_colt

Absolutely amazing! Thanks for spending the whole day with me.

Here they are! # AdwCleaner v2.306 - Logfile created 07/25/2013 at 19:45:29 # Updated 19/07/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Administrator - WJCI03 # Boot Mode : Normal # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3} ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1163 octets] - [25/07/2013 19:35:39] AdwCleaner[s1].txt - [1106 octets] - [25/07/2013 19:45:29] ########## EOF - C:\AdwCleaner[s1].txt - [1166 octets] ########## Results of screen317's Security Check version 0.99.71 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Disabled! Please wait while WMIC compiles updated MOF files.d i s p l a y N a m e ECHO is off. M i c r o s o f t ECHO is off. S e c u r i t y ECHO is off. E s e n t i a l s ECHO is off. Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 6 Update 23 Java SE Runtime Environment 6 Update 1 Java 6 Update 2 Java 6 Update 3 Java 6 Update 5 Java 6 Update 7 Java version out of Date! ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 11% Defragment your hard drive soon! (Do NOT defrag if SSD!) ````````````````````End of Log``````````````````````

AdwCleaner log file: # AdwCleaner v2.306 - Logfile created 07/25/2013 at 19:35:39 # Updated 19/07/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Administrator - WJCI03 # Boot Mode : Normal # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD} Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3} ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1034 octets] - [25/07/2013 19:35:39] ########## EOF - C:\AdwCleaner[R1].txt - [1094 octets] ##########

Here is the ComboFix.txt ComboFix 13-07-25.02 - Administrator 07/25/2013 18:47:18.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1471 [GMT -5:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . . ((((((((((((((((((((((((( Files Created from 2013-06-25 to 2013-07-25 ))))))))))))))))))))))))))))))) . . 2013-07-25 23:25 . 2013-07-25 23:30 -------- d-----w- c:\windows\system32\MRT 2013-07-25 22:09 . 2013-07-25 22:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable) 2013-07-25 22:07 . 2013-07-25 22:07 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2013-07-25 21:20 . 2013-07-02 06:54 7143960 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{9267FC44-4190-4C80-A0EC-A591EE4A1AD5}\mpengine.dll 2013-07-25 12:50 . 2013-07-25 16:08 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0 2013-07-24 21:34 . 2013-07-24 21:34 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth 2013-07-24 21:33 . 2013-07-24 21:33 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2013-07-24 07:20 . 2013-07-02 06:54 7143960 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-07-07 22:07 . 2013-07-07 22:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Leadertech 2013-07-07 22:07 . 2013-07-07 22:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Xerox 2013-07-07 22:04 . 2013-07-07 22:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Xerox . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-16 14:28 . 2012-03-29 13:53 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-07-16 14:28 . 2011-05-19 13:43 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-06-19 02:50 . 2012-03-21 01:44 211560 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2013-06-08 04:55 . 2004-08-11 22:00 385024 ----a-w- c:\windows\system32\html.iec 2013-06-07 21:56 . 2004-08-11 22:00 920064 ----a-w- c:\windows\system32\wininet.dll 2013-06-07 21:56 . 2004-08-11 22:00 43520 ----a-w- c:\windows\system32\licmgr10.dll 2013-06-07 21:56 . 2004-08-11 22:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2013-06-04 07:23 . 2004-08-11 22:00 562688 ----a-w- c:\windows\system32\qedit.dll 2013-06-04 01:40 . 2008-08-28 20:39 1876736 ----a-w- c:\windows\system32\win32k.sys 2013-05-09 05:28 . 2006-10-19 03:47 1543680 ------w- c:\windows\system32\wmvdecod.dll 2013-05-03 01:30 . 2008-08-28 20:39 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-05-03 00:38 . 2008-08-28 20:39 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-05-02 15:28 . 2012-07-17 14:24 238872 ------w- c:\windows\system32\MpSigStub.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StatusClient 2.5"="c:\program files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2003-09-30 61440] "TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2003-06-10 155648] "Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 483328] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-11-04 7204864] "nwiz"="nwiz.exe" [2005-11-04 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-11-04 86016] "Opware12"="c:\program files\ScanSoft\OmniPagePro12.0\Opware12.exe" [2002-08-01 49152] "Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-20 995176] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2006-5-31 25214] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= . S3 MatSvc;Microsoft Automated Troubleshooting Service;c:\program files\Microsoft Fix it Center\Matsvc.exe [6/13/2011 10:09 PM 267568] S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [7/25/2013 5:07 PM 35144] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2013-07-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 14:28] . 2013-07-25 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job - c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-06-20 23:05] . . ------- Supplementary Scan ------- . IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html TCP: DhcpNameServer = 192.168.1.4 DPF: {6F74F92E-8DD8-4DDE-8FB8-CBB882A68048} - file://c:\program files\Microsoft Interactive Training\O10C\mitm0026.cab . - - - - ORPHANS REMOVED - - - - . HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe Notify-NavLogon - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-07-25 18:56 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-4015669829-748437774-2945145902-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,aa,9a,e9,64,51,ca,d0,45,84,8c,dd,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,aa,9a,e9,64,51,ca,d0,45,84,8c,dd,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(676) c:\windows\system32\Ati2evxx.dll . - - - - - - - > 'explorer.exe'(488) c:\windows\system32\WININET.dll c:\program files\ScanSoft\OmniPagePro12.0\ophook12.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Microsoft Security Client\MsMpEng.exe c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\nvsvc32.exe c:\program files\Windows Media Player\WMPNetwk.exe c:\windows\system32\RUNDLL32.EXE c:\program files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe c:\program files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe . ************************************************************************** . Completion time: 2013-07-25 19:02:02 - machine was rebooted ComboFix-quarantined-files.txt 2013-07-26 00:01 . Pre-Run: 51,027,292,160 bytes free Post-Run: 51,651,366,912 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect . - - End Of File - - AF391184BB62CAB85265C62F1F5F7DA6 8F558EB6672622401DA993E1E865C861

