smokeylonesome

Hijacker All removal tools blocked

18 posts in this topic

Started off with HomeAntiVirus2010, would not let MBAM, Spybot or MSMRT run, they would start the scan then die after a few seconds. Tried to open back up and get a no permission error. Uninstall the antivirus software to try again but the exe file cannot be deleted. Finally did a manual remove and got rid of the red x in the task bar and it has quit trying to download homeantivirus2010. Thought I had it but MBAM etc still would not run. Now something has complete taken over IE, it will not go to the selected links, always redirected to some worthless site. Currenly using FireFox and it is running slow as molasses. Installed and tried to run HJT, see logfile below, but it ran for only a few seconds then shut down, I don't think it completed the scan. HELP.

Somkeylonesome

Logfile of HijackThis v1.99.0

Scan saved at 2:38:54 PM, on 3/27/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe

C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Portrait Displays\forteManager\DTHtml.exe

C:\Program Files\BroadJump\Client Foundation\CFD.exe

C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Eraser\eraser.exe

C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe

C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\PROGRA~1\BLUETO~1\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe

C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe

C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Outlook Express\MSIMN.EXE

C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Downloads\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local

O1 - Hosts: HP79872F HP0017A479872F

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe

O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder

O4 - HKLM\..\Run: [bJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Apoligamepixoh] rundll32.exe "C:\Documents and Settings\a\Local Settings\Temporary Internet Files\596325812.dll",e

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide

O4 - HKCU\..\Run: [Yahoo! Pager] 1

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: AT&T Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O15 - Trusted Zone: http://*.turbotax.com

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1231151953266

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe

O23 - Service: Portrait Displays Display Tune Service - Unknown - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: IAA Event Monitor - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MaxBackServiceInt - Unknown - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe

O23 - Service: MaxSyncService - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Share this post


Link to post
Share on other sites

Forgot to mention, tried downloading and renaming MBAM to winlogon.exe while booted up in SAFE mode for the entire time. It downloaded, updated then still got killed when I tried to scan.

Share this post


Link to post
Share on other sites

Download and run Win32kDiag:

Share this post


Link to post
Share on other sites

Thanks, Win32 log below.

Log file is located at: C:\Documents and Settings\a\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Found mount point : C:\WINDOWS\$hf_mig$\{29F8DDC1-9487-49b8-B27E-3E0C3C1298FF}

Mount point destination : \Device\__max++>\^

Cannot access: C:\WINDOWS\SYSTEM32\MRT.exe

[1] 2009-07-29 17:49:16 24281536 C:\WINDOWS\SYSTEM32\MRT.exe ()

[2] 2009-04-06 07:57:26 24921544 C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1450\A0079782.exe (Microsoft Corporation)

Cannot access: C:\WINDOWS\SYSTEM32\netlogon.dll

[1] 2004-08-04 06:00:00 407040 C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll (Microsoft Corporation)

[1] 2008-04-13 19:12:01 407040 C:\WINDOWS\ServicePackFiles\i386\netlogon.dll (Microsoft Corporation)

[1] 2008-04-13 19:12:01 60416 C:\WINDOWS\SYSTEM32\netlogon.dll ()

[2] 2008-04-13 19:12:01 407040 C:\WINDOWS\SYSTEM32\ntelogon.dll (Microsoft Corporation)

[1] 2004-08-04 06:00:00 407040 C:\i386\NETLOGON.DLL (Microsoft Corporation)

Cannot access: C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe

[1] 2009-02-06 05:15:13 227840 C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe (Microsoft Corporation)

[1] 2004-08-04 06:00:00 218112 C:\WINDOWS\$NtServicePackUninstall$\wmiprvse.exe (Microsoft Corporation)

[1] 2008-04-13 19:12:40 218112 C:\WINDOWS\$NtUninstallKB956572$\wmiprvse.exe (Microsoft Corporation)

[1] 2008-04-13 19:12:40 218112 C:\WINDOWS\ServicePackFiles\i386\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 05:10:02 227840 C:\WINDOWS\SYSTEM32\DLLCACHE\wmiprvse.exe (Microsoft Corporation)

[1] 2009-02-06 05:10:02 227840 C:\WINDOWS\SYSTEM32\WBEM\wmiprvse.exe ()

[1] 2004-08-04 06:00:00 218112 C:\i386\WMIPRVSE.EXE (Microsoft Corporation)

Finished!

Share this post


Link to post
Share on other sites

ComboFix RAN!!! That is already an improvement. Log below.

