Thanks Guys!! Only wish I had asked three days ago!!! My wife thinks that I am nuts working on her sister's (college student) computer that long. Anyway, I attached the CBfix logs ... Feel free to post any additional feedback. The only thing left is to figure out why I can not install XP SP2 on computer # 1 (sister's (college student) computer))... Her machine was missing about 50 hotfixes... I got them all installed but XP SP2. I get the following error msg.... Service Pack2 setup error.... the file c:\windows\system32\services.exe is open or in use by another application. Close all other applications and click retry. I tried to kill the services.exe process but could not... Any on this issue is appreciated too.

Here are the combofix logs...

It was interesting that computer 2 (my machine); the computer with the multiple logins.. I had to run  the above instructions on each login. Is that normal?

Thanks Again!!
cbfixlog29apr08.txt
CBFixlog29APR08.txt

It looks like I may have spoken too soon.

The virus returned on one of the computers. Both logs belong to the infected computer (combofix logs #2 combofix logs #1 above). Still unable to open reg or tskmgr on all three accounts. I will give safe mode a try if you can come upmwith anyother suggestions that would be appreciated as well... Also, i will search to see what else is out there for the SirCam Virus.. I will reopen the ticket... next time I will wait 24hours just to make sure i got it... One computer is still doing fine.

Thanks,
Terry

Terry,
Both logs are still infected.

1.  This one below is the Combofix log 1 for the 'tqtclipper"pc.
Open notepad and copy/paste the text inside the lines below into it.
--------------------------------------------------------------
File::
C:\WINDOWS\La15366\ib7197.exe
C:\WINDOWS\SY20118\ib9573.exe
C:\WINDOWS\system32\n6543\b7197.exe
C:\WINDOWS\system32\n6543\csrss.exe
C:\WINDOWS\system32\n6543\lsass.exe
C:\WINDOWS\system32\n6543\services.exe
C:\WINDOWS\system32\n6543\smss.exe
C:\WINDOWS\system32\n6543\sv711441830r.exe
C:\WINDOWS\system32\n8127\b9573.exe
C:\WINDOWS\system32\n8127\csrss.exe
C:\WINDOWS\system32\n8127\lsass.exe
C:\WINDOWS\system32\n8127\services.exe
C:\WINDOWS\system32\n8127\smss.exe
C:\WINDOWS\system32\n8127\sv711917030r.exe
C:\Documents and Settings\Default User\Local Settings\Application Data\dv6191700x\yesbron.com
C:\Documents and Settings\4mychildren\Local Settings\Application Data\dv6171900x\yesbron.com

Folder::
C:\WINDOWS\SY20118
C:\WINDOWS\La15366
C:\WINDOWS\system32\n8127
C:\WINDOWS\system32\n6543
C:\Documents and Settings\4mychildren\Local Settings\Application Data\dv6171900x
C:\Documents and Settings\Default User\Local Settings\Application Data\dv6191700x

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"y3114SYS"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]
"y3114SYS"=-

--------------------------------------------------------------
Save this as CFScript in the same location as ComboFix.exe
drag CFScript.txt into ComboFix.exe

This will start ComboFix again. Follow the prompts. After reboot, (in case it asks to reboot), attach the contents of Combofix.txt in your next reply.




2.  This is for the lafina pc.
Open notepad and copy/paste the text inside the lines below into it.
--------------------------------------------------------------
File::
C:\WINDOWS\system32\n6543\csrss.exe
C:\WINDOWS\system32\n6543\lsass.exe
C:\WINDOWS\system32\n6543\services.exe
C:\WINDOWS\system32\n6543\smss.exe
C:\WINDOWS\system32\n6543\sv711441830r.exe
C:\WINDOWS\La15366\ib7197.exe
C:\WINDOWS\system32\n8127\sv711917030r.exe
C:\Documents and Settings\Lafina\Local Settings\Application Data\dv6144180x\yesbron.com
C:\Documents and Settings\Default User\Local Settings\Application Data\dv6191700x\yesbron.com

Folder::
C:\Documents and Settings\4mychildren\Local Settings\Application Data\dv6171900x
C:\WINDOWS\system32\n6543
C:\WINDOWS\La15366
C:\WINDOWS\system32\n8127
C:\Documents and Settings\Lafina\Local Settings\Application Data\dv6144180x
C:\Documents and Settings\Default User\Local Settings\Application Data\dv6191700x

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"y2322Laf"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"y3114SYS"=-
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"y2322Laf"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer\run]
"y3114SYS"=-

--------------------------------------------------------------
Save this as CFScript in the same location as ComboFix.exe
then drag CFScript.txt into ComboFix.exe

This will start ComboFix again. Follow the prompts. After reboot, (in case it asks to reboot), attach the contents of Combofix.txt in your next reply together a hijackthis log.




Please also run this removal tool for Brontok worm.
http://www.sophos.com/support/disinfection/brontok.html

BRONTGUI is a disinfector for standalone Windows computers
http://www.sophos.com/support/cleaners/brontgui.com
open BRONTGUI
run it
then click GO.

I have three logins on the infected computer. The combofix logs above are on the same computer, different logins. Right now I have control of one of the logins.. Every previous attempt to access the other two logins revelas the virus i.e.  REGEDIT and TASK MANAGER DISABLED BY VIRUS. After that I return to my good login and the virus is there again... I run combofix three or four times and its still there... the only thing that seems to work is running  my Ultimate Boot >>miniPE>>Registryt Wizard to restore the registry to a earlier restore point run combofix and then I have access to the same login again and the process repeats itself.. Oh yeah I ran hijack and cleared the errors as well as ran Smitfraudfix and BRONTGUI and just about any online scan tool that I could find.... Anyway, I will take a look at the instructions above and get back to you.

Thanks Again!!

rpg can you check in on the new thread that was started for these machines? I posted my thoughts but would certainly like a second, and/or third opinion from someone.

Thanks,
Dave

Dave,
I'm so sorry, somehow I missed the alerts on this thread and only just now found it by chance searching in the database. My apology.


Terry,
Thanks!

You may download a free tool at www.digitalsupporttech.com. The tool will tell you what causes the problem. It is also free to get it fixed.