykow.sys


---- System - GMER 1.0.15 ----

SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwAllocateVirtualMemory [0xB23B6ED0]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwAssignProcessToJobObject [0xB23B7700]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwConnectPort [0xB23B4DA0]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwCreateFile [0xB23C49C0]
SSDT            AC2099DE                                                                                                                                                                       ZwCreateKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwCreatePort [0xB23B48E0]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwCreateProcess [0xB23B1620]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwCreateProcessEx [0xB23B1A30]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwCreateSection [0xB23B0EF0]
SSDT            AC2099D4                                                                                                                                                                       ZwCreateThread
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwDebugActiveProcess [0xB23B3B90]
SSDT            AC2099E3                                                                                                                                                                       ZwDeleteKey
SSDT            AC2099ED                                                                                                                                                                       ZwDeleteValueKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwDuplicateObject [0xB23B46F0]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwLoadDriver [0xB23B6490]
SSDT            AC2099F2                                                                                                                                                                       ZwLoadKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwOpenFile [0xB23C5040]
SSDT            AC2099C0                                                                                                                                                                       ZwOpenProcess
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwOpenSection [0xB23B1310]
SSDT            AC2099C5                                                                                                                                                                       ZwOpenThread
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwProtectVirtualMemory [0xB23B7350]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwQueryDirectoryFile [0xB23B6A70]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwQueueApcThread [0xB23B78A0]
SSDT            AC2099FC                                                                                                                                                                       ZwReplaceKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwRequestPort [0xB23B59A0]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwRequestWaitReplyPort [0xB23B5F90]
SSDT            AC2099F7                                                                                                                                                                       ZwRestoreKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwResumeThread [0xB23B4340]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSecureConnectPort [0xB23B5190]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSetContextThread [0xB23B3970]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSetSystemInformation [0xB23B3D30]
SSDT            AC2099E8                                                                                                                                                                       ZwSetValueKey
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwShutdownSystem [0xB23B6370]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSuspendProcess [0xB23B4520]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSuspendThread [0xB23B4130]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwSystemDebugControl [0xB23B3F40]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwTerminateProcess [0xB23B2C80]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwTerminateThread [0xB23B3760]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwUnloadDriver [0xB23B6780]
SSDT            \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Emsisoft)                                                                                                       ZwWriteVirtualMemory [0xB23B7520]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 104                                                                                                                                       804E2770 12 Bytes  [E0, 48, 3B, B2, 20, 16, 3B, ...]
.text           ntoskrnl.exe!_abnormal_termination + 428                                                                                                                                       804E2A94 4 Bytes  CALL 8FFA4B32
.text           ntoskrnl.exe!_abnormal_termination + 440                                                                                                                                       804E2AAC 12 Bytes  [20, 45, 3B, B2, 30, 41, 3B, ...] {AND [EBP+0x3b], AL; MOV DL, 0x30; INC ECX; CMP ESI, [EDX-0x4dc4c0c0]}
init            C:\WINDOWS\system32\drivers\nvax.sys                                                                                                                                           entry point in "init" section [0xF68D7C9E]
init            C:\WINDOWS\System32\Drivers\sunkfilt.sys                                                                                                                                       entry point in "init" section [0xF78472E0]

