"Antivirus XP" turns to system shutdown, unable to dl, blocking websites?

Question

agent rotary 0 Newbie Poster

16 Years Ago

Hello,

Just a few days ago I was in IE (regrets!) just because I thought it would be quicker than opening Firefox for some odd reason and...promptly picked up the "Antivirus XP" issue. I was pretty easily able to find the cause of the pop-up agreement, deleted the screensaver and background and thought it was done.

Unfortunately, the search engine/web page redirects persist and now, certain websites will not work for me. Especially the sites with alternate malware detectors. Those really don't like to work. Even under safemode, I've been unable to download any. Thankfully, I have hijackthis logs and I know pray someone here may have a possible solution:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:27:37 AM, on 8/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [ ] C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://smg.photobucket.com
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/online2/pogo/mahjong_escape_ancient/PTGameLauncher.cab
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6020 bytes

suggestions are appreciated!

windows-virus

2 Contributors
8 Replies
223 Views
1 Day Discussion Span
Latest Post 16 Years Ago Latest Post by crunchie

crunchie 990 Most Valuable Poster

16 Years Ago

Hi and welcome to the Daniweb forums :).

==========

Try and download this one;

Download
SDFix
and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the
following :

Restart your computer
After hearing your computer beep once during startup, but before the
Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose Extract
All,
Open the extracted folder and double click RunThis.bat to
start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the
registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool
will be running and removing files.
When the desktop loads the Fixtool will complete the removal and
display Finished, then press any key to end the script and load
your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the
contents of the results file Report.txt back onto the forum with
a new HijackThis log.
Please post the SDFix log within CODE Tags.

If you have trouble getting it, let me know and I will try and upload it or email it to you.

crunchie 990 Most Valuable Poster

16 Years Ago

with
a new HijackThis log.

I requested an hijackthis log too.

Try deleting the following two files and let me know if you succeed;

C:\WINDOWS\system32\a.exe
C:\WINDOWS\system32\sysrest32.exe

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

agent rotary 0 Newbie Poster · Answer 1 · 2008-08-29T20:55:26+00:00

It was an epic battle to get SDFix, but thankfully its small size appears to have made it possible with multiple attempts (in safe mode, even).

this is what it said:

[b]SDFix: Version 1.220 [/b]
Run by Madame Rotary on Fri 08/29/2008 at 09:58 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\Madame Rotary\Desktop\SDFix\SDFix

[b]Checking Services [/b]:

[b]Name [/b]: 
sysrest.sys

[b]Path [/b]:
\??\C:\WINDOWS\system32\sysrest.sys 

sysrest.sys - Deleted



Restoring Default Security Values
Restoring Default Hosts File
Restoring Default Desktop Wallpaper

agent rotary 0 Newbie Poster · Answer 2 · 2008-08-29T23:59:16+00:00

After that fix, my computer forced a reboot through the "Service and Controller app" problem reboot through system32/services. exe, error 1073741819. Then it ran again and it said this:

[b]SDFix: Version 1.220 [/b]
Run by Madame Rotary on Fri 08/29/2008 at 09:58 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\Madame Rotary\Desktop\SDFix\SDFix

[b]Checking Services [/b]:

[b]Name [/b]: 
sysrest.sys

[b]Path [/b]:
\??\C:\WINDOWS\system32\sysrest.sys 

sysrest.sys - Deleted



Restoring Default Security Values
Restoring Default Hosts File
Restoring Default Desktop Wallpaper  

