18 replies to this topic

[KPP]

Ron,

Here's my new post.

Kate

[AdvancedSetup]

Please disable your Anti-Virus and run the following and post back the log.


Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
  • Tools->Options->Main tab
    
  • Set to "Always ask me where to Save the files".
• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  
  
• It is important you rename Combofix during the download, but not after.
  
• Please do not rename Combofix to other names, but only to the one indicated.
  
• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
    
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combo-Fix.exe & follow the prompts.
  
• When finished, it will produce a report for you.
  
• Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

If this doesn't work either, try the same method (above method), but name Combofix.exe to iexplore.exe instead, or winlogon.exe..
This because It also happens in some cases that malware blocks EVERY process except for what is in its own whitelist, so this whitelist also includes system important processes such as iexplore.exe, explorer.exe, winlogon.exe...

[KPP]

New topic opened per Advanced Setup.

[KPP]

Quote

Please disable your Anti-Virus and run the following and post back the log.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.
[/list]

Ron,

Here's the log file from Combo-Fix:

ComboFix 09-11-19.05 - Kate 11/20/2009 0:14.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.78 [GMT -6:00]
Running from: c:\documents and settings\Kate\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))
.

2009-11-20 03:44 . 2009-02-13 22:01 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll
2009-11-20 03:44 . 2009-07-21 20:40 404737 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe
2009-11-20 03:44 . 2009-04-09 16:20 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll
2009-11-20 03:44 . 2009-06-03 22:26 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll
2009-11-20 03:44 . 2008-12-05 17:32 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll
2009-11-14 04:56 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-14 04:56 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-14 04:56 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-14 04:56 . 2009-11-14 04:56 -------- d-----w- c:\program files\Avira
2009-11-14 04:56 . 2009-11-14 04:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-11-13 04:50 . 2009-11-13 04:50 -------- d-----w- c:\documents and settings\Kate\Application Data\ElevatedDiagnostics
2009-11-13 04:47 . 2009-11-13 04:47 -------- d-----w- c:\program files\Microsoft ATS
2009-11-04 01:20 . 2009-11-04 01:20 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2009-11-03 15:18 . 2009-11-03 15:17 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-03 15:16 . 2009-11-03 15:16 152576 ----a-w- c:\documents and settings\Kate\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-17 17:33 . 2009-06-08 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-17 07:22 . 2008-09-26 05:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-15 07:50 . 2004-06-26 23:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-07 02:04 . 2004-06-27 03:00 87056 -c--a-w- c:\documents and settings\Kate\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-03 15:16 . 2005-06-22 03:00 -------- d-----w- c:\program files\Java
2009-10-12 06:29 . 2009-10-12 06:29 -------- d-----w- c:\program files\Trend Micro
2009-10-11 06:04 . 2007-10-19 04:43 -------- d-----w- c:\program files\DivX
2009-10-11 06:03 . 2009-03-15 08:56 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-09-25 22:57 . 2007-05-23 05:44 -------- d-----w- c:\documents and settings\Kate\Application Data\Move Networks
2009-09-25 22:57 . 2009-07-30 06:34 126970 -c--a-w- c:\documents and settings\Kate\Application Data\Move Networks\uninstall.exe
2009-09-25 22:57 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\plugins\npqmp071505000010.dll
2009-09-25 22:56 . 2009-09-25 22:56 1407680 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe
2009-09-11 14:18 . 2008-09-21 22:46 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2001-08-23 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:36 . 2004-01-08 20:23 832512 ----a-w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2004-08-04 07:56 78336 -c--a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2001-08-23 12:00 17408 -c--a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00 . 2001-08-23 12:00 247326 -c--a-w- c:\windows\system32\strmdll.dll
2008-06-19 08:42 . 2006-04-27 04:24 122880 -c--a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-03 149280]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-03-26 1442888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/13/2009 10:56 PM 108289]
S3 AdWatchDrv;AW Realtime Driver;\??\c:\windows\system32\drivers\AWRTPD.sys --> c:\windows\system32\drivers\AWRTPD.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-10-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-11-15 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 23:36]