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!FreeLibrary + 15                                                                                                               7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\system32\winlogon.exe[468] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\system32\services.exe[512] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\system32\lsass.exe[524] kernel32.dll!FreeLibrary + 15                                                                                                               7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\system32\svchost.exe[684] kernel32.dll!FreeLibrary + 15                                                                                                             7C80AC93 4 Bytes  CALL 71AF003D
.text           ...                                                                                                                                                                           
.text           C:\WINDOWS\System32\svchost.exe[784] ntdll.dll!NtProtectVirtualMemory                                                                                                          7C90D6EE 5 Bytes  JMP 007F000A
.text           C:\WINDOWS\System32\svchost.exe[784] ntdll.dll!NtWriteVirtualMemory                                                                                                            7C90DFAE 5 Bytes  JMP 0080000A
.text           C:\WINDOWS\System32\svchost.exe[784] ntdll.dll!KiUserExceptionDispatcher                                                                                                       7C90E47C 5 Bytes  JMP 007E000C
.text           C:\WINDOWS\System32\svchost.exe[784] kernel32.dll!FreeLibrary + 15                                                                                                             7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\System32\svchost.exe[784] USER32.dll!GetCursorPos                                                                                                                   7E42974E 5 Bytes  JMP 017D000A
.text           C:\WINDOWS\System32\svchost.exe[784] ole32.dll!CoCreateInstance                                                                                                                774FF1AC 5 Bytes  JMP 00C6000A
.text           C:\WINDOWS\system32\svchost.exe[836] kernel32.dll!FreeLibrary + 15                                                                                                             7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\Program Files\BigFix\BigFix.exe[924] kernel32.dll!LoadLibraryExW + C4                                                                                                       7C801BB9 4 Bytes  CALL 00E90001
.text           C:\Program Files\BigFix\BigFix.exe[924] kernel32.dll!CreateProcessW                                                                                                            7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\BigFix\BigFix.exe[924] kernel32.dll!CreateProcessA                                                                                                            7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\Program Files\BigFix\BigFix.exe[924] kernel32.dll!FreeLibrary + 15                                                                                                          7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\Program Files\BigFix\BigFix.exe[924] ADVAPI32.dll!CreateServiceA                                                                                                            77E37211 6 Bytes  JMP 5F130F5A
.text           C:\Program Files\BigFix\BigFix.exe[924] ADVAPI32.dll!CreateServiceW                                                                                                            77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\Program Files\BigFix\BigFix.exe[924] USER32.dll!ExitWindowsEx                                                                                                               7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\Program Files\BigFix\BigFix.exe[924] IPHLPAPI.DLL!IcmpSendEcho2                                                                                                             76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!FreeLibrary + 15                                                                                                             7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] kernel32.dll!LoadLibraryExW + C4                                                                                    7C801BB9 4 Bytes  CALL 00C70001
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] kernel32.dll!CreateProcessW                                                                                         7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] kernel32.dll!CreateProcessA                                                                                         7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] kernel32.dll!FreeLibrary + 15                                                                                       7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] USER32.dll!ExitWindowsEx                                                                                            7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] ADVAPI32.dll!CreateServiceA                                                                                         77E37211 6 Bytes  JMP 5F130F5A
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] ADVAPI32.dll!CreateServiceW                                                                                         77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[1072] IPHLPAPI.DLL!IcmpSendEcho2                                                                                          76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\WINDOWS\Explorer.EXE[1124] ntdll.dll!NtProtectVirtualMemory                                                                                                                 7C90D6EE 5 Bytes  JMP 00A8000A
.text           C:\WINDOWS\Explorer.EXE[1124] ntdll.dll!NtWriteVirtualMemory                                                                                                                   7C90DFAE 5 Bytes  JMP 00A9000A
.text           C:\WINDOWS\Explorer.EXE[1124] ntdll.dll!KiUserExceptionDispatcher                                                                                                              7C90E47C 5 Bytes  JMP 00A2000C
.text           C:\WINDOWS\Explorer.EXE[1124] kernel32.dll!FreeLibrary + 15                                                                                                                    7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\Explorer.EXE[1124] ADVAPI32.dll!CreateServiceA                                                                                                                      77E37211 6 Bytes  JMP 5F130F5A
.text           C:\WINDOWS\Explorer.EXE[1124] ADVAPI32.dll!CreateServiceW                                                                                                                      77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\WINDOWS\Explorer.EXE[1124] USER32.dll!ExitWindowsEx                                                                                                                         7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\WINDOWS\Explorer.EXE[1124] IPHLPAPI.DLL!IcmpSendEcho2                                                                                                                       76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\WINDOWS\system32\svchost.exe[1132] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\Program Files\Emsisoft\Online Armor\OAcat.exe[1208] kernel32.dll!FreeLibrary + 15                                                                                           7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\system32\spoolsv.exe[1352] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\WINDOWS\System32\svchost.exe[1440] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71AF003D
