Jump to content

slowreactor

Members
 View Profile  See their activity

  • Posts

    19

  • Joined

  • Last visited

 Content Type 

Posts posted by slowreactor

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    Looks like it found a few more things:

    C:\MGtools.exe probably a variant of Win32/TrojanDropper.Agent trojan cleaned by deleting - quarantined

    C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\11\51bd4ccb-429e62af Java/TrojanDownloader.Agent.NBJ trojan deleted - quarantined

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP159\A0024383.exe probably a variant of Win32/TrojanDropper.Agent trojan cleaned by deleting - quarantined

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    Alright, I updated Java, and did a full scan with MBAM, and it found nothing:

    Malwarebytes' Anti-Malware 1.46

    www.malwarebytes.org

    Database version: 4309

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 7.0.5730.11

    7/13/2010 12:43:22 PM

    mbam-log-2010-07-13 (12-43-22).txt

    Scan type: Full scan (C:\|)

    Objects scanned: 213083

    Time elapsed: 1 hour(s), 2 minute(s), 24 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    I accidentally messed up... I ran the program the first time before I thoroughly read your instructions, and it cleared out 1 infected item, which I don't remember the name now. After I realized there was no log to post, I followed your instructions, and this is the log for the second time it ran.

    16:26:38:828 3544 TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49

    16:26:38:828 3544 ================================================================================

    16:26:38:828 3544 SystemInfo:

    16:26:38:828 3544 OS Version: 5.1.2600 ServicePack: 3.0

    16:26:38:828 3544 Product type: Workstation

    16:26:38:828 3544 ComputerName: DELL-0706

    16:26:38:828 3544 UserName: Neil Blythe

    16:26:38:828 3544 Windows directory: C:\WINDOWS

    16:26:38:828 3544 System windows directory: C:\WINDOWS

    16:26:38:828 3544 Processor architecture: Intel x86

    16:26:38:828 3544 Number of processors: 2

    16:26:38:828 3544 Page size: 0x1000

    16:26:38:828 3544 Boot type: Normal boot

    16:26:38:828 3544 ================================================================================

    16:26:39:218 3544 Initialize success

    16:26:39:218 3544

    16:26:39:218 3544 Scanning Services ...

    16:26:39:625 3544 Raw services enum returned 401 services

    16:26:39:640 3544

    16:26:39:640 3544 Scanning Drivers ...

    16:26:40:234 3544 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS

    16:26:40:343 3544 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

    16:26:40:421 3544 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

    16:26:40:515 3544 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys

    16:26:40:593 3544 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

    16:26:40:640 3544 AegisP (30bb1bde595ca65fd5549462080d94e5) C:\WINDOWS\system32\DRIVERS\AegisP.sys

    16:26:40:734 3544 Afc (a7b8a3a79d35215d798a300df49ed23f) C:\WINDOWS\system32\drivers\Afc.sys

    16:26:40:843 3544 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

    16:26:40:921 3544 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

    16:26:40:968 3544 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys

    16:26:40:984 3544 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys

    16:26:41:062 3544 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys

    16:26:41:109 3544 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys

    16:26:41:171 3544 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys

    16:26:41:250 3544 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys

    16:26:41:265 3544 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys

    16:26:41:281 3544 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys

    16:26:41:359 3544 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys

    16:26:41:421 3544 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys

    16:26:41:468 3544 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys

    16:26:41:562 3544 ASCTRM (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys

    16:26:41:640 3544 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

    16:26:41:656 3544 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

    16:26:41:718 3544 ati2mtag (03621f7f968ff63713943405deb777f9) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

    16:26:41:796 3544 ATIAVPCI (b27fec21c1125bab7d3c8cdf872e627b) C:\WINDOWS\system32\DRIVERS\atinavrr.sys

    16:26:41:875 3544 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

    16:26:41:875 3544 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

    16:26:42:031 3544 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys

    16:26:42:062 3544 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

    16:26:42:140 3544 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

    16:26:42:187 3544 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys

    16:26:42:265 3544 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

    16:26:42:312 3544 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

    16:26:42:390 3544 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

    16:26:42:437 3544 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys

    16:26:42:500 3544 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys

    16:26:42:562 3544 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys

    16:26:42:578 3544 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys

    16:26:42:718 3544 DcCam (32e31781d59be1fa9c66c5d2e42ef12a) C:\WINDOWS\system32\DRIVERS\DcCam.sys

    16:26:42:781 3544 DcFpoint (016ad1e71da43c39e5211fd7521c88d0) C:\WINDOWS\system32\DRIVERS\DcFpoint.sys

    16:26:42:859 3544 DCFS2K (7cef1cd1dc5c24208f196c36eb48a411) C:\WINDOWS\system32\drivers\dcfs2k.sys

    16:26:42:968 3544 DcLps (2484fe767708eaba26767f2da0256398) C:\WINDOWS\system32\DRIVERS\DcLps.sys

    16:26:43:015 3544 DcPTP (a76d1610c9cae786006d412f012dcb7c) C:\WINDOWS\system32\DRIVERS\DcPTP.sys

    16:26:43:109 3544 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

    16:26:43:140 3544 DLABOIOM (e2d0de31442390c35e3163c87cb6a9eb) C:\WINDOWS\system32\DLA\DLABOIOM.SYS

    16:26:43:156 3544 DLACDBHM (d979bebcf7edcc9c9ee1857d1a68c67b) C:\WINDOWS\system32\Drivers\DLACDBHM.SYS