ComboFix 09-08-29.01 - a 08/30/2009 8:46.1.2 - NTFSx86

Running from: c:\program downloads\ComboFix\Combo-Fix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\a\Application Data\cixosumyta.bat

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome.manifest

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\_cfg.js

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\c.js

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\chrome\content\overlay.xul

c:\documents and settings\a\Local Settings\Application Data\{45DDB470-512E-45F7-A10B-C35B8B4024D4}\install.rdf

c:\documents and settings\a\Local Settings\Application Data\ohuso.reg

c:\documents and settings\a\Local Settings\Application Data\qagygeta.inf

c:\documents and settings\a\Local Settings\Temporary Internet Files\ifofa.sys

c:\documents and settings\a\Local Settings\Temporary Internet Files\meradabyj._sy

c:\documents and settings\a\Local Settings\Temporary Internet Files\ofyw.scr

c:\documents and settings\a\Local Settings\Temporary Internet Files\udahokigi.db

c:\documents and settings\a\Local Settings\Temporary Internet Files\ykoqavup.scr

c:\documents and settings\All Users\Application Data\amixoz.vbs

c:\documents and settings\All Users\Documents\ahicuvew.reg

c:\documents and settings\All Users\Documents\siqez.inf

c:\program files\Common Files\edywirocer.bat

c:\program files\Common Files\qexykidiq.inf

c:\windows\batyxaboli.reg

c:\windows\Downloaded Program Files\popcaploader.dll

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\ewagos.exe

c:\windows\ewirujom.dll

c:\windows\Installer\1d7a3.msi

c:\windows\opebuvo.inf

c:\windows\sili.reg

c:\windows\system32\bszip.dll

c:\windows\system32\dllcache\beep.sys

c:\windows\system32\tmp.reg

c:\windows\system32\wisdstr.exe

c:\windows\system32\ygyzokuv.inf

c:\windows\yhabuz.bat

Infected copy of c:\windows\system32\netlogon.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\netlogon.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))

.

2009-08-29 16:39 . 2009-08-03 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-29 16:39 . 2009-08-30 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-29 16:39 . 2009-08-03 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-29 13:12 . 2009-08-29 13:12 0 ----a-w- c:\documents and settings\a\settings.dat

2009-08-29 12:08 . 2009-08-29 12:08 -------- d-----w- c:\program files\Trend Micro

2009-08-26 22:07 . 2009-08-26 22:08 -------- d-----w- c:\program files\SpywareBlaster

2009-08-20 09:29 . 2009-08-20 09:29 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

2009-08-18 09:56 . 2009-08-18 09:56 -------- d-----w- c:\documents and settings\a\Local Settings\Application Data\Mozilla

2009-08-16 20:12 . 2009-08-16 20:12 117760 ----a-w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com

2009-08-02 16:12 . 2009-08-02 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-08-02 16:12 . 2009-08-02 16:12 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-08-02 13:25 . 2009-08-02 13:25 -------- d--h--w- c:\windows\PIF

2009-08-02 13:25 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\a\Application Data\Simply Super Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-08-01 18:47 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-27 09:35 . 2007-11-01 22:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-08-27 09:31 . 2008-05-06 00:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-08-27 09:31 . 2005-08-01 10:09 -------- d-----w- c:\program files\Lavasoft

2009-08-20 09:29 . 2005-03-10 17:34 -------- d-----w- c:\program files\Java

2009-08-15 14:11 . 2005-04-03 16:31 -------- d-----w- c:\program files\Canon

2009-08-02 13:25 . 2009-07-31 00:19 -------- d-----w- c:\program files\AVG

2009-08-02 13:25 . 2009-07-31 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-08-02 13:24 . 2009-07-31 00:05 -------- d-----w- c:\program files\Trojan Remover

2009-08-02 13:20 . 2009-03-22 13:37 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)

2009-08-01 18:18 . 2007-05-28 13:17 -------- d-----w- c:\program files\Eraser

2009-07-31 22:39 . 2009-03-22 13:36 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)

2009-07-31 00:54 . 2005-03-26 21:47 4212 ---ha-w- c:\windows\system32\zllictbl.dat

2009-07-31 00:05 . 2009-07-31 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2009-07-30 21:33 . 2009-07-30 21:33 19604 ----a-w- c:\windows\bobojy.com

2009-07-30 21:33 . 2009-07-30 21:33 18309 ----a-w- c:\program files\Common Files\tycujavece.scr

2009-07-30 21:33 . 2009-07-30 21:33 15725 ----a-w- c:\documents and settings\a\Local Settings\Application Data\nofesu.sys

2009-07-30 21:33 . 2009-07-30 21:33 14513 ----a-w- c:\windows\system32\zoqa.dll

2009-07-30 21:33 . 2009-07-30 21:33 13338 ----a-w- c:\program files\Common Files\xemetoh.pif

2009-07-30 21:33 . 2009-07-30 21:33 12083 ----a-w- c:\documents and settings\All Users\Application Data\yhozucuj.scr

2009-07-30 21:33 . 2009-07-30 21:33 12083 ----a-w- c:\documents and settings\All Users\Application Data\yhozucuj.scr

2009-07-30 20:49 . 2009-07-30 20:49 19251 ----a-w- c:\windows\system32\jecepudyj.bin