.text           C:\Program Files\iPod\bin\iPodService.exe[1468] kernel32.dll!FreeLibrary + 15                                                                                                  7C80AC93 4 Bytes  CALL 71B0003D
.text           ...                                                                                                                                                                           
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] kernel32.dll!LoadLibraryExW + C4                                                                                                  7C801BB9 4 Bytes  CALL 00980001
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] kernel32.dll!CreateProcessW                                                                                                       7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] kernel32.dll!CreateProcessA                                                                                                       7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] kernel32.dll!FreeLibrary + 15                                                                                                     7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] ADVAPI32.dll!CreateServiceA                                                                                                       77E37211 6 Bytes  JMP 5F130F5A
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] ADVAPI32.dll!CreateServiceW                                                                                                       77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] USER32.dll!ExitWindowsEx                                                                                                          7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\Program Files\Zune\ZuneLauncher.exe[2464] IPHLPAPI.DLL!IcmpSendEcho2                                                                                                        76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] kernel32.dll!LoadLibraryExW + C4                                                                                        7C801BB9 4 Bytes  CALL 00D00001
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] kernel32.dll!CreateProcessW                                                                                             7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] kernel32.dll!CreateProcessA                                                                                             7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] kernel32.dll!FreeLibrary + 15                                                                                           7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] USER32.dll!ExitWindowsEx                                                                                                7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] ADVAPI32.dll!CreateServiceA                                                                                             77E37211 6 Bytes  JMP 5F130F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] ADVAPI32.dll!CreateServiceW                                                                                             77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2524] IPHLPAPI.DLL!IcmpSendEcho2                                                                                              76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] kernel32.dll!LoadLibraryExW + C4                                                                                                         7C801BB9 4 Bytes  CALL 00C40001
.text           C:\WINDOWS\system32\wuauclt.exe[2588] kernel32.dll!CreateProcessW                                                                                                              7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] kernel32.dll!CreateProcessA                                                                                                              7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] kernel32.dll!FreeLibrary + 15                                                                                                            7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\WINDOWS\system32\wuauclt.exe[2588] ADVAPI32.dll!CreateServiceA                                                                                                              77E37211 6 Bytes  JMP 5F130F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] ADVAPI32.dll!CreateServiceW                                                                                                              77E373A9 6 Bytes  JMP 5F160F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] USER32.dll!ExitWindowsEx                                                                                                                 7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\WINDOWS\system32\wuauclt.exe[2588] IPHLPAPI.DLL!IcmpSendEcho2                                                                                                               76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] kernel32.dll!LoadLibraryExW + C4                                                                         7C801BB9 4 Bytes  CALL 00CE0001
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] kernel32.dll!CreateProcessW                                                                              7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] kernel32.dll!CreateProcessA                                                                              7C80236B 6 Bytes  JMP 5F040F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] kernel32.dll!FreeLibrary + 15                                                                            7C80AC93 4 Bytes  CALL 71B0003D
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] USER32.dll!ExitWindowsEx                                                                                 7E45A275 6 Bytes  JMP 5F0D0F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] ADVAPI32.dll!CreateServiceA                                                                              77E37211 6 Bytes  JMP 5F1B0F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] ADVAPI32.dll!CreateServiceW                                                                              77E373A9 6 Bytes  JMP 5F1E0F5A
.text           C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe[2768] IPHLPAPI.DLL!IcmpSendEcho2                                                                               76D6B73C 6 Bytes  JMP 5F100F5A
.text           C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe[2848] kernel32.dll!LoadLibraryExW + C4                                                                   7C801BB9 4 Bytes  CALL 00C40001
.text           C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe[2848] kernel32.dll!CreateProcessW                                                                        7C802336 6 Bytes  JMP 5F0A0F5A
.text           C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe[2848] kernel32.dll!Crea

