Constantly Sending Spam - 247fixes PC Help Forum

Welcome Guest ( Log In | Register )

247fixes PC Help Forum > Malware Removal > Resolved Hijackthis logs

3 Pages

1 2 3 >

Constantly Sending Spam, HELP ME PLEASE

Options

pleasehelp View Member Profile	Jun 27 2008, 04:34 AM Post #1
Full Member Group: Member Posts: 18 Joined: 27-June 08 Member No.: 1,100	Hi, I am having an issue with my computer constantly sending spam through an unknown account. I have ran numerous scans and tried to solve the problem but to no prevail has this worked at all. I have ran Hijackthis and here is my current log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:16:20 AM, on 6/28/2001 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\ehome\RMSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE C:\Program Files\UnHackMe\hackmon.exe C:\WINDOWS\ehome\RMSysTry.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = actsvr.comcastonline.com:8100 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = cdn O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe -silent O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [EPSON Stylus Photo R280 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKA.EXE /FU "C:\WINDOWS\TEMP\E_S8E.tmp" /EF "HKCU" O4 - HKCU\..\Run: [UnHackMe Monitor] C:\Program Files\UnHackMe\hackmon.exe O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} (NSHelp Class) - http://astech/connectcomputer/nshelp.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/active...oad/XUpload.ocx O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ASTech.local O17 - HKLM\Software\..\Telephony: DomainName = ASTech.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ASTech.local O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ASTech.local O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: winrgq32 - winrgq32.dll (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- End of file - 6484 bytes I have found a few forums offering solutions but nothing similar to mine. Please let me know if there is anything I can do. I am close to just caving in and doing a full system format and starting from scratch. The problem is that I have a large number of documents that are vital on my computer and am unable to fully know what is infected at this point. Oh, I also just ran a scan through "UnHackMe" and Superantispyware. Neither of them have found anything that is harmfull as of right now. Thank you for any help you have to offer.

Blender View Member Profile	Jun 27 2008, 05:14 AM Post #2
I Will Eat Your Malware Group: Administrator Posts: 342 Joined: 19-September 06 Member No.: 426	Hi and welcome, Please download Deckard's System Scanner (DSS) and save to your Desktop. alternate download site DSS will do the following: Create a new System Restore point in Windows XP and Vista. Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives. Check some important areas of your system and produce a report for an analyst to review. Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes. You must be logged onto an account with administrator privileges when using. Close all applications and windows. Double-click on dss.exe to run it and follow the prompts. (On Vista; right click dss.exe and choose run as administrator) If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When the scan is complete, two text files will open in Notepad: main.txt <- this one will be maximized extra.txt <- this one will be minimized If not, they both can be found in the C:\Deckard\System Scanner folder. Please copy (Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your next reply. -- When running DSS, some firewalls may warn that it is trying to access the Internet especially if your asked to download the most current version of HijackThis. Please ensure that you allow it permission to do so. -- If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful. Next: Download Gmer from here: http://www.gmer.net/gmer.zip Unzip it to its own folder. Disconnect from internet & shut down Antivirus to prevent conflicts. Also shut down "UnHackme" so no conflict. Shut down also any other unneeded apps including any open browser windows. The less stuff we got running the less chance of false positives in log. Double click gmer.exe to run it. Allow driver to install if asked (gmer.sys) You may get a warning at program start that there is possible rootkit activity and do you want to run scan. Say OK to run scan. If no warning, just click "scan". Let the scan finish. Once done press "save" In the new window that pops up, give the log a name and save it someplace handy. Press save. Re-enable your antivirus, re-connect to internet & post that log here. Don't be tempted to fix anything yet with Gmer please --- there are likely several legit system hooks due to security software. If the Gmer log is huge -- please attach it. Thanks