2009-11-20 c:\windows\Tasks\User_Feed_Synchronization-{566C0DF4-C73B-4F7B-A67A-6B19000EC267}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 23:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://dallas.craigslist.org/wrg/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: abc.com
Trusted Zone: abc.com\ll.media
Trusted Zone: fox.com\gksrv
Trusted Zone: fox.com\www
Trusted Zone: go.com\abc
Trusted Zone: go.com\fep.abc
Trusted Zone: google.com\www
Trusted Zone: ncspearson.com
FF - ProfilePath - c:\documents and settings\Kate\Application Data\Mozilla\Firefox\Profiles\dav8808z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://dallas.craigslist.org/dal/etc/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-aawservice



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 00:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
"abhmjphalfajeibgjfpgapeghgpbkecbcd"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
"iafmdbjjdpioemkknk"=hex:61,61,00,01
"hahmjphalfajeibg"=hex:61,61,00,01
"iajfdoahpdengkffgh"=hex:61,61,00,01
"bbfmdbjjdpioemkknkkddcelccconlkpjgli"=hex:6a,61,63,64,64,6c,63,65,64,67,67,6a,
6f,6a,62,69,6a,63,69,63,00,00
"abhmjphalfajeibgjfpgapeghgkblgoclc"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
"bbfmdbjjdpioemkknkkddcelcccoieejlbni"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1272)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-11-20 00:52
ComboFix-quarantined-files.txt 2009-11-20 06:52

Pre-Run: 9,118,425,088 bytes free
Post-Run: 9,799,245,824 bytes free

- - End Of File - - D2258117C7208933EFCAD169CEAF3EBC


HTJ Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:07:06 AM, on 11/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dallas.craigslist.org/wrg/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O15 - Trusted Zone: ll.media.abc.com
O15 - Trusted Zone: http://*.abc.com
O15 - Trusted Zone: gksrv.fox.com
O15 - Trusted Zone: http://www.fox.com
O15 - Trusted Zone: http://abc.go.com
O15 - Trusted Zone: fep.abc.go.com
O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.micro...gWebControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--

[AdvancedSetup]

STEP 00
You may have corrupted files on your disk. Please try running the following.
First close ALL Applications as this routine will automatically restart your computer.
Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

STEP 01
Download but do not yet run ComboFix
If you have a previous version of Combofix.exe, delete it and download a fresh copy.
Download it to your DESKTOP - it MUST run from the Desktop
download.bleepingcomputer.com/sUBs/ComboFix.exe
subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• Disconnect from the Internet.
  
• Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  
• A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  
• It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
  When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

STEP 02
Please download the following scanning tool. GMER
[indent]

• Download the randomly named EXE and copy the file to your Desktop. Remember what its name is.
  
• Double click on random named exe file and run it.
  
• It may take a minute to load and become available.
  
• Do not make any changes. Click on the SCAN button and DO NOT use the computer while it's scanning.
  
• Once the scan is done click on the SAVE button and browse to your Desktop and save the file as GMER.LOG
  
• Zip up the GMER.LOG file and save it as gmerlog.zip and attach it to your reply post.
  
• DO NOT directly post this log into a reply. You MUST attach it as a .ZIP file.
  
• Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP
Compress and uncompress files (zip files) in Vista
[/indent]

STEP 03
RootRepeal - Rootkit Detector
[indent]

Close ALL applications and as many items in the task tray that will stop and exit.

• Please download the following tool: RootRepeal - Rootkit Detector
  
• Direct download link is here: RootRepeal.rar
  
• If you don't already have a program to open a .RAR compressed file you can download a trial version from here: WinRAR
  
• Extract the program file to a new folder such as C:\RootRepeal
  
• Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button
  
• Select ALL of the checkboxes and then click OK and it will start scanning your system.
  
• If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
  
• When done, click on Save Report
  
• Save it to the same location where you ran it from, such as C:\RootRepeal
  
• Save it as your_name_rootrepeal.txt - where your_name is your forum name
  
• This makes it more easy to track who the log belongs to.
  
• Then open that log and select all and copy/paste it back on your next reply please.
  
• Quit the RootRepeal program.