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 03, 2011, 05:01:22 PM

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
 ESET OnlineScan (http://eset.com/onlinescan)
•Click the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetOnline.png) button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstall.png) to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetSmartInstallDesktopIcon.png) icon on your desktop.
  

•Check (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetAcceptTerms.png)
•Click the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetStart.png) button.
•Accept any security warnings from your browser.
•Check (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetScanArchives.png)
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png)
•Push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png), and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetBack.png) button.
•Push (http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetFinish.png)
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 03, 2011, 06:24:25 PM

List of found threats:

C:\Documents and Settings\My Computer\Application Data\Sun\Java\Deployment\cache\6.0\11\16818dcb-46ffdd4c   multiple threats
C:\Documents and Settings\My Computer\Application Data\Sun\Java\Deployment\cache\6.0\57\5d9759b9-15255d96   multiple threats



ESET log:


ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=c298a35f58f44f4e94e0cebb8fde2f79
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-01-04 01:21:03
# local_time=2011-01-03 05:21:03 (-0800, Pacific Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775141 100 93 0 30518091 156709 0
# compatibility_mode=6401 16777214 66 100 0 15477968 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=71237
# found=2
# cleaned=0
# scan_time=3724
C:\Documents and Settings\My Computer\Application Data\Sun\Java\Deployment\cache\6.0\11\16818dcb-46ffdd4c   multiple threats (unable to clean)   00000000000000000000000000000000   I
C:\Documents and Settings\My Computer\Application Data\Sun\Java\Deployment\cache\6.0\57\5d9759b9-15255d96   multiple threats (unable to clean)   00000000000000000000000000000000   I

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 04, 2011, 04:46:24 PM

Download Dr.Web CureIt to the desktop:
DrWebCureIt (http://download.cnet.com/Dr-Web-CureIt/3000-2239_4-128071.html)

• Double-click the launch.exe or cureit.exe file and Allow to run the express scan
  
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, just let it cure whatever it finds...

  o Now, go to Settings >> Change Settings
  o Go to Actions tab >> under Objects section, change the settings to below
  Infected objects - Cure
  Incurable objects - Report
  Suspicious objects - Report
  o Don't change any other settings

• Start the scan again. This time, choose Complete Scan
  
• Click the green arrow button at the right, and the scan will start.
• After the scan finished, click Select all
  
• Click on Cure and choose Report incurable (means take no actions.. Don't "move", or "rename" or "delete")
  
• When the scan has finished, in the menu, click File and choose Save report list
  
• Save the report to your Desktop. The report will be called DrWeb.csv
• Post DrWeb.csv in your next reply (Open it as Notepad).. Do NOT reboot the computer yet..
  

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 08, 2011, 10:43:10 PM

The link you provided does not work. Is there another link?

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 09, 2011, 07:33:01 PM

Sorry. I think I fixed the link.

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 12, 2011, 08:41:31 AM

Thanks for the fix :) Okay, the complete scan finished, however, there is no option to report incurable. Should I just save the report list and exit  the program afterwards? ???

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 12, 2011, 12:11:42 PM

Please try running the ESET scan again.

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on January 14, 2011, 07:41:39 PM

Dr web Report list


Process in memory: C:\WINDOWS\system32\svchost.exe:744;;BackDoor.Tdss.565;Eradicated.;
f_0005c3;C:\Documents and Settings\My Computer\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache(2);Probably SCRIPT.Virus;Incurable.Moved.;
sma_common[1].js;C:\Documents and Settings\My Computer\Local Settings\Temporary Internet Files\Content.IE5\SLEFKDEB;Probably SCRIPT.Virus;Incurable.Moved.;
change.log.1;C:\System Volume Information\_restore{BABF27AF-98B1-46AD-8AEE-3507E0DEE2FA}\RP173;Modification of Trojan.DownLoad1.17823;Incurable.Moved.;
sma_common.js;I:\common\inc;Probably SCRIPT.Virus;;
sprt_common.js;I:\sprtcommon\inc;Probably SCRIPT.Virus;;

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on January 15, 2011, 12:26:37 PM

That  looks good. If there are no other issues, let's cleanup. You may keep SAS and MBAM, if you wish. Update them and run them regularly.

Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.
**********************************************
To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.
This will give you a new, clean Restore Point.
********************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
******************************************
Use the Secunia Software Inspector (http://secunia.com/software_inspector) to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update (http://windowsupdate.microsoft.com/) and get all critical updates.

----------

I suggest using WOT - Web of Trust (http://www.mywot.com/). WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer (http://www.bleepingcomputer.com/forums/tutorial49.html) from Spyware and Malware
* If you don't know what ActiveX controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html)

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. (http://www.safer-networking.org/en/spybotsd/index.html) Guide: Use Spybot's Immunize Feature (http://www.bleepingcomputer.com/tutorials/tutorial43.html#immunize) to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ (http://www.safer-networking.org/en/faq/index.html)

Check out Keeping Yourself Safe On The Web  (http://evilfantasy.wordpress.com/2008/05/20/keeping-yourself-safe-on-the-web/) for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware (http://evilfantasy.wordpress.com/2008/05/24/slow-computer-it-may-not-be-malware/) for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: Alvarezz on March 13, 2011, 05:43:21 PM

What are the programs that OTL is supposed to remove?
If they are not removed will it make my computer slow to start up?

Title: Re: "System Tool 2011" virus + Taskbar keeps swithching themes
Post by: SuperDave on March 13, 2011, 07:11:41 PM

Quote

What are the programs that OTL is supposed to remove?
If they are not removed will it make my computer slow to start up?

They will not make your slow to start unless you have them running at startup. Here's a handy program to check to see what's running at startup.
!Killbox
*.run
_backupD
_OTL
_OTListIt
_OTM
_OTMoveIt
_OTS
_OTScanIt
404fix.exe
Avenger
avenger.exe
avenger.txt
avenger.zip
AWF.txt
BFU
bfu.zip
catchme
catchme.exe
cleanup.txt
ComboFix
ComboFix*.txt
combofix.exe
combo-fix.exe
Combo-Fix.sys
dds.com
dds.pif
dds.scr
Deckard
delete.bat
deljob
deljob.exe
dss.exe
dumphive.exe
erdnt\subs
Extras.txt
fdsv.exe
FindAWF.exe
fixwareout
fixwareout.exe
fsbl*.log
fsbl.exe
gmer
gmer.dll
gmer.exe
gmer.ini
gmer.log
gmer.sys
gmer_uninstall.cmd
grep.exe
haxfix.exe
haxfix.txt
iedfix.exe
killbox.exe
logit.txt
Lop SD
lopR.txt
LopSD.exe
moveex.exe
nircmd.exe
NoLop.exe
NoLop.txt
NoLopOLD.txt
OTL.exe
OTL.txt
OTListIt.txt
OTListIt2.exe
OTM.exe
OTMoveIt.exe
OTMoveIt2.exe
OTMoveIt3.exe
OTS.exe
OTS.txt
OTScanIt
OTScanIt.exe
OTScanIt2
OTScanIt2.exe
OTViewIt.exe
OTViewIt.txt
QooBox
rapport.txt
Rooter$
Rooter.exe
Rooter.txt
RSIT
RSIT.exe
Runscanner
Runscanner.exe
Runscanner.net
Runscanner.zip
Rustbfix
rustbfix.exe
SDFix
sdfix.exe
sed.exe
Silent Runners.vbs
SmitfraudFix
SmitfraudFix.exe
swreg.exe
Swsc.exe
Swxcacls.exe
SysInsite
tmp.reg
vacfix.exe
vcclsid.exe
VFind.exe
VundoFix Backups
VundoFix.exe
vundofix.txt
vundofix.vft
win32delfkil.exe
windelf.txt
WinPfind
winpfind.exe
WinPFind35u
WinPFind35u.exe
WinPFind3u
WinPFind3u.exe
WS2Fix.exe
zip.exe
StartupLite

Download StartupLite by MalwareBytes (http://www.malwarebytes.org/StartUpLite.exe) to your Desktop.
Doubleclick StartupLite.exe to launch the program.
Ensure the Disable box is checked.
Click Continue.
A pop up message will tell you the unecessary startup items in your list have been disabled and ask you to restart your computer.
Re-start your computer.