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\phcr6mj0ej59.bmp - Deleted
C:\Documents and Settings\Madame Rotary\xrt_cyjy.exe - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt168E.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1692.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt16C3.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1712.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1759.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1770.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1779.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1783.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1786.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt178B.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt178D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt178F.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1791.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1797.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt179D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17A0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17A2.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17A8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17AA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17AC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17AF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17B1.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17B3.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17B5.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17B7.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17B9.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17BC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17BE.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17C0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17C2.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17C4.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17C6.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17C9.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17CB.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17CD.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17CF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17D1.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17D3.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17D6.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17D8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17DA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17DC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17DE.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17E0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17E6.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17E8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17EA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17EC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17EE.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17F0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17F3.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17F5.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17F8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17FA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17FC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt17FF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1802.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1805.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1807.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt180B.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt180D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt180F.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1812.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1818.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt182D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1836.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1845.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1878.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1893.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt18AA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt18BB.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt18F1.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1909.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt190F.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1915.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1918.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt191A.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1925.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1946.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt195D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1985.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt198A.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1993.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt19A9.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CAD.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CB4.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CD0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CD9.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CDF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CE5.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CEB.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CF1.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CF9.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CFF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D06.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D0C.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D12.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D18.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D1E.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D24.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D2A.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D30.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D36.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D3C.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D42.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D48.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D4E.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D54.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D5A.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D60.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D66.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D6C.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D72.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D78.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D7E.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D84.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D8A.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D90.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D96.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1D9C.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DA2.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DA8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DAE.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DB4.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DBA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DC0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DC8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DCE.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DD4.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DDA.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DE0.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DE6.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DEC.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DF2.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DF8.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1DFF.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E05.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E0B.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E11.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E17.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E1D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E23.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E29.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E2F.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E4D.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1E6E.tmp - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt168E.tmp.vbs - Deleted
C:\DOCUME~1\MADAME~1\LOCALS~1\Temp\.tt1CAD.tmp.vbs - Deleted
C:\WINDOWS\system32\drivers\tdssserv.sys  - Deleted
C:\WINDOWS\system32\sysrest.sys  - Deleted
C:\WINDOWS\system32\tdssadw.dll  - Deleted
C:\WINDOWS\system32\tdssinit.dll  - Deleted
C:\WINDOWS\system32\tdssl.dll  - Deleted
C:\WINDOWS\system32\tdsslog.dll  - Deleted
C:\WINDOWS\system32\tdssmain.dll  - Deleted
C:\WINDOWS\system32\tdssservers.dat  - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 12:02:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5d,d3,6f,da,74,01,fa,a4,8a,e4,f0,2e,35,15,dc,47,2d,a6,dc,d1,f4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:62,bf,56,f0,8d,c1,a2,f4,db,41,f3,07,b5,dd,19,fb,ea,7d,7b,c4,94,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:05,67,bc,98,d7,34,64,ae,7a,d9,30,18,ac,9d,c9,4c,30,a2,60,0b,5f,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdssserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5d,d3,6f,da,74,01,fa,a4,8a,e4,f0,2e,35,15,dc,47,2d,a6,dc,d1,f4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:62,bf,56,f0,8d,c1,a2,f4,db,41,f3,07,b5,dd,19,fb,ea,7d,7b,c4,94,..
"d0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:05,67,bc,98,d7,34,64,ae,7a,d9,30,18,ac,9d,c9,4c,30,a2,60,0b,5f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdssserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers\TDSSserv.sys"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\utorrent.exe"="C:\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"="C:\\Program Files\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe:*:Enabled:LastFM"
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe:*:Enabled:P2P Networking"
"C:\\Program Files\\Kazaa\\kazaa.exe"="C:\\Program Files\\Kazaa\\kazaa.exe:*:Enabled:Kazaa"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Trillian\\trillian.exe"="C:\\Program Files\\Trillian\\trillian.exe:*:Enabled:Trillian"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Documents and Settings\\Madame Rotary\\My Documents\\my games\\Nintendo Games\\EMULATOR1 - NESTICLE.exe"="C:\\Documents and Settings\\Madame Rotary\\My Documents\\my games\\Nintendo Games\\EMULATOR1 - NESTICLE.exe:*:Disabled:EMULATOR1 - NESTICLE"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\WINDOWS\\system32\\a.exe"="C:\\WINDOWS\\system32\\a.exe:*:Disabled:a"
"C:\\WINDOWS\\system32\\sysrest32.exe"="C:\\WINDOWS\\system32\\sysrest32.exe:*:Enabled:enable"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:Windows Explorer"
"C:\\WINDOWS\\system32\\services.exe"="C:\\WINDOWS\\system32\\services.exe:*:Enabled:enable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\MADAME~1\Desktop\SDFix\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Fri 16 Mar 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 17 May 2007           399 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti43.tmp"
Wed 17 Nov 2004        94,458 A..H. --- "C:\Program Files\Nero\data\Nero PhotoShow Express.exe"