[/indent]

STEP 04

Please create a BOOTLOG

• Delete the following file if it exists. C:\Windows\ntbtlog.txt
  
• Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  
• Select "Enable Boot Logging" option and press enter.
  
• Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  
• This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
   
  If you're already running inside Windows you can enable it the following way.
   
  
• Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  
• Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  
• After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  
• From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.
  
• NOTE: If the file is over about 150 lines or so then DELETE the C:\Windows\ntbtlog.txt file and restart the computer and post the NEW one it creates.
  
• NOTE: Vista users can type in the Search and it will show on the menu, then Right click and choose Run as Adminsitrator
  
• The tab is called BOOT on Vista. Then choose Boot log

STEP 05
[indent]Click on START - RUN and type in SIGVERIF and click OK
This is a Microsoft File Signature Verification program that will check some file status for us.

• Click on the START button and let it run.
  
• It will popup a box when it's done to show the status, you can close that box.
  
• Close the File Signature Verification application.
  
• Find and attach the file C:\WINDOWS\SIGVERIF.TXT to your reply.
  
• DO NOT post the log directly into your reply, attach the file please.

[/indent]

[KPP]

Ron,

I have a work project online starting tomorrow through next Wednesday. I'd rather wait till after that so as not to have any issues during the project.

Is there any chance you can help me get my new keyboard operational? It's a Dynex Wired Keyboard DX-WKBD, and I've tried all my USB ports. It does work on another computer.

The following is a list of USB controllers in Device Manager. All but one are "working properly." The first one, Intel®82801DB/DBM USB 2.0 Enhanced Host Controller - 24CD [X] states "No drivers are installed for this device."

Universal Serial Bus controllers
Intel®82801DB/DBM USB 2.0 Enhanced Host Controller - 24CD [X]
Intel®82801DB/DBM USB Universal Host Controller - 24C2
" " " " - 24C4
" " " " - 24C7
" " " "
USB Root Hub
" "
" "

Thanks,

Kate

[AdvancedSetup]

Right click on it and remove. Then reboot. If it's real it will come back and want a driver. Check in your BIOS and make sure all the USB ports are enabled.

Well if you're not going to work on the Malware scans then I'll close your post and when you're ready you can send me a PM and we can start back up again.

[AdvancedSetup]

Reopened at user request.

[KPP]

Ron,

I have tried to follow all/most of your instructions, but I am now confused about what to post. what to zip/attach, and what's left to do.

Here's what I have so far:

Combo-fix log.txt
hijackthis.log
DDS.txt
Attach.txt
ark.txt

Also, should I delete the attachments I previously uploaded?

Thanks,

Kate

[AdvancedSetup]

Please post or attach either one is fine. I'll review all of them and let you know what if anything I find.

[KPP]

AdvancedSetup, on Dec 2 2009, 01:39 AM, said:

Please post or attach either one is fine. I'll review all of them and let you know what if anything I find.

Here goes!

[AdvancedSetup]

STEP 01
Please uninstall the following software until we've completed assisting you.
You can re-install it once we're done.
µTorrent
Advanced SystemCare 3
Shockwave

STEP 02
Download but do not yet run ComboFix
Delete you previous version of Combofix.exe, and download a fresh copy. You're running an old version.
Download it to your DESKTOP - it MUST run from the Desktop
download.bleepingcomputer.com/sUBs/ComboFix.exe
subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions]
Driver::
AdWatchDrv
File::
c:\windows\system32\drivers\AWRTPD.sys

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

• Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  
• Disconnect from the Internet.
  
• Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  
• A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  
• It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
  When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

STEP 03
Please download the following program to your desktop. Close all other open applications and then run the program.
It will restore file permissions to the system and automatically restart the computer when done.
restoredefaultperms.exe

When finished please run the following from Microsoft.
Please download and run the following fix from Microsoft How do I restore security settings to the default settings?

STEP 04
You may have corrupted files on your disk. Please try running the following.
First close ALL Applications as this routine will automatically restart your computer.
Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

[KPP]

STEP 01

Quote

Please uninstall the following software until we've completed assisting you.
You can re-install it once we're done.
µTorrent
Advanced SystemCare 3
Shockwave

Done


STEP 02

Quote

Download but do not yet run ComboFix

Quote

ost back the Combofix log on your next reply.