2009-07-30 20:49 . 2009-07-30 20:49 16926 ----a-w- c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com

2009-07-30 20:49 . 2009-07-30 20:49 16585 ----a-w- c:\program files\Common Files\evihi.pif

2009-07-30 20:49 . 2009-07-30 20:49 15720 ----a-w- c:\documents and settings\a\Application Data\qenawogec.exe

2009-07-30 20:49 . 2009-07-30 20:49 15720 ----a-w- c:\documents and settings\a\Application Data\qenawogec.exe

2009-07-30 20:49 . 2009-07-30 20:49 13062 ----a-w- c:\program files\Common Files\enygew.ban

2009-07-30 20:49 . 2009-07-30 20:49 19050 ----a-w- c:\documents and settings\a\Local Settings\Application Data\zafypire.bin

2009-07-30 20:49 . 2009-07-30 20:49 10218 ----a-w- c:\program files\Common Files\gezotekiwe.scr

2009-07-30 19:00 . 2009-07-31 09:10 3036024 ----a-w- c:\documents and settings\a\Application Data\Simply Super Software\Trojan Remover\sxmC5.exe

2009-07-30 19:00 . 2009-07-31 00:06 3036024 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\hhu3.exe

2009-07-25 10:23 . 2009-01-09 21:41 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-07-23 15:09 . 2009-07-23 06:38 -------- d-----w- c:\program files\Shared

2009-07-20 16:34 . 2009-07-20 16:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap

2009-07-15 05:58 . 2008-07-20 11:56 -------- d-----w- c:\program files\NewsRover

2009-07-12 15:47 . 2005-03-23 00:15 86600 ----a-w- c:\documents and settings\a\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2007-05-10 00:19 . 2007-05-10 00:19 2823446 ----a-w- c:\program files\audacity-win-unicode-1.3.2.exe

2006-06-05 22:07 . 2006-06-05 22:07 2614605 ----a-w- c:\program files\Tetrominoes_v1-3_Instl.exe

2006-05-03 09:06 . 2007-11-01 21:43 163328 --sh--r- c:\windows\SYSTEM32\flvDX.dll

2007-02-21 10:47 . 2007-11-01 21:43 31232 --sh--r- c:\windows\SYSTEM32\msfDX.dll

.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2005-08-18 18:49 . 2005-08-18 18:49 307200 c:\program files\Adobe\Acrobat 7.0\Reader\bak\AdobeUpdateManager.exe

1980-01-01 06:00 . 2004-10-14 21:42 1404928 c:\program files\Analog Devices\Core\bak\smax4pnp.exe

2005-03-10 17:35 . 2004-08-25 18:52 339968 c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

2004-01-07 07:01 . 2004-01-07 07:01 110592 c:\program files\Common Files\Sonic\Update Manager\bak\sgtray.exe

2005-03-10 17:36 . 2004-10-12 22:54 57344 c:\program files\CyberLink\PowerDVD\bak\DVDLauncher.exe

2004-09-15 07:01 . 2004-09-15 07:01 86016 c:\program files\Dell\Media Experience\bak\DMXLauncher.exe

2005-03-10 17:35 . 2004-06-29 17:23 135168 c:\program files\Intel\Intel Application Accelerator\bak\iaanotif.exe

2005-03-10 17:35 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2005-03-10 17:40 . 2004-09-14 14:50 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe

2005-03-10 17:40 . 2004-09-14 14:50 131072 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mm_tray.exe

2005-03-10 17:43 . 2005-03-10 17:43 98304 c:\program files\QuickTime\bak\qttask.exe

2009-01-05 22:18 . 2009-01-05 22:18 413696 c:\program files\QuickTime\QTTask.exe

2005-03-10 17:44 . 2004-12-06 07:05 127035 c:\windows\SYSTEM32\dla\bak\tfswctrl.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Yahoo! Pager"="1" [X]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]

"DT LGE"="c:\program files\Portrait Displays\forteManager\DTHtml.exe" [2007-02-01 285696]

"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]

"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455]

"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2007-04-05 684118]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"NWEReboot"="" [N/A]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-25 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2007-10-18 217088]

Bluetooth.lnk - c:\program files\Bluetooth\Bluetooth Software\BTTray.exe [2005-9-19 581693]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Downloads\\Mute\\MUTE\\fileSharingMUTE.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\SYSTEM32\\MMC.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]

R3 DPCNET5U;Satellite USB Driver;c:\windows\system32\DRIVERS\dpcnet5u.sys [x]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]

R3 OlCamudp;OLYMPUS Digital Camera;c:\windows\system32\Drivers\olcamudp.sys [2000-02-08 10379]

S3 DVC150B;Dazzle DVC 150B;c:\windows\system32\Drivers\dvc150b.SYS [2005-02-09 30976]

.