Blender View Member Profile	Jul 2 2008, 11:43 AM Post #4
I Will Eat Your Malware Group: Administrator Posts: 342 Joined: 19-September 06 Member No.: 426	Hi, You get the Gmer scan done ok? FEw things I see we can cleanup while waiting for me to get back in regards to Gmer. Almost all are just leftovers from msconfig items. Copy the following text to a new notepad file. Save as file name fix.reg As file types: all files Save to the desktop. CODE REGEDIT4 [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrgq32] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApachInc] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ipmon] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rbse] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SManager] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr] Once created right click it and choose "merge" OK the prompt. Should get success message. No need for reboot. You can delete fix.reg when done. Post fresh hijackthis log please. Thanks

pleasehelp View Member Profile	Jul 2 2008, 05:28 PM Post #5
Full Member Group: Member Posts: 18 Joined: 27-June 08 Member No.: 1,100	Hey, Sorry for the delay, here's the GMER log. It said that there were several RootKit actions. Thank you. I will be merging the other files and posting a new log here momentarily. GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2008-07-01 23:52:38 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.14 ---- SSDT \??\C:\WINDOWS\system32\xpdx.sys ZwCreateKey [0xF8544A5C] <-- ROOTKIT !!! SSDT spav.sys ZwEnumerateKey [0xF8293CA2] <-- ROOTKIT !!! SSDT spav.sys ZwEnumerateValueKey [0xF8294030] <-- ROOTKIT !!! SSDT \??\C:\WINDOWS\system32\xpdx.sys ZwOpenKey [0xF8544B10] <-- ROOTKIT !!! SSDT spav.sys ZwQueryKey [0xF8294108] <-- ROOTKIT !!! SSDT spav.sys ZwQueryValueKey [0xF8293F88] <-- ROOTKIT !!! SSDT spav.sys ZwSetValueKey [0xF829419A] <-- ROOTKIT !!! SSDT \??\C:\WINDOWS\system32\xpdx.sys ZwTerminateProcess [0xF85467D6] <-- ROOTKIT !!! INT 0x62 ? 82387BF8 INT 0x73 ? 82387BF8 INT 0x82 ? 82387BF8 INT 0x84 ? 8225CBF8 INT 0x94 ? 8225CBF8 INT 0xA4 ? 8225CBF8 ---- Kernel code sections - GMER 1.0.14 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2DA2 8050462E 2 Bytes [ 54, F8 ] ? spav.sys The system cannot find the file specified. ! .text USBPORT.SYS!DllUnload F78C38AC 5 Bytes JMP 8225C1D8 .text xpdx.sys F8544101 47 Bytes CALL F8544106 \??\C:\WINDOWS\system32\xpdx.sys .text xpdx.sys F8544131 68 Bytes [ 8D, B5, 1A, 04, 00, 00, 8D, ... ] .text xpdx.sys F8544176 38 Bytes [ 0B, FF, 95, 5F, 04, 00, 00, ... ] .text xpdx.sys F854419D 178 Bytes [ C7, 40, 08, 2E, 65, 78, 65, ... ] .text xpdx.sys F8544250 577 Bytes CALL F85442B0 \??\C:\WINDOWS\system32\xpdx.sys .text ... .text C:\WINDOWS\system32\xpdx.sys section is writeable [0xF8544000, 0x7200, 0xE8000020] ? C:\WINDOWS\system32\xpdx.sys The system cannot find the file specified. ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8277040] spav.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F827713C] spav.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F82770BE] spav.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F82777FC] spav.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F82776D2] spav.sys ---- Devices - GMER 1.0.14 ---- Device \FileSystem\Ntfs \Ntfs xpdx.sys Device \FileSystem\Ntfs \Ntfs 823851F8 Device \Driver\Tcpip \Device\Ip xpdx.sys Device \Driver\NetBT \Device\NetBT_Tcpip_{6816AB09-612C-43CE-854D-0A93D4959D8E} 820A9500 Device \Driver\usbuhci \Device\USBPDO-0 8225B1F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 823881F8 Device \Driver\dmio \Device\DmControl\DmConfig 823881F8 Device \Driver\dmio \Device\DmControl\DmPnP 823881F8 Device \Driver\dmio \Device\DmControl\DmInfo 823881F8 Device \Driver\usbuhci \Device\USBPDO-1 8225B1F8 Device \Driver\usbuhci \Device\USBPDO-2 8225B1F8 Device \Driver\usbuhci \Device\USBPDO-3 8225B1F8 Device \Driver\usbehci \Device\USBPDO-4 8225A1F8 Device \Driver\Tcpip \Device\Tcp xpdx.sys Device \Driver\Ftdisk \Device\HarddiskVolume1 823891F8 Device \Driver\Cdrom \Device\CdRom0 821EB1F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 820A9500 Device \Driver\NetBT \Device\NetbiosSmb 820A9500 Device \Driver\Tcpip \Device\Udp xpdx.sys Device \Driver\Tcpip \Device\RawIp xpdx.sys Device \Driver\usbuhci \Device\USBFDO-0 8225B1F8 Device \Driver\usbuhci \Device\USBFDO-1 8225B1F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 82024500 Device \Driver\Tcpip \Device\IPMULTICAST xpdx.sys Device \Driver\usbuhci \Device\USBFDO-2 8225B1F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 82024500 Device \Driver\usbuhci \Device\USBFDO-3 8225B1F8 Device \Driver\usbehci \Device\USBFDO-4 8225A1F8 Device \Driver\Ftdisk \Device\FtControl 823891F8 Device \FileSystem\Cdfs \Cdfs 81F331F8 ---- Services - GMER 1.0.14 ---- Service C:\WINDOWS\system32\xpdx.sys (* hidden * ) [SYSTEM] xpdx <-- ROOTKIT !!! ---- Registry - GMER 1.0.14 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD2 0x06 0xE7 0x70 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@ErrorControl 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@ImagePath \??\C:\WINDOWS\system32\xpdx.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@DisplayName xpdx system driver Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@Group Base Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx@Checked 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx\Security Reg HKLM\SYSTEM\CurrentControlSet\Services\xpdx\Security@Security 0x01 0x00 0x14 0x80 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD2 0x06 0xE7 0x70 ... Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@Type 1 Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@Start 1 Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@ImagePath \??\C:\WINDOWS\system32\xpdx.sys Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@DisplayName xpdx system driver Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@Group Base Reg HKLM\SYSTEM\ControlSet002\Services\xpdx@Checked 1 Reg HKLM\SYSTEM\ControlSet002\Services\xpdx\Security Reg HKLM\SYSTEM\ControlSet002\Services\xpdx\Security@Security 0x01 0x00 0x14 0x80 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD2 0x06 0xE7 0x70 ... Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@Type 1 Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@Start 1 Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@ImagePath \??\C:\WINDOWS\system32\xpdx.sys Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@DisplayName xpdx system driver Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@Group Base Reg HKLM\SYSTEM\ControlSet003\Services\xpdx@Checked 1 Reg HKLM\SYSTEM\ControlSet003\Services\xpdx\Security Reg HKLM\SYSTEM\ControlSet003\Services\xpdx\Security@Security 0x01 0x00 0x14 0x80 ... ---- EOF - GMER 1.0.14 ----