Here it is.


ComboFix 09-12-04.02 - Kate 12/05/2009 4:02.7.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.116 [GMT -6:00]
Running from: c:\documents and settings\Kate\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kate\Desktop\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\system32\drivers\AWRTPD.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ADWATCHDRV
-------\Service_AdWatchDrv


((((((((((((((((((((((((( Files Created from 2009-11-05 to 2009-12-05 )))))))))))))))))))))))))))))))
.

2009-11-29 09:41 . 2009-03-30 15:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-29 09:41 . 2009-02-13 17:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-29 09:41 . 2009-02-13 17:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\program files\Avira
2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-11-13 04:50 . 2009-11-13 04:50 -------- d-----w- c:\documents and settings\Kate\Application Data\ElevatedDiagnostics
2009-11-13 04:47 . 2009-11-13 04:47 -------- d-----w- c:\program files\Microsoft ATS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-05 09:45 . 2009-07-11 04:41 -------- d-----w- c:\program files\Common Files\Apple
2009-12-05 08:59 . 2008-09-26 05:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-01 04:31 . 2009-06-08 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-15 07:50 . 2004-06-26 23:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-07 02:04 . 2004-06-27 03:00 87056 -c--a-w- c:\documents and settings\Kate\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-04 01:20 . 2009-11-04 01:20 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2009-11-03 15:17 . 2009-11-03 15:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-03 15:16 . 2005-06-22 03:00 -------- d-----w- c:\program files\Java
2009-11-03 15:16 . 2009-11-03 15:16 152576 ----a-w- c:\documents and settings\Kate\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-12 06:29 . 2009-10-12 06:29 -------- d-----w- c:\program files\Trend Micro
2009-10-11 06:04 . 2007-10-19 04:43 -------- d-----w- c:\program files\DivX
2009-10-11 06:03 . 2009-03-15 08:56 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-09-25 22:57 . 2009-07-30 06:34 126970 -c--a-w- c:\documents and settings\Kate\Application Data\Move Networks\uninstall.exe
2009-09-25 22:57 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\plugins\npqmp071505000010.dll
2009-09-25 22:56 . 2009-09-25 22:56 1407680 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe
2009-09-11 14:18 . 2008-09-21 22:46 136192 ----a-w- c:\windows\system32\msv1_0.dll
2008-06-19 08:42 . 2006-04-27 04:24 122880 -c--a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-20_06.41.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-05 10:43 . 2009-12-05 10:43 16384 c:\windows\temp\Perflib_Perfdata_114.dat
- 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2007-01-29 08:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
- 2008-04-03 22:18 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
+ 2008-04-03 22:18 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2004-08-04 07:56 . 2008-04-14 00:11 21504 c:\windows\system32\hidserv.dll
+ 2004-08-04 06:08 . 2008-04-13 18:45 32128 c:\windows\system32\drivers\usbccgp.sys
- 2009-11-14 04:56 . 2009-05-11 16:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-11-29 09:41 . 2009-05-11 15:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2004-08-04 05:58 . 2008-04-13 18:39 14592 c:\windows\system32\drivers\kbdhid.sys
+ 2009-05-02 08:42 . 2008-04-13 18:45 10368 c:\windows\system32\drivers\hidusb.sys
- 2009-10-19 07:46 . 2009-07-28 22:33 55656 c:\windows\system32\drivers\avgntflt.sys
+ 2009-10-19 07:46 . 2009-07-28 21:33 55656 c:\windows\system32\drivers\avgntflt.sys
+ 2004-08-04 06:08 . 2008-04-13 18:45 32128 c:\windows\system32\dllcache\usbccgp.sys
+ 2004-08-04 05:58 . 2008-04-13 18:39 14592 c:\windows\system32\dllcache\kbdhid.sys
+ 2009-05-02 08:42 . 2008-04-13 18:45 10368 c:\windows\system32\dllcache\hidusb.sys
+ 2004-08-04 07:56 . 2008-04-14 00:11 21504 c:\windows\system32\dllcache\hidserv.dll
+ 2009-11-25 06:12 . 2009-11-25 06:12 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-11-25 06:12 . 2009-11-25 06:12 429568 c:\windows\Installer\1a0e118.msi
+ 2009-07-21 06:03 . 2009-07-21 06:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2009-05-02 08:44 . 2009-07-31 16:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 06:05 . 2009-07-21 06:05 1348432 c:\windows\system32\msxml4.dll
+ 2001-08-23 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2009-05-02 08:44 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-05-02 11:57 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-03 149280]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-03-26 1442888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