Contents of the 'Scheduled Tasks' folder

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = 127.0.0.1;*.local

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

IE: Send To &Bluetooth - c:\program files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm

Trusted Zone: turbotax.com

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\mxuet5r0.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 83

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-30 08:52

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,dd,35,7d,54,5c,

f4,84,6f,c8,28,51,af,b0,29,a3,98,2e,70,73,e8,58,5e,5a,6c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,ef,98,38,b6,33,

e2,d3,3b,71,3b,04,66,8b,46,0d,96,b0,d5,27,14,ca,1e,a7,ba,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,8c,28,30,81,68,

8d,90,15,25,da,ec,7e,55,20,c9,26,17,b1,aa,3f,4b,52,8b,27,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,37,12,51,14,ec,

c3,fe,9e,3e,1e,9e,e0,57,5a,93,61,6d,2c,0f,7f,59,7a,b3,ec,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,5d,fc,f0,4f,cc,

32,33,58,cd,44,cd,b9,a6,33,6c,cd,6d,cc,f8,80,99,c2,64,9c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,c4,a4,c7,11,66,

ca,32,52,b0,18,ed,a7,3f,8d,37,a4,fe,d3,d3,24,81,ad,57,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,d7,ba,bd,28,28,

71,5d,5e,31,77,e1,ba,b1,f8,68,02,46,45,cf,0c,18,02,35,dc,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,db,78,8d,ca,c7,

11,48,9f,83,6c,56,8b,a0,85,96,ab,e2,fe,a5,39,96,c3,ea,a5,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,85,01,d8,2e,07,

b8,c3,ac,51,fa,6e,91,28,9e,14,cc,7e,bb,c1,b1,55,b1,54,e1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,bd,27,59,97,cb,

3d,40,24,b1,cd,45,5a,a8,c4,f8,b9,8c,4f,9b,73,ae,53,8c,75,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3b,f5,26,43,b9,

57,ba,87,e3,0e,66,d5,eb,bc,2f,6b,bf,c5,48,b8,bd,c3,ea,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,b2,75,e1,a3,f5,

e3,85,8b,fa,ea,66,7f,d4,3b,6b,70,cc,5d,63,0a,02,52,89,a3,6c,43,2d,1e,aa,22,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2352)

c:\progra~1\SBCSEL~1\SMARTB~1\SBHook.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\btncopy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\SYSTEM32\ati2evxx.exe

c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe

c:\program files\SBC Self Support Tool\bin\mpbtn.exe

c:\program files\Bluetooth\Bluetooth Software\bin\btwdins.exe

c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe

c:\program files\Intel\Intel Application Accelerator\IAANTmon.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\SYSTEM32\HPZipm12.exe

c:\program files\Bluetooth\Bluetooth Software\BTStackServer.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\SYSTEM32\msiexec.exe

c:\program files\HP\Digital Imaging\bin\hpqnrs08.exe

c:\windows\SYSTEM32\wscntfy.exe

c:\windows\SYSTEM32\HPZinw12.exe

.

**************************************************************************

.

Completion time: 2009-08-30 8:58 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-30 13:58

Pre-Run: 109,032,763,392 bytes free

Post-Run: 112,174,645,248 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

372

Share this post


Link to post
Share on other sites

Does MBAM work now?

Open NOTEPAD and copy/paste the text in the quotebox below into it:

DirLook::
c:\program files\Shared
FILE::
C:\documents and settings\a\settings.dat
C:\windows\bobojy.com
C:\program files\Common Files\tycujavece.scr
C:\documents and settings\a\Local Settings\Application Data\nofesu.sys
C:\windows\system32\zoqa.dll
C:\program files\Common Files\xemetoh.pif
C:\documents and settings\All Users\Application Data\yhozucuj.scr
C:\windows\system32\jecepudyj.bin
C:\documents and settings\a\Local Settings\Application Data\tucoxatud.com
C:\program files\Common Files\evihi.pif
C:\documents and settings\a\Application Data\qenawogec.exe
C:\program files\Common Files\enygew.ban
C:\documents and settings\a\Local Settings\Application Data\zafypire.bin
C:\program files\Common Files\gezotekiwe.scr
FOLDER::
C:\program files\Adobe\Acrobat 7.0\Reader\Bak
C:\program files\Analog Devices\Core\Bak
C:\program files\ATI Technologies\ATI Control Panel\Bak
C:\program files\Common Files\Sonic\Update Manager\Bak
C:\program files\CyberLink\PowerDVD\Bak
C:\program files\Dell\Media Experience\Bak
C:\program files\Intel\Intel Application Accelerator\Bak
C:\program files\Intel\Modem Event Monitor\Bak
C:\program files\MUSICMATCH\Musicmatch Jukebox\Bak
C:\program files\MUSICMATCH\Musicmatch Jukebox\Bak
C:\program files\QuickTime\Bak
C:\windows\SYSTEM32\dla\Bak
REGISTRY::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"=-
"SUPERAntiSpyware"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NWEReboot"=-
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=-

Save this as "CFScript"

CFScriptB-4.gif

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

---------------

Using Internet Explorer, visit http://www.kaspersky.com/service?chapter=161739400

Vista users right click on the Internet Explorer shortcut, and choose Run As Administrator.