Blender

Jul 3 2008, 06:24 AM

Post #7

I Will Eat Your Malware
Group Icon

Group: Administrator
Posts: 342
Joined: 19-September 06
Member No.: 426

Hi,

Thanks for the logs.
Indeed have Rustock rootkit. This is your spammer.

Download SDFix and save it to your Desktop.

In the event you already have SDFix, please delete it as this is a new version I need you to download.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt. (Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally copy and paste the contents of the results file Report.txt back onto the forum

Run Gmer again please as well & post its log.

Next I want to get you to run a virus scan.

Download Dr.Webs CureIt to your desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Double-click the drweb-cureit.exe file and allow it to run the express scan.

This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.

Once the short scan has finished, select the "full system scan"

Click the green arrow > to the right and the scan will begin.

At the first infection, select 'Yes to all' if it asks if you want to cure/move the file.

When the scan has finished, click the "Select all" toggle button (if available) next to the files found

Then click the green cup icon right below and select Move incurable

This will move any infected files to the %userprofile%\DoctorWeb\quarantaine-folder that can't be cured (in case if we need samples).

Then, from the main Dr.Web CureIt menu (top left), click File and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv

Close Dr.Web Cureit and Restart your computer to completely remove any stubborn files in reboot.

Post back with the DrWeb.csv report please.

Let me know how the system is running please.

Thanks

ps.
You really should get an antivirus program installed.
You risk getting hit again without it.

Few decent free o