[b]Finished![/b]

Firefox also stopped working, so I uninstalled that, but this startup is an issue, I'm actually racing against time to post now, so I'm not sure if fixing the problem caused more problem or if this is now an entirely different issue.

agent rotary 0 Newbie Poster · Answer 3 · 2008-08-30T09:43:45+00:00

thanks so much for your help already, Crunchie. Unfortunately both those files are not found in my system32 folder anymore. This is my third try trying to post this; I think I hvae afalse svchost.exe that's draining my CPU usage and, of course, my computer constantly rebooting (even in safe mode!). Sorry for missing the hijack this log, it is below taken as of five minutes ago:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:34:18 PM, on 8/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [ ] C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://smg.photobucket.com
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/online2/pogo/mahjong_escape_ancient/PTGameLauncher.cab
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5931 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2008-08-30T11:14:08+00:00

Try this if you can;

Please go to Jotti's or to virustotal and have these files scanned. Post the results back here.

C:\WINDOWS\system32\rdssrv.exe
C:\WINDOWS\system32\rdshost.dll
C:\WINDOWS\system32\hdfkt.dll

==

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

agent rotary 0 Newbie Poster · Answer 5 · 2008-08-30T11:58:58+00:00

Thanks again, crunchie. The computer appears to be not restarting itself as long as I'm in safe mode. However, when not in safe mode, the system seeks to reboot in less than five minutes and often less than three.

Notably, I don't appear to have a rdssrv.exe or hdfkt.dll. I double-checked my logs, the files you listed, and my folder multiple times to ensure I wasn't making any errors. Would that possibly be the error?

Here's what combofix had to say:

ComboFix 08-08-29.02 - Madame Rotary 2008-08-30  1:27:05.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.780 [GMT -4:00]
Running from: C:\Documents and Settings\Madame Rotary\Desktop\ComboFix.exe

[b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\bin.clearspring.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\interclick.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\interclick.com\ud.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\static.youku.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Program Files\Altnet
C:\Program Files\Altnet\DBBackup\Sigfiles.db
C:\Program Files\Altnet\Download Manager\adm25.dll
C:\Program Files\Altnet\Download Manager\adm4.dll
C:\Program Files\Altnet\Download Manager\adm4005.exe
C:\Program Files\Altnet\Download Manager\admdata.dll
C:\Program Files\Altnet\Download Manager\admdloader.dll
C:\Program Files\Altnet\Download Manager\admfdi.dll
C:\Program Files\Altnet\Download Manager\admprog.dll
C:\Program Files\Altnet\Download Manager\altnetuninstall.exe
C:\Program Files\Altnet\Download Manager\asm.exe
C:\Program Files\Altnet\Download Manager\asmend.exe
C:\Program Files\Altnet\Download Manager\asmps.dll
C:\Program Files\Altnet\Download Manager\dminfo3.cab
C:\Program Files\Altnet\Download Manager\dminstall7.cab
C:\Program Files\Altnet\Download Manager\dmsetup.bmp
C:\Program Files\Altnet\Download Manager\dmsetupbig.bmp
C:\Program Files\Altnet\Download Manager\jsinstall.cab
C:\Program Files\Altnet\Download Manager\jslegals.txt
C:\Program Files\Altnet\Download Manager\selectdir.txt
C:\Program Files\Altnet\Download Manager\selectdir1st.txt
C:\Program Files\Altnet\Download Manager\Thumbs.db
C:\WINDOWS\cdmxtras
C:\WINDOWS\cdmxtras\uninst.exe
C:\WINDOWS\Fonts\acrsec.fon
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\AdCache
C:\WINDOWS\system32\cache329

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Service_tdssserv


(((((((((((((((((((((((((   Files Created from 2008-07-28 to 2008-08-30  )))))))))))))))))))))))))))))))
.