**Note**

To optimize scanning time and produce a more sensible report for review:

  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

  • Click Run at the Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

---------------

In your next post, please include fresh logs from:

  1. Online scan
  2. ComboFix's log

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

Share this post


Link to post
Share on other sites

I decided to run the script in ComboFIx before trying to run MBAM. Log file below.

ComboFix 09-08-29.01 - a 08/30/2009 9:58.2.2 - NTFSx86

Running from: c:\program downloads\ComboFix\Combo-Fix.exe

Command switches used :: c:\documents and settings\a\Desktop\CFScript.txt

* Created a new restore point

FILE ::

"c:\documents and settings\a\Application Data\qenawogec.exe"

"c:\documents and settings\a\Local Settings\Application Data\nofesu.sys"

"c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com"

"c:\documents and settings\a\Local Settings\Application Data\zafypire.bin"

"c:\documents and settings\a\settings.dat"

"c:\documents and settings\All Users\Application Data\yhozucuj.scr"

"c:\program files\Common Files\enygew.ban"

"c:\program files\Common Files\evihi.pif"

"c:\program files\Common Files\gezotekiwe.scr"

"c:\program files\Common Files\tycujavece.scr"

"c:\program files\Common Files\xemetoh.pif"

"c:\windows\bobojy.com"

"c:\windows\system32\jecepudyj.bin"

"c:\windows\system32\zoqa.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\a\Application Data\qenawogec.exe

c:\documents and settings\a\Local Settings\Application Data\nofesu.sys

c:\documents and settings\a\Local Settings\Application Data\tucoxatud.com

c:\documents and settings\a\Local Settings\Application Data\zafypire.bin

c:\documents and settings\a\settings.dat

c:\documents and settings\All Users\Application Data\yhozucuj.scr

c:\program files\Adobe\Acrobat 7.0\Reader\Bak

c:\program files\Adobe\Acrobat 7.0\Reader\Bak\AdobeUpdateManager.exe

c:\program files\Analog Devices\Core\Bak

c:\program files\Analog Devices\Core\Bak\smax4pnp.exe

c:\program files\ATI Technologies\ATI Control Panel\Bak

c:\program files\ATI Technologies\ATI Control Panel\Bak\atiptaxx.exe

c:\program files\Common Files\enygew.ban

c:\program files\Common Files\evihi.pif

c:\program files\Common Files\gezotekiwe.scr

c:\program files\Common Files\Sonic\Update Manager\Bak

c:\program files\Common Files\Sonic\Update Manager\Bak\sgtray.exe

c:\program files\Common Files\tycujavece.scr

c:\program files\Common Files\xemetoh.pif

c:\program files\CyberLink\PowerDVD\Bak

c:\program files\CyberLink\PowerDVD\Bak\DVDLauncher.exe

c:\program files\Dell\Media Experience\Bak

c:\program files\Dell\Media Experience\Bak\DMXLauncher.exe

c:\program files\Intel\Intel Application Accelerator\Bak

c:\program files\Intel\Intel Application Accelerator\Bak\iaanotif.exe

c:\program files\Intel\Modem Event Monitor\Bak

c:\program files\Intel\Modem Event Monitor\Bak\IntelMEM.exe

c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak

c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak\mm_tray.exe

c:\program files\MUSICMATCH\Musicmatch Jukebox\Bak\mmtask.exe

c:\program files\QuickTime\Bak

c:\program files\QuickTime\Bak\qttask.exe

c:\windows\bobojy.com

c:\windows\SYSTEM32\dla\Bak

c:\windows\SYSTEM32\dla\Bak\tfswctrl.exe

c:\windows\system32\jecepudyj.bin

c:\windows\system32\zoqa.dll

.

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))

.

2009-08-29 16:39 . 2009-08-03 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-29 16:39 . 2009-08-30 11:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-29 16:39 . 2009-08-03 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-29 12:08 . 2009-08-29 12:08 -------- d-----w- c:\program files\Trend Micro

2009-08-26 22:07 . 2009-08-26 22:08 -------- d-----w- c:\program files\SpywareBlaster

2009-08-20 09:29 . 2009-08-20 09:29 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

2009-08-18 09:56 . 2009-08-18 09:56 -------- d-----w- c:\documents and settings\a\Local Settings\Application Data\Mozilla

2009-08-16 20:12 . 2009-08-16 20:12 117760 ----a-w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-08-16 20:11 . 2009-08-16 20:11 -------- d-----w- c:\documents and settings\a\Application Data\SUPERAntiSpyware.com