    16:26:43:171 3544 DLADResN (83545593e297f50a8e2524b4c071a153) C:\WINDOWS\system32\DLA\DLADResN.SYS

    16:26:43:218 3544 DLAIFS_M (96e01d901cdc98c7817155cc057001bf) C:\WINDOWS\system32\DLA\DLAIFS_M.SYS

    16:26:43:234 3544 DLAOPIOM (0a60a39cc5e767980a31ca5d7238dfa9) C:\WINDOWS\system32\DLA\DLAOPIOM.SYS

    16:26:43:296 3544 DLAPoolM (9fe2b72558fc808357f427fd83314375) C:\WINDOWS\system32\DLA\DLAPoolM.SYS

    16:26:43:359 3544 DLARTL_N (7ee0852ae8907689df25049dcd2342e8) C:\WINDOWS\system32\Drivers\DLARTL_N.SYS

    16:26:43:421 3544 DLAUDFAM (f08e1dafac457893399e03430a6a1397) C:\WINDOWS\system32\DLA\DLAUDFAM.SYS

    16:26:43:437 3544 DLAUDF_M (e7d105ed1e694449d444a9933df8e060) C:\WINDOWS\system32\DLA\DLAUDF_M.SYS

    16:26:43:531 3544 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

    16:26:43:578 3544 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

    16:26:43:625 3544 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

    16:26:43:671 3544 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

    16:26:43:734 3544 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys

    16:26:43:796 3544 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

    16:26:43:812 3544 DRVMCDB (fd0f95981fef9073659d8ec58e40aa3c) C:\WINDOWS\system32\Drivers\DRVMCDB.SYS

    16:26:43:875 3544 DRVNDDM (b4869d320428cdc5ec4d7f5e808e99b5) C:\WINDOWS\system32\Drivers\DRVNDDM.SYS

    16:26:44:093 3544 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys

    16:26:44:187 3544 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys

    16:26:44:234 3544 E100B (95974e66d3de4951d29e28e8bc0b644c) C:\WINDOWS\system32\DRIVERS\e100b325.sys

    16:26:44:328 3544 Eplpdx02 (f9472131367d39435d750f5fa3d23582) C:\WINDOWS\system32\Drivers\EPLPDX02.SYS

    16:26:44:406 3544 Exportit (bf218812f530e6a80be487cbfd1f3dde) C:\WINDOWS\system32\DRIVERS\exportit.sys

    16:26:44:468 3544 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

    16:26:44:484 3544 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

    16:26:44:500 3544 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

    16:26:44:546 3544 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

    16:26:44:593 3544 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

    16:26:44:609 3544 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

    16:26:44:640 3544 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

    16:26:44:718 3544 GEARAspiWDM (4ac51459805264affd5f6fdfb9d9235f) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

    16:26:44:890 3544 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

    16:26:45:015 3544 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys

    16:26:45:140 3544 HidIr (bb1a6fb7d35a91e599973fa74a619056) C:\WINDOWS\system32\DRIVERS\hidir.sys

    16:26:45:250 3544 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

    16:26:45:312 3544 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys

    16:26:45:421 3544 HSFHWBS2 (77e4ff0b73bc0aeaaf39bf0c8104231f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys

    16:26:45:500 3544 HSF_DP (60e1604729a15ef4a3b05f298427b3b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys

    16:26:45:609 3544 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

    16:26:45:656 3544 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys

    16:26:45:703 3544 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys

    16:26:45:734 3544 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

    16:26:45:750 3544 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

    16:26:45:781 3544 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys

    16:26:45:859 3544 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

    16:26:45:921 3544 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

    16:26:46:109 3544 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

    16:26:46:171 3544 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

    16:26:46:312 3544 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

    16:26:46:484 3544 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

    16:26:46:500 3544 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

    16:26:46:531 3544 IrBus (b43b36b382aea10861f7c7a37f9d4ae2) C:\WINDOWS\system32\DRIVERS\IrBus.sys

    16:26:46:562 3544 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

    16:26:46:609 3544 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

    16:26:46:656 3544 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

    16:26:46:671 3544 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

    16:26:46:734 3544 klmd23 (316353165feba3d0538eaa9c2f60c5b7) C:\WINDOWS\system32\drivers\klmd.sys

    16:26:46:781 3544 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

    16:26:46:812 3544 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

    16:26:46:859 3544 mdmxsdk (eeaea6514ba7c9d273b5e87c4e1aab30) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

    16:26:46:953 3544 mfeavfk (bafdd5e28baea99d7f4772af2f5ec7ee) C:\WINDOWS\system32\drivers\mfeavfk.sys

    16:26:47:046 3544 mfebopk (1d003e3056a43d881597d6763e83b943) C:\WINDOWS\system32\drivers\mfebopk.sys

    16:26:47:125 3544 mfehidk (3f138a1c8a0659f329f242d1e389b2cf) C:\WINDOWS\system32\drivers\mfehidk.sys

    16:26:47:250 3544 mferkdk (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys

    16:26:47:328 3544 mfesmfk (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys

    16:26:47:453 3544 MHNDRV (7f2f1d2815a6449d346fcccbc569fbd6) C:\WINDOWS\system32\DRIVERS\mhndrv.sys

    16:26:47:546 3544 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

    16:26:47:609 3544 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

    16:26:47:625 3544 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys

