MrAngry

Thanks very much for your time and brilliant service, I really don't know how I would have managed to sort this out without you - probably would have had to reinstall XP and start life again! The problem for me is that I do not have a fast 'copper' broadband connection and up until recently I have had to rely on dial-up, which is rubbish when you need to be downloading Windows and Anti Virus updates on a regular basis. For example, it takes 1 hour to download 16mb. So I recently purchased a USB mobile broadband device which is far better and will help me get all my updates in a reasonable time. However, perhaps it is this faster speed that also allowed these viruses in? Who knows? I'll be looking at all your recommendations and I'll certainly act on them. Once again, thank you so much for all your help.

You are correct, I amended the user name as I did not want it on the web, but that is all. I'm sorry but I did not think this would make a material difference to the output. Would you like me to run dss again and email the files to you? The machine seems to be OK but to be honest I have been reluctant to use it in earnest before I know whether it is clean. First thing I want to do is load my new Internet Security software before I start using the internet again. Do you think it's OK to load this now and start using the web again? The logs looked pretty clean to me but I'm not the expert! I'm sorry if I screwed the log files, but thank you once again for all your assistance. Please let me know what you would like me to do next.

Here's the dds.txt report and Attach.zip. I really appreciate your help. Many thanks. DDS (Ver_09-02-01.01) - NTFSx86 Run by User1 at 13:51:37.76 on 02/03/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.511.298 [GMT 0:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\PROGRA~1\DataFlux\DFPOWE~1\7.1\bin\DFBATC~1.EXE C:\WINDOWS\System32\DVDRAMSV.exe C:\Program Files\Orange\ICON 225 USB Connect\GtDetectSc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\QLink 1.0\devmonit.exe C:\WINDOWS\system32\RAMASST.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\User1\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.co.uk/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://gb8l.hpwis.com/ uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_219B3E1547538286.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [instantTray] c:\program files\pinnacle\shared files\instantcddvd\PCLETray.exe uRun: [iW_Drop_Icon] c:\program files\pinnacle\instantcddvd\instantwrite\iwctrl.exe /DropDisc uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [CamMonitor] c:\program files\hewlett-packard\digital imaging\unload\hpqcmon.exe mRun: [HPHUPD05] c:\program files\hewlett-packard\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe mRun: [HPHmon05] c:\windows\system32\hphmon05.exe mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Camera Detector] c:\progra~1\acdsys~1\devdet~1\DEVDET~1.EXE -autorun mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monitor.lnk - c:\program files\qlink 1.0\devmonit.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - hxxp://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} - hxxp://www.symantec.com/techsupp/asa/ctrl/SymAData.cab DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} - hxxp://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxp://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100 ============= SERVICES / DRIVERS =============== R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [2003-8-1 29239] R1 vobcom;vobcom;c:\windows\system32\drivers\vobcom.sys [2001-10-4 9728] R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [2003-8-27 187392] R2 BCDCNDIS;Belkin Direct Connect Network Adapter;c:\windows\system32\drivers\BCDCNDIS.SYS [2000-8-8 14054] R2 DFBatchSvc;DataFlux Batch Scheduler;c:\progra~1\dataflux\dfpowe~1\7.1\bin\DFBATC~1.EXE [2007-7-9 86016] R2 GtDetectSc;GtDetectSc;c:\program files\orange\icon 225 usb connect\GtDetectSc.exe [2007-12-18 196704] R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [2002-12-13 64000] R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;c:\windows\system32\drivers\wbsd.sys [2003-9-9 26240] S3 BCDCLINK;Belkin USB Direct Connect;c:\windows\system32\drivers\BCDCLINK.SYS [2004-4-10 14279] S3 Dz3s2kxp;Dz3s2kxp;c:\windows\system32\drivers\Dz3s2kxp.sys [2004-8-19 10496] S3 Dz3u2kxp;Dz3u2kxp;c:\windows\system32\drivers\Dz3u2kxp.sys [2004-8-19 11264] S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2007-11-13 106112] S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2008-11-19 59264] S3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2007-3-30 8064] =============== Created Last 30 ================ 2009-03-02 09:44 <DIR> a-dshr-- C:\cmdcons 2009-03-02 09:42 161,792 a------- c:\windows\SWREG.exe 2009-03-02 09:42 98,816 a------- c:\windows\sed.exe 2009-03-02 09:42 <DIR> --d----- C:\ComboFix 2009-03-02 09:22 <DIR> --d----- c:\docume~1\alluse~1\applic~1\NortonInstaller 2009-02-28 14:00 <DIR> --d----- c:\docume~1\user1~1\applic~1\Malwarebytes 2009-02-28 13:31 15,504 a------- c:\windows\system32\drivers\mbam.sys 2009-02-28 13:31 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-28 13:31 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware 2009-02-28 13:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-02-26 22:51 <DIR> --d----- c:\program files\XoftSpySE 2009-02-26 16:57 410,984 a------- c:\windows\system32\deploytk.dll 2009-02-26 16:57 73,728 a------- c:\windows\system32\javacpl.cpl 2009-02-26 16:45 <DIR> --d----- c:\program files\Norton Security Scan 2009-02-26 09:53 <DIR> --dsh--- c:\documents and settings\user1\Temporary Internet Files 2009-02-23 15:39 54,156 a---h--- c:\windows\QTFont.qfn 2009-02-23 15:39 1,409 a------- c:\windows\QTFont.for ==================== Find3M ==================== 2009-01-16 21:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll 2008-12-19 09:10 70,656 a------- c:\windows\system32\dllcache\ie4uinit.exe 2008-12-19 09:10 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe 2008-12-19 05:25 634,024 a------- c:\windows\system32\dllcache\iexplore.exe 2008-12-19 05:23 161,792 a------- c:\windows\system32\dllcache\ieakui.dll 2008-12-11 11:57 333,184 a------- c:\windows\system32\dllcache\srv.sys ============= FINISH: 13:52:08.25 =============== Attach.zip Attach.zip