2009-08-02 16:12 . 2009-08-02 16:12 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-08-02 16:12 . 2009-08-02 16:12 152576 ----a-w- c:\documents and settings\a\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-08-02 13:25 . 2009-08-02 13:25 -------- d--h--w- c:\windows\PIF

2009-08-02 13:25 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\a\Application Data\Simply Super Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Simply Super Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\BVRP Software

2009-08-02 13:24 . 2009-08-02 13:24 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-08-01 18:47 . 2009-08-02 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-30 15:02 . 2005-03-10 17:43 -------- d-----w- c:\program files\QuickTime

2009-08-27 09:35 . 2007-11-01 22:03 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-08-27 09:31 . 2008-05-06 00:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2009-08-27 09:31 . 2005-08-01 10:09 -------- d-----w- c:\program files\Lavasoft

2009-08-20 09:29 . 2005-03-10 17:34 -------- d-----w- c:\program files\Java

2009-08-15 14:11 . 2005-04-03 16:31 -------- d-----w- c:\program files\Canon

2009-08-02 13:25 . 2009-07-31 00:19 -------- d-----w- c:\program files\AVG

2009-08-02 13:25 . 2009-07-31 00:15 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-08-02 13:24 . 2009-07-31 00:05 -------- d-----w- c:\program files\Trojan Remover

2009-08-02 13:20 . 2009-03-22 13:37 -------- d-----w- c:\program files\File Scanner Library (Spybot - Search & Destroy)

2009-08-01 18:18 . 2007-05-28 13:17 -------- d-----w- c:\program files\Eraser

2009-07-31 22:39 . 2009-03-22 13:36 -------- d-----w- c:\program files\SDHelper (Spybot - Search & Destroy)

2009-07-31 00:54 . 2005-03-26 21:47 4212 ---ha-w- c:\windows\system32\zllictbl.dat

2009-07-31 00:05 . 2009-07-31 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2009-07-30 19:00 . 2009-07-31 09:10 3036024 ----a-w- c:\documents and settings\a\Application Data\Simply Super Software\Trojan Remover\sxmC5.exe

2009-07-30 19:00 . 2009-07-31 00:06 3036024 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\hhu3.exe

2009-07-25 10:23 . 2009-01-09 21:41 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-07-23 15:09 . 2009-07-23 06:38 -------- d-----w- c:\program files\Shared

2009-07-20 16:34 . 2009-07-20 16:34 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap

2009-07-15 05:58 . 2008-07-20 11:56 -------- d-----w- c:\program files\NewsRover

2009-07-12 15:47 . 2005-03-23 00:15 86600 ----a-w- c:\documents and settings\a\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2007-05-10 00:19 . 2007-05-10 00:19 2823446 ----a-w- c:\program files\audacity-win-unicode-1.3.2.exe

2006-06-05 22:07 . 2006-06-05 22:07 2614605 ----a-w- c:\program files\Tetrominoes_v1-3_Instl.exe

2006-05-03 09:06 . 2007-11-01 21:43 163328 --sh--r- c:\windows\SYSTEM32\flvDX.dll

2007-02-21 10:47 . 2007-11-01 21:43 31232 --sh--r- c:\windows\SYSTEM32\msfDX.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\program files\Shared ----

2009-07-23 15:09 . 2009-07-24 09:30 50688 ----a-w- c:\program files\Shared\_lib.sig

2009-07-23 12:45 . 2009-07-23 12:45 294924 ----a-w- c:\program files\Shared\_lib.dll

2009-07-23 09:34 . 2009-07-30 09:38 50688 ----a-w- c:\program files\Shared\lib.sig

2009-07-23 06:38 . 2009-07-24 11:45 294924 ----a-w- c:\program files\Shared\lib.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

"PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-10 406016]

"DT LGE"="c:\program files\Portrait Displays\forteManager\DTHtml.exe" [2007-02-01 285696]

"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]

"Motive SmartBridge"="c:\progra~1\SBCSEL~1\SMARTB~1\MotiveSB.exe" [2005-08-24 442455]

"Name of App"="c:\program files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2007-04-05 684118]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2006-01-12 155648]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-25 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

AT&T Self Support Tool.lnk - c:\program files\SBC Self Support Tool\bin\matcli.exe [2007-10-18 217088]

Bluetooth.lnk - c:\program files\Bluetooth\Bluetooth Software\BTTray.exe [2005-9-19 581693]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Downloads\\Mute\\MUTE\\fileSharingMUTE.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\SYSTEM32\\MMC.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [x]

R3 DPCNET5U;Satellite USB Driver;c:\windows\system32\DRIVERS\dpcnet5u.sys [x]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [x]

R3 OlCamudp;OLYMPUS Digital Camera;c:\windows\system32\Drivers\olcamudp.sys [2000-02-08 10379]

S3 DVC150B;Dazzle DVC 150B;c:\windows\system32\Drivers\dvc150b.SYS [2005-02-09 30976]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = 127.0.0.1;*.local