2008-08-30 01:20 . 2008-08-30 01:20	<DIR>	d---s----	C:\Documents and Settings\Madame Rotary\UserData
2008-08-30 00:13 . 2008-08-30 00:13	552	--a------	C:\WINDOWS\system32\d3d8caps.dat
2008-08-29 23:41 . 2007-02-13 15:14	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Snapfish
2008-08-29 23:41 . 2007-01-15 13:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Simple Star
2008-08-29 23:41 . 2007-01-15 13:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Ahead
2008-08-29 23:41 . 2008-08-29 23:41	<DIR>	d--------	C:\Documents and Settings\Administrator
2008-08-29 09:52 . 2008-08-29 09:52	<DIR>	d--------	C:\WINDOWS\ERUNT
2008-08-28 14:25 . 2008-08-28 14:25	<DIR>	dr-------	C:\Program Files\Norton Support
2008-08-28 12:00 . 2008-08-29 23:32	86,528	--a------	C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys
2008-08-28 12:00 . 2008-08-28 12:00	3	--a------	C:\temp.tmp
2008-08-27 23:47 . 2008-08-27 23:51	<DIR>	d--------	C:\fixwareout
2008-08-27 23:30 . 2008-08-27 23:30	<DIR>	d--------	C:\Program Files\Trend Micro
2008-08-27 13:17 . 2008-08-27 13:20	<DIR>	d--------	C:\Program Files\XoftSpySE
2008-08-27 01:50 . 2008-08-27 01:50	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\NVIDIA
2008-08-26 15:41 . 2008-08-26 15:41	<DIR>	d--------	C:\Program Files\Symantec
2008-08-26 15:41 . 2008-08-26 15:43	<DIR>	d--------	C:\Program Files\Common Files\Symantec Shared
2008-08-26 15:41 . 2008-08-26 15:41	124,464	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-26 15:41 . 2008-08-26 15:41	60,808	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-26 15:41 . 2008-08-26 15:41	35,888	-ra------	C:\WINDOWS\system32\drivers\SymIM.sys
2008-08-26 15:41 . 2008-08-26 15:41	10,635	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-26 15:41 . 2008-08-26 15:41	806	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\WINDOWS\system32\drivers\NIS
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\Windows Sidebar
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\NortonInstaller
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\Norton Internet Security
2008-08-26 15:40 . 2008-08-26 15:42	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-08-26 15:40 . 2008-08-26 15:41	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Norton
2008-08-26 01:24 . 2008-08-27 23:48	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Application Data\COMCASTTOOLBAR
2008-08-26 01:24 . 2008-08-28 23:28	12,288	--a------	C:\WINDOWS\system32\tdssserf.dll
2008-08-07 11:36 . 2008-08-07 11:36	<DIR>	d--------	C:\My Music
2008-07-21 16:03 . 2008-07-21 16:15	<DIR>	d--------	C:\WINDOWS\system32\CatRoot_bak
2008-07-04 12:43 . 2008-07-04 12:43	<DIR>	d--------	C:\Documents and Settings\Madame Rotary\Application Data\Amazon
2008-07-04 12:38 . 2008-07-04 12:38	<DIR>	d--------	C:\Program Files\Amazon

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 06:52	---------	d-----w	C:\Program Files\Trillian
2008-08-29 05:03	---------	d-----w	C:\Program Files\Java
2008-08-23 15:25	---------	d-----w	C:\Documents and Settings\Madame Rotary\Application Data\uTorrent
2008-07-20 04:20	---------	d-----w	C:\Program Files\ABC Amber LIT Converter
2008-06-13 06:49	3,532	----a-w	C:\drmHeader.bin
.