Here's the results of the Quick Scan. I'll run the dds and post when complete. Malwarebytes' Anti-Malware 1.34 Database version: 1814 Windows 5.1.2600 Service Pack 2 02/03/2009 13:16:59 mbam-log-2009-03-02 (13-16-59).txt Scan type: Quick Scan Objects scanned: 85931 Time elapsed: 1 hour(s), 7 minute(s), 0 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Thanks. I was able to remove Norton and run ComboFix. Please let me know what I should do next. Here's the log file. ComboFix 09-02-28.01 - User1 2009-03-02 9:46:15.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.290 [GMT 0:00] Running from: c:\documents and settings\User1\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\TDSSorvd.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TDSSSERV.SYS -------\Service_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 ))))))))))))))))))))))))))))))) . 2009-03-02 09:22 . 2009-03-02 09:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-02-28 19:07 . 2009-02-28 19:07 <DIR> d-------- c:\documents and settings\User2\Application Data\Malwarebytes 2009-02-28 14:00 . 2009-02-28 14:00 <DIR> d-------- c:\documents and settings\User1\Application Data\Malwarebytes 2009-02-28 13:31 . 2009-02-28 17:30 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-28 13:31 . 2009-02-28 13:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-28 13:31 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-28 13:31 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-26 22:51 . 2009-02-26 22:51 <DIR> d-------- c:\program files\XoftSpySE 2009-02-26 16:57 . 2009-02-26 16:57 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-26 16:57 . 2009-02-26 16:57 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-02-26 16:45 . 2009-02-26 16:46 <DIR> d-------- c:\program files\Norton Security Scan 2009-02-26 09:53 . 2009-03-01 17:38 <DIR> d--hs---- c:\documents and settings\User1\Temporary Internet Files 2009-02-23 15:39 . 2009-02-23 15:39 54,156 --ah----- c:\windows\QTFont.qfn 2009-02-23 15:39 . 2009-02-23 15:39 1,409 --a------ c:\windows\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-02 09:23 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2009-03-02 09:21 --------- d-----w c:\program files\Google 2009-03-02 09:14 --------- d-----w c:\program files\Common Files\Symantec Shared 2009-03-02 09:11 --------- d-----w c:\documents and settings\User1\Application Data\Symantec 2009-02-26 16:57 --------- d-----w c:\program files\Java . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "InstantTray"="c:\program files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2003-10-22 746496] "IW_Drop_Icon"="c:\program files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2003-11-19 1134080] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-14 68856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-24 327680] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2003-07-17 184412] "CamMonitor"="c:\program files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe" [2002-10-06 90112] "HPHUPD05"="c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-05-22 49152] "HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-22 483328] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-20 98304] "Camera Detector"="c:\progra~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE" [2003-06-17 208896] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-07 180269] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-11-10 406016] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-26 148888] "ATIModeChange"="Ati2mdxx.exe" [2002-08-28 c:\windows\system32\Ati2mdxx.exe] "AGRSMMSG"="AGRSMMSG.exe" [2003-05-06 c:\windows\AGRSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\User2\Start Menu\Programs\Startup\ PowerReg Scheduler V3.exe [2006-09-12 225280] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Monitor.lnk - c:\program files\QLink 1.0\devmonit.exe [2006-03-26 45056] RAMASST.lnk - c:\windows\system32\RAMASST.exe [2004-08-19 151552] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= vdrcodec.dll "VIDC.ACDV"= ACDV.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R0 VOBID;VOBID;c:\windows\system32\drivers\vobid.sys [2003-08-01 29239] R1 vobcom;vobcom;c:\windows\system32\drivers\vobcom.sys [2001-10-04 9728] R1 vobiw;vobiw;c:\windows\system32\drivers\vobIW.sys [2003-08-27 187392] R2 BCDCNDIS;Belkin Direct Connect Network Adapter;c:\windows\system32\drivers\BCDCNDIS.SYS [2000-08-08 14054] R2 DFBatchSvc;DataFlux Batch Scheduler;c:\progra~1\DataFlux\DFPOWE~1\7.1\bin\DFBATC~1.EXE [2007-07-09 86016] R2 GtDetectSc;GtDetectSc;c:\program files\Orange\ICON 225 USB Connect\GtDetectSc.exe [2007-12-18 196704] R3 cdrdrv;Cdrdrv;c:\windows\system32\drivers\Cdrdrv.sys [2002-12-13 64000] R3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2007-11-13 106112] R3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2008-11-19 59264] R3 GTPTSER;GT PT SER;c:\windows\system32\drivers\gtptser.sys [2007-03-30 8064] R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;c:\windows\system32\drivers\wbsd.sys [2003-09-09 26240] S3 BCDCLINK;Belkin USB Direct Connect;c:\windows\system32\drivers\BCDCLINK.SYS [2004-04-10 14279] S3 Dz3s2kxp;Dz3s2kxp;c:\windows\system32\drivers\Dz3s2kxp.sys [2004-08-19 10496] S3 Dz3u2kxp;Dz3u2kxp;c:\windows\system32\drivers\Dz3u2kxp.sys [2004-08-19 11264] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{042ed220-81f2-11d9-9d80-00500c00ffaa}] \Shell\access\command - g:\.\sgportable\SGPortable.exe \Shell\AutoRun\command - g:\.\sgportable\SGPortable.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62175a32-adcc-11dd-9f8f-000cf11012f7}] \Shell\AutoRun\command - G:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62175a35-adcc-11dd-9f8f-000cf11012f7}] \Shell\AutoRun\command - G:\AutoRun.exe . Contents of the 'Scheduled Tasks' folder 2009-02-23 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - User1.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [] 2009-02-26 c:\windows\Tasks\Norton Security Scan for User1.job - c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18] . - - - - ORPHANS REMOVED - - - - HKCU-Run-MobileConnect.EXE - c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.EXE . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.co.uk/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Connection Wizard,ShellNext = hxxp://gb8l.hpwis.com/ uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-02 09:50:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... c:\windows\explorer.exe [1668] 0x828ADBC0 scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe???????????????|?????? ?deB???????????????B? ?????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\DVDRAMSV.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\windows\system32\MsPMSPSv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-03-02 9:53:39 - machine was rebooted ComboFix-quarantined-files.txt 2009-03-02 09:53:36 Pre-Run: 9,999,642,624 bytes free Post-Run: 10,105,991,168 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn 162 --- E O F --- 2009-02-26 00:06:55