.
Contents of the 'Scheduled Tasks' folder

2009-10-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-12-04 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 23:36]

2009-12-05 c:\windows\Tasks\User_Feed_Synchronization-{566C0DF4-C73B-4F7B-A67A-6B19000EC267}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 23:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://dallas.craigslist.org/wrg/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: abc.com
Trusted Zone: abc.com\ll.media
Trusted Zone: fox.com\gksrv
Trusted Zone: fox.com\www
Trusted Zone: go.com\abc
Trusted Zone: go.com\fep.abc
Trusted Zone: google.com\www
Trusted Zone: ncspearson.com
FF - ProfilePath - c:\documents and settings\Kate\Application Data\Mozilla\Firefox\Profiles\dav8808z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://dallas.craigslist.org/dal/etc/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-Adobe Flash Player Plugin - c:\windows\system32\Macromed\Flash\uninstall_plugin.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-05 04:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"abhmjphalfajeibgjfpgapeghgpbkecbcd"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
"iafmdbjjdpioemkknk"=hex:61,61,00,01
"hahmjphalfajeibg"=hex:61,61,00,01
"iajfdoahpdengkffgh"=hex:61,61,00,01
"bbfmdbjjdpioemkknkkddcelccconlkpjgli"=hex:6a,61,63,64,64,6c,63,65,64,67,67,6a,
6f,6a,62,69,6a,63,69,63,00,00
"abhmjphalfajeibgjfpgapeghgkblgoclc"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
"bbfmdbjjdpioemkknkkddcelcccoieejlbni"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,
6a,68,62,66,63,6d,6c,65,00,00
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3180)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-05 05:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-05 11:00
ComboFix2.txt 2009-11-29 19:37
ComboFix3.txt 2009-11-20 06:52

Pre-Run: 8,685,948,928 bytes free
Post-Run: 9,277,956,096 bytes free

- - End Of File - - 00BD0BD264DEEC06FFCFB5AA0CEA38EB

[AdvancedSetup]

Okay please try editing your CFSCRIPT.TXT file and use this entry instead. Save the file and drop it on Combofix again.

RegNull::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]

Then run the following.

Please download and run the following fix from Microsoft How do I restore security settings to the default settings?
When completed please reboot your computer.

Post back the Combofix log again.

[KPP]

AdvancedSetup, on Dec 5 2009, 08:44 PM, said:

Quote

STEP 03
Please download the following program to your desktop. Close all other open applications and then run the program.
It will restore file permissions to the system and automatically restart the computer when done.
restoredefaultperms.exe

Quote

Please download and run the following fix from Microsoft How do I restore security settings to the default settings?

Done

Quote

STEP 04
You may have corrupted files on your disk. Please try running the following.
First close ALL Applications as this routine will automatically restart your computer.
Click on START - RUN and copy / paste the following entry into the box and click OK.
Okay please try editing your CFSCRIPT.TXT file and use this entry instead. Save the file and drop it on Combofix again.

RegNull::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]

Done

Quote

Post back the Combofix log again.

ComboFix 09-12-05.06 - Kate 12/06/2009 6:54.8.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.129 [GMT -6:00]
Running from: c:\documents and settings\Kate\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kate\Desktop\CFscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))
.

2009-11-29 09:41 . 2009-03-30 15:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-11-29 09:41 . 2009-02-13 17:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-11-29 09:41 . 2009-02-13 17:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\program files\Avira
2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-11-13 04:50 . 2009-11-13 04:50 -------- d-----w- c:\documents and settings\Kate\Application Data\ElevatedDiagnostics
2009-11-13 04:47 . 2009-11-13 04:47 -------- d-----w- c:\program files\Microsoft ATS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-06 11:06 . 2004-06-27 03:00 87056 -c--a-w- c:\documents and settings\Kate\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-06 00:29 . 2008-09-26 05:29 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-12-05 09:45 . 2009-07-11 04:41 -------- d-----w- c:\program files\Common Files\Apple
2009-12-01 04:31 . 2009-06-08 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-15 07:50 . 2004-06-26 23:02 -------- d-----w- c:\program files\Common Files\InstallShield
2009-11-04 01:20 . 2009-11-04 01:20 -------- d-----w- c:\program files\Microsoft IntelliType Pro
2009-11-03 15:17 . 2009-11-03 15:18 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-03 15:16 . 2005-06-22 03:00 -------- d-----w- c:\program files\Java
2009-11-03 15:16 . 2009-11-03 15:16 152576 ----a-w- c:\documents and settings\Kate\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-12 06:29 . 2009-10-12 06:29 -------- d-----w- c:\program files\Trend Micro
2009-10-11 06:04 . 2007-10-19 04:43 -------- d-----w- c:\program files\DivX
2009-10-11 06:03 . 2009-03-15 08:56 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-09-25 22:57 . 2009-07-30 06:34 126970 -c--a-w- c:\documents and settings\Kate\Application Data\Move Networks\uninstall.exe
2009-09-25 22:57 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\plugins\npqmp071505000010.dll
2009-09-25 22:56 . 2009-09-25 22:56 1407680 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe
2009-09-11 14:18 . 2008-09-21 22:46 136192 ----a-w- c:\windows\system32\msv1_0.dll
2008-06-19 08:42 . 2006-04-27 04:24 122880 -c--a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-20_06.41.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-06 11:02 . 2009-12-06 11:02 16384 c:\windows\temp\Perflib_Perfdata_27c.dat
- 2007-01-29 08:58 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2007-01-29 08:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2008-04-03 22:18 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
- 2008-04-03 22:18 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
+ 2004-08-04 07:56 . 2008-04-14 00:11 21504 c:\windows\system32\hidserv.dll
+ 2004-08-04 06:08 . 2008-04-13 18:45 32128 c:\windows\system32\drivers\usbccgp.sys
+ 2009-11-29 09:41 . 2009-05-11 15:12 28520 c:\windows\system32\drivers\ssmdrv.sys
- 2009-11-14 04:56 . 2009-05-11 16:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2004-08-04 05:58 . 2008-04-13 18:39 14592 c:\windows\system32\drivers\kbdhid.sys
+ 2009-05-02 08:42 . 2008-04-13 18:45 10368 c:\windows\system32\drivers\hidusb.sys
- 2009-10-19 07:46 . 2009-07-28 22:33 55656 c:\windows\system32\drivers\avgntflt.sys
+ 2009-10-19 07:46 . 2009-07-28 21:33 55656 c:\windows\system32\drivers\avgntflt.sys
+ 2004-08-04 06:08 . 2008-04-13 18:45 32128 c:\windows\system32\dllcache\usbccgp.sys
+ 2004-08-04 05:58 . 2008-04-13 18:39 14592 c:\windows\system32\dllcache\kbdhid.sys
+ 2009-05-02 08:42 . 2008-04-13 18:45 10368 c:\windows\system32\dllcache\hidusb.sys
+ 2004-08-04 07:56 . 2008-04-14 00:11 21504 c:\windows\system32\dllcache\hidserv.dll
+ 2009-11-25 06:12 . 2009-11-25 06:12 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2004-06-26 17:30 . 2009-12-06 06:41 302032 c:\windows\system32\FNTCACHE.DAT
- 2004-06-26 17:30 . 2009-11-12 07:10 302032 c:\windows\system32\FNTCACHE.DAT
+ 2009-11-25 06:12 . 2009-11-25 06:12 429568 c:\windows\Installer\1a0e118.msi
+ 2009-07-21 06:03 . 2009-07-21 06:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2009-05-02 08:44 . 2009-07-31 16:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 06:05 . 2009-07-21 06:05 1348432 c:\windows\system32\msxml4.dll
+ 2001-08-23 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2009-05-02 08:44 . 2009-07-31 16:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2009-05-02 11:57 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-03 149280]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-03-26 1442888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/29/2009 3:41 AM 108289]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://dallas.craigslist.org/wrg/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: abc.com
Trusted Zone: abc.com\ll.media
Trusted Zone: fox.com\gksrv
Trusted Zone: fox.com\www
Trusted Zone: go.com\abc
Trusted Zone: go.com\fep.abc
Trusted Zone: google.com\www
Trusted Zone: ncspearson.com
FF - ProfilePath - c:\documents and settings\Kate\Application Data\Mozilla\Firefox\Profiles\dav8808z.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://dallas.craigslist.org/dal/etc/
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-06 07:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3372)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-12-06 07:29
ComboFix-quarantined-files.txt 2009-12-06 13:29
ComboFix2.txt 2009-12-05 11:00
ComboFix3.txt 2009-11-29 19:37
ComboFix4.txt 2009-11-20 06:52