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

IE: Send To &Bluetooth - c:\program files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm

Trusted Zone: turbotax.com

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\a\Application Data\Mozilla\Firefox\Profiles\mxuet5r0.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 83

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-30 10:02

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,dd,35,7d,54,5c,

f4,84,6f,c8,28,51,af,b0,29,a3,98,2e,70,73,e8,58,5e,5a,6c,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,ef,98,38,b6,33,

e2,d3,3b,71,3b,04,66,8b,46,0d,96,b0,d5,27,14,ca,1e,a7,ba,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,8c,28,30,81,68,

8d,90,15,25,da,ec,7e,55,20,c9,26,17,b1,aa,3f,4b,52,8b,27,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,37,12,51,14,ec,

c3,fe,9e,3e,1e,9e,e0,57,5a,93,61,6d,2c,0f,7f,59,7a,b3,ec,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,5d,fc,f0,4f,cc,

32,33,58,cd,44,cd,b9,a6,33,6c,cd,6d,cc,f8,80,99,c2,64,9c,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,c4,a4,c7,11,66,

ca,32,52,b0,18,ed,a7,3f,8d,37,a4,fe,d3,d3,24,81,ad,57,c2,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,d7,ba,bd,28,28,

71,5d,5e,31,77,e1,ba,b1,f8,68,02,46,45,cf,0c,18,02,35,dc,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1d68fe701cdea33e477eb204b76f993d"=hex:83,6c,56,8b,a0,85,96,ab,db,78,8d,ca,c7,

11,48,9f,83,6c,56,8b,a0,85,96,ab,e2,fe,a5,39,96,c3,ea,a5,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,85,01,d8,2e,07,

b8,c3,ac,51,fa,6e,91,28,9e,14,cc,7e,bb,c1,b1,55,b1,54,e1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,bd,27,59,97,cb,

3d,40,24,b1,cd,45,5a,a8,c4,f8,b9,8c,4f,9b,73,ae,53,8c,75,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,3b,f5,26,43,b9,

57,ba,87,e3,0e,66,d5,eb,bc,2f,6b,bf,c5,48,b8,bd,c3,ea,c4,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]

"ThreadingModel"="Apartment"

@="c:\\WINDOWS\\system32\\OLE32.DLL"

"8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,b2,75,e1,a3,f5,

e3,85,8b,fa,ea,66,7f,d4,3b,6b,70,cc,5d,63,0a,02,52,89,a3,6c,43,2d,1e,aa,22,\

.

Completion time: 2009-08-30 10:04

ComboFix-quarantined-files.txt 2009-08-30 15:04

ComboFix2.txt 2009-08-30 13:58

Pre-Run: 112,220,368,896 bytes free

Post-Run: 112,166,473,728 bytes free

318

Share this post


Link to post
Share on other sites
---- Directory of c:\program files\Shared ----

2009-07-23 15:09 . 2009-07-24 09:30 50688 ----a-w- c:\program files\Shared\_lib.sig

2009-07-23 12:45 . 2009-07-23 12:45 294924 ----a-w- c:\program files\Shared\_lib.dll

2009-07-23 09:34 . 2009-07-30 09:38 50688 ----a-w- c:\program files\Shared\lib.sig

2009-07-23 06:38 . 2009-07-24 11:45 294924 ----a-w- c:\program files\Shared\lib.dll

Any idea what these are? Are they part of something that you installed?

Share this post


Link to post
Share on other sites

MBAM now runs. No way I could have killed off this sucker on my own. What was the offender.

Logfile below.

Malwarebytes' Anti-Malware 1.40

Database version: 2718

Windows 5.1.2600 Service Pack 3

8/30/2009 10:14:02 AM

mbam-log-2009-08-30 (10-14-02).txt

Scan type: Quick Scan

Objects scanned: 99663

Time elapsed: 3 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\TypeLib\{df058c45-cd18-453e-8745-5a77f60722ab} (Adware.Gdown) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{b5a33c35-7298-4d15-8753-a2e851e2eab3} (Adware.Gdown) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f0d2b812-752d-4af1-a2fb-968c4d8446db} (Adware.Gdown) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{e856b973-45fd-4559-8f82-eab539144667} (Adware.Gdown) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\SYSTEM32\GTDownDE_87.ocx (Adware.Gdown) -> Quarantined and deleted successfully.

C:\WINDOWS\meta4.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Shared\lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

C:\Program Files\Shared\_lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

Share this post


Link to post
Share on other sites
Any idea what these are? Are they part of something that you installed?
C:\Program Files\Shared\lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

C:\Program Files\Shared\_lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

I guess that answers my query. Please delete the rest of the folder - C:\Program Files\Shared

I shall wait for the results of the Kaspersky scan

Share this post


Link to post
Share on other sites

could not run the Kaspersky lab software. [Error: java.lang.UnsatisfiedLinkError: C:documents and SettingsLocal SettingsTempjkos-a inarieskosglue-7.026.0.dll: The system cannot find the file specified]

Share this post


Link to post
Share on other sites

Let's try a different scanner.