This doesn't look too good. To add a little more information to my problem I should have said that this problem is on a laptop that does not get used very often. I used it two weeks ago to try and update the anti-virus software (Norton Internet Security 2008) before the subscription was due to expire but I was prevented from getting to the Norton site, which I now know to be caused by one of the viruses I had, or possibly still have. The subscription has now expired and, having looked at a number of reviews and spoken to friends and colleagues, I have now purchased Kaspersky and hopefully, once this mess is sorted out, I hope I'll be able to install it. Unfortunately I am stuck at another wall. I am now following the instructions to disable firewalls and anti virus software before running ComboFix. Whether the fact that the subscription has expired is a factor or not, whilst following the instructions on how to turn off Norton Internet Security (http://service1.symantec.com/SUPPORT/nip.nsf/docid/2003071515220236) there is no User Account in the left pane. I can disable the Firewall but I cannot see any other way of disabling the software and, as the subscription has expired, and I'm less than happy that it has not protected me I decided to uninstall it. Using my own account, which is a Computer Administrator, from Conrol Panel I go into Add or Remove Programs option to get a list of installed programs. However, when I click on any program whereas I expect to see a Chage or Remove option, there is nothing but Size, Used frequency and Last Used information. The only application that brings up the Remove option is Malwarebytes' Anti Malware. Do you know what's going on? I have no idea how to remove software completely other than this method. Thanks for your continued support, it's nice to know there's a guardian angel out there who can help take some of the stress of this situation away. I'll try and pick up your response and action as soon as possible.