Pre-Run: 9,198,243,840 bytes free
Post-Run: 9,293,463,552 bytes free

- - End Of File - - 83B270CD2DB4EABFEDB18B83057349AA

[AdvancedSetup]

Please uninstall Combofix now. Click on START - RUN and type in Combo-Fix.exe /UNINSTALL and allow it to remove itself.


Okay, now please go back to the PC Help forum and continue on with them.
http://www.malwareby...showtopic=30039

[KPP]

Ron,

2 questions. First, what you find wrong with my computer? Second, I still have something going on. For one thing, my computer is running very slow on the net.

Plus a minute ago I got a pop-up from ads.apartmentratings.com asking me for a user name and password. It looked exactly like the logon window I use for a company I work for online. I captured a copy of the image if you want to see it.

Also, I have been getting weird messages at one of my email addresses where emails are arriving in succession--one comes, then another, and another. Just deleting them doesn't work. I have to first block them, then delete them in 2 separate operations. They all have the subject line "Hi" and then a link to click inside.

Thoughts?

Kate

[AdvancedSetup]

You did not appear to have any real infection but you did have some left over pieces of old software drivers that I had you remove.
Slowness can be caused by many things and Exile can probably assist you with that.

As for the Ad popups that is always going to happen without using a good ad blocker. On IE you can maybe look at using AdMuncher
Or switch to Firefox/Opera and use NoScript and AdBlocker Plus which will reduce a lot of those type of issues.

For now unless something is very hidden, none of the current scanners detect any other Malware. If you're specifically trusting any sites in IE you can remove all sites in the Advanced section.

In fact you may want to reset IE just in case. Go to Tools/Internet Options/Advanced and click on the RESET button and restart IE.

Make sure your Anti-Virus is up to date and working properly as well and gets updates daily.

[KPP]

AdvancedSetup, on Dec 7 2009, 06:17 PM, said:

You did not appear to have any real infection but you did have some left over pieces of old software drivers that I had you remove.

Quote

Slowness can be caused by many things and Exile can probably assist you with that.

I will turn myself over to Exile's trusted care. But I first want to say thank you very much for all your time and effort. I wish you a happy holiday season wherever you are! Do you want me to keep you posted as to what Exile has me do?

Quote

As for the Ad popups that is always going to happen without using a good ad blocker. On IE you can maybe look at using AdMuncher
Or switch to Firefox/Opera and use NoScript and AdBlocker Plus which will reduce a lot of those type of issues.

Ads aren't a problem. It's just that one ad that looked identical to the logon window I use for my online work. Very deceptive!

Quote

For now unless something is very hidden, none of the current scanners detect any other Malware. If you're specifically trusting any sites in IE you can remove all sites in the Advanced section.

I do have a lot of my work sites marked as trusted sites.

Quote

In fact you may want to reset IE just in case. Go to Tools/Internet Options/Advanced and click on the RESET button and restart IE.

If I do that, will I have to reinput the ones I want to keep as a trusted site?



Make sure your Anti-Virus is up to date and working properly as well and gets updates daily.