ESET Online Scanner

  • Please go to the following link ESET Online Scanner Link
  • Tick the box YES, I accept the Terms Of Use
  • Click the Start button
  • Now click the Install button
  • Click Start
    The scanner engine will initialise and update
  • Do Not tick the box Remove found threats
  • Click the Scan button
    The scan will now run, please be patient
  • When the scan finishes click the Details tab
  • Copy and paste the contents of the C:\Program Files\EsetOnlineScanner\log.txt back here.

Share this post


Link to post
Share on other sites

Sorry for the delay, had to send the oldest to Texas A&M for his first semester of college, also prep'd about 8 pints of jalapenoes for canning tomorrow, if you want a recipe for the best pickled jals (better than Trappies) let me know. While I had control of my computer, for the first time is 3 weeks, I updated window xp, java and ran Malwarebytes on deep scan mode along with Spybot's latest scan, deleted detected files as suggested. ESET scan file is attached.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=6

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6050

# api_version=3.0.2

# EOSSerial=31f7dd8d66776046bb8675bdeb4b88e0

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2009-08-31 12:15:40

# local_time=2009-08-30 07:15:40 (-0600, Central Daylight Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1027 62 0 7 26781485000000

# scanned=225826

# found=10

# cleaned=0

# scan_time=5618

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2004 email.dbx Win32/Sober.I worm 00000000000000000000000000000000 I

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan 00000000000000000000000000000000 I

C:\I386\GTDownDE_87.ocx probably a variant of Win32/Adware.Agent application 00000000000000000000000000000000 I

F:\Mark 8.28.09\Outlook Express\2004 email.dbx Win32/Sober.I worm 00000000000000000000000000000000 I

F:\Mark 8.28.09\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan 00000000000000000000000000000000 I

F:\Russell's Awesome Documents\My Music April 1 2009\03 Track 3 (techno).wma WMA/TrojanDownloader.Wimad.D trojan 00000000000000000000000000000000 I

F:\Russell's Awesome Documents\My Music April 1 2009\07 Track 7 (techno).wma WMA/TrojanDownloader.Wimad.D trojan 00000000000000000000000000000000 I

F:\Russell's Awesome Documents\My Music April 1 2009\The Mars Volta - Televators.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I

F:\Russell's Awesome Documents\My Music April 1 2009\Amon Amarth\runes to my memory.mpg a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I

F:\Russell's Awesome Documents\My Music April 1 2009\Bonobo\Bonobo - Discography.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan 00000000000000000000000000000000 I

Share this post


Link to post
Share on other sites

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2004 email.dbx Win32/Sober.I worm 

C:\Documents and Settings\a\Local Settings\Application Data\Identities\{31391EF3-B3AC-4F12-94D8-DC2DA45E9526}\Microsoft\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan

F:\Mark 8.28.09\Outlook Express\2004 email.dbx Win32/Sober.I worm

F:\Mark 8.28.09\Outlook Express\2005 email.dbx HTML/Phishing.gen trojan

These are infections/threats from old backups of old email. To remove them, you have to launch your email client, load those backups and pick them off individually. Personally, I'll leave them be. The infections are old and shall be easily picked up by your resident antivirus program.

------------

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"F:\Russell's Awesome Documents\My Music April 1 2009\03 Track 3 (techno).wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\07 Track 7 (techno).wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\The Mars Volta - Televators.wma"
"F:\Russell's Awesome Documents\My Music April 1 2009\Amon Amarth\runes to my memory.mpg"
"F:\Russell's Awesome Documents\My Music April 1 2009\Bonobo\Bonobo - Discography.mp3"
) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"%systemdrive%\VundoFix Backups"
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
pause
del %0

Save this as fix.bat Choose to "Save type as - All Files"

It should look like this: bat_icon.gif

Double click on fix.bat & allow it to run

Post back to tell me what it says

Share this post


Link to post
Share on other sites

Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

  1. Uninstall ComboFix ... do not skip this step
    This process will perform some post cleanup measures.
    Do this by going to to Start > Run & typing in ComboFix /u
  2. ANTIVIRUS SOFTWARE
    It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  3. Microsoft Windows Updatehttp://www.windowsupdate.com
    Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  4. http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  5. http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  6. http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
    ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
    NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://www.spywareinfoforum.com/index.php?showtopic=60955

After doing all these, your system will be optimised against future threats.

.

Have a safe & happy computing day. wave.gif

Kindly respond to this thread once more so we can mark this thread as resolved.

Share this post


Link to post
Share on other sites

You are great, I was on the verge of wiping the entire drive and starting over. Many many thanks.

One each Smokeylonesome

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.