Sorry, I managed to add the previous reply without the second log. mbam_log_2009_02_28__17_18_51_.txt mbam_log_2009_02_28__17_18_51_.txt

Success! I have successfully removed a number of Trojans after a bit of renaming. I presume one or more of the viruses has got wise to your mbam software and is blocking it from running as it was intended. However, just for the record, this is what I did to resolve the problem. 1. I logged on to my PC in 'safe mode' and, using the Administrator account, went into windows explorer and renamed the mbam-setup.exe to 'fix-setup.exe' 2. I double clicked on the program and that started the installation. 3. Although the installation went through to the point where it shows the 'Finishing Installation....' window with the blue progress bar showing 100% complete, it took some time (but < 10 minutes) before the 'Installation Complete' window appeared. 4. Both the 'Update Malwarebytes' Anti Malware' and 'Launch Malwarebytes' Anti Malware' check boxes were ticked. 5. I clicked 'Finish' and the Installation Complete window closed although the 'setup' task remained in my taskbar at the bottom of the screen for several minutes afterwards, but it did eventually disappear. I was expecting the Malwarebytes' Anti Malware' application to launch but nothing happened. I check Task Manager and could see a mbam.exe sitting there, but again it was not using any CPU. 6. Next I tried launching the application using the 'Malwarebytes' Anti-Malware' icon on the desktop but again nothing happened and I could see mbam.exe in Task Manager but never using any CPU. This stayed in the Task Manager for about 5 minutes before it disappeared. 7. Using windows explorer I drilled down to the Malwarebytes directory and copied the mbam.exe member giving it the name PTFix.exe. This I double clicked and successfully launched the scanning application which found a number of Trojans. 8. Having found the viruses I then asked the application to remove them, which it did. I have attached the log for your information. mbam_log_2009_02_28__15_09_38_.txt 9. I then rebooted my machine and logged on as normal to one of my XP accounts (NOT in safe mode this time). From there I initiated the original mbam.exe application using the Malwarebytes' icon that was added by the setup installation. This time the application ran in its own right, giving me immediate confidence that the viruses had indeed been killed! However, another set of viruses were identified (see second attached log). Q: Should mbam.exe be run from every user account? The machine I am cleaning runs XP Home Edition and has multiple user accounts. I assumed that the scan only needed to be run once but when I ran the second time not in 'safe mode' and found more viruses it made me wonder if I do need to scan from every account. I would be interested to know why the second batch of viruses were not detected first time round, which I'm sure you be able to explain. I have no idea when or how I picked these viruses up and I am more concerned that my Norton Anti Virus and Internet Security software did not pick these up especially as they have been around for some time. Many thanks to Malwarebytes for your help and support. A much happier and less MrAngry! mbam_log_2009_02_28__15_09_38_.txt

I have a virus 'go-google' which redirects me to anywhere but where I want to go when attempting to go to web sites via Google serach results. I have read threads from others who have suffered the same fate and I was directed to this site for help - so thanks for being here. I am also unable to connect to Norton or Microsoft web sites - IE also becomes very slow and I eventually get a message to say that the site does not exist or was not responding. Using a borrowed laptop I have followed the instructions in I'm infected - What do I do now? I downloaded the mbam-setup.exe and copied the desktop of my infected machine using a USB memory stick. I double click on the icon and can see the mbam-setup.exe as a process in taskmanager using 2,224K of memory but it never uses any CPU. It stays in taskmanager for 5 minutes before it disappears - I have timed it 3 times! I would appreciate any help you can give as I have already spent 2 days trying to hunt down and get rid of this nasty virus.