------- Sigcheck -------

2008-04-13 20:12  507904  ed0ef0a136dec83df69f04118870003e	C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
2008-08-26 01:24  502272  9b1bd82bd0761b5ba986af66d2809c30	C:\WINDOWS\system32\winlogon.exe
2004-08-04 08:00  502272  01c3346c241652f43aed8e2149881bfe	C:\WINDOWS\system32\dllcache\winlogon.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 20:28 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 05:46 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 00:01 185896]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 08:00 158208]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 13:22 86016 C:\WINDOWS\system32\nvmctray.dll]

C:\Documents and Settings\Madame Rotary\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\z2yhfmbkp2z.sys]
@="\??\C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\utorrent.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Trillian\\trillian.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Documents and Settings\\Madame Rotary\\My Documents\\my games\\Nintendo Games\\EMULATOR1 - NESTICLE.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\services.exe"=

R0 SymEFA;Symantec Extended File Attributes;C:\WINDOWS\system32\drivers\NIS\1000000.078\SYMEFA.SYS [2008-08-26 15:41]
S1 BHDrvx86;Symantec Heuristics Driver;C:\WINDOWS\system32\drivers\NIS\1000000.078\BHDrvx86.sys [2008-08-26 15:41]
S1 ccHP;Symantec Hash Provider;C:\WINDOWS\system32\drivers\NIS\1000000.078\ccHPx86.sys [2008-08-26 15:41]
S1 IDSxpx86;IDSxpx86;C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080822.001\IDSxpx86.sys [2008-08-26 15:41]
S2 Norton Internet Security;Norton Internet Security;C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.120\diMaster.dll []
S2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
S2 z2yhfmbkp2z.sys;z2yhfmbkp2z.sys;C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys [2008-08-29 23:32]
S3 MRVW225;D-Link AirPlus G DWL-G122 Wireless USB Dirver for Windows XP;C:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-09-30 21:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f8ef482-bee2-11db-963f-0018f39d11f4}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-30 C:\WINDOWS\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-08-19 18:37]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = www.google.com
R0 -: HKLM-Main,Start Page = www.google.com
R0 -: HKLM-Main,Window Title = Windows Internet Explorer provided by Comcast
R1 -: HKCU-Internet Settings,ProxyOverride = *.local

O16 -: {EF148DBB-5B6D-4130-B2A1-661571E86260} - hxxp://download-games.pogo.com/online2/pogo/mahjong_escape_ancient/PTGameLauncher.cab
C:\WINDOWS\Downloaded Program Files\PTGameLauncher.inf
C:\WINDOWS\Downloaded Program Files\PTGameLauncher.dll

And of course, Hijack this:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:54, on 2008-08-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\RunOnce: [ ] C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://smg.photobucket.com
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/online2/pogo/mahjong_escape_ancient/PTGameLauncher.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 4901 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2008-08-30T12:31:47+00:00

Notably, I don't appear to have a rdssrv.exe or hdfkt.dll. I double-checked my logs, the files you listed, and my folder multiple times to ensure I wasn't making any errors. Would that possibly be the error?

I don't think they would be causing this problem if they were not there.

==

Go toAdd/Remove programs and uninstall the following, if present:

Viewpoint Manager,Viewpoint Media Player,Viewpoint Toolbar

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

===============

A. Please RUN HijackThis Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)

O4 - HKLM\..\RunOnce: [ ] C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
B. 1. Please open Notepad Click Start , then Run
Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\rdssrv.exe
C:\WINDOWS\system32\rdshost.dll
C:\WINDOWS\system32\hdfkt.dll
Folder::
C:\Program Files\Viewpoint
Driver::
C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys
Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\z2yhfmbkp2z.sys]

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), pleasere-enable all the programs that were disabled during the running of ComboFix then post the following reports/logs into your next reply:Combofix.txt
A new HijackThis log.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.