Completed Malwarebytes Anti-Rootkit cleanup operation. No additional threats found. Internet access, Windows update and firewall appear operational. Log files attached. mbar-log-2013-07-25 (17-09-36).txt system-log.txt

I appear to have been able to log in to a normal startup

MrC, Sorry for delay. Wasn't sure that I did it correctly so ran a second time. Here is the combined report: First Kapersky Scan: Objects Scan: completed 1 hour ago (events: 18, objects: 458616, time: 01:18:15) 7/25/13 12:58 PM Task started 7/25/13 1:03 PM Detected: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe 7/25/13 1:03 PM Untreated: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe Postponed 7/25/13 1:08 PM Detected: HEUR:Exploit.Java.Generic C:/Documents and Settings/JoshuaH.WJCI/Application Data/Sun/Java/Deployment/cache/6.0/40/412ca8-2183ce13 7/25/13 1:08 PM Untreated: HEUR:Exploit.Java.Generic C:/Documents and Settings/JoshuaH.WJCI/Application Data/Sun/Java/Deployment/cache/6.0/40/412ca8-2183ce13 Postponed 7/25/13 1:35 PM Detected: Backdoor.Win32.ZAccess.crgn C:/System Volume Information/_restore{46DE8921-1D39-44D2-A9E9-64119261F211}/RP2902/A0197845.exe 7/25/13 1:35 PM Untreated: Backdoor.Win32.ZAccess.crgn C:/System Volume Information/_restore{46DE8921-1D39-44D2-A9E9-64119261F211}/RP2902/A0197845.exe Postponed 7/25/13 2:12 PM Detected: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe 7/25/13 2:12 PM Untreated: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe Postponed 7/25/13 2:13 PM Detected: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe 7/25/13 2:14 PM Disinfected: Backdoor.Win32.ZAccess.crgn HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run/yCpCQSpcQDy4 7/25/13 2:14 PM Disinfected: Backdoor.Win32.ZAccess.crgn HKEY_USERS\S-1-5-21-4015669829-748437774-2945145902-500\Software\Microsoft\Windows\CurrentVersion\Run/yCpCQSpcQDy4 7/25/13 2:14 PM Deleted: Backdoor.Win32.ZAccess.crgn C:/Documents and Settings/Administrator/Local Settings/Application Data/RsbYH13.exe 7/25/13 2:14 PM Detected: HEUR:Exploit.Java.Generic C:/Documents and Settings/JoshuaH.WJCI/Application Data/Sun/Java/Deployment/cache/6.0/40/412ca8-2183ce13 7/25/13 2:16 PM Deleted: HEUR:Exploit.Java.Generic C:/Documents and Settings/JoshuaH.WJCI/Application Data/Sun/Java/Deployment/cache/6.0/40/412ca8-2183ce13 7/25/13 2:16 PM Detected: Backdoor.Win32.ZAccess.crgn C:/System Volume Information/_restore{46DE8921-1D39-44D2-A9E9-64119261F211}/RP2902/A0197845.exe 7/25/13 2:17 PM Deleted: Backdoor.Win32.ZAccess.crgn C:/System Volume Information/_restore{46DE8921-1D39-44D2-A9E9-64119261F211}/RP2902/A0197845.exe 7/25/13 2:17 PM Task completed Second Kaspersky Scan: Objects Scan: completed 3 minutes ago (events: 2, objects: 458687, time: 01:14:47) 7/25/13 2:23 PM Task started 7/25/13 3:38 PM Task completed

First, thank you for helping me. Unfortunately, I have not been able to get enough control of the system to run the FRST.exe

I have MoneyPak FBI virus on machine running Wndows XP SP3 Cannot boot into SAFE MODE or SAFE MODE WITH NETWORKING (both result in blue screen of death) Cannot access any menus or System Manager on startup - the scumbags are in total control Have a memory stick available with yesterday's downloads of: FRST.exe tdsskiller.exe mbar-1.06.0.1004.zip SecurityCheck.exe ComboFix.exe I would surely appreciate any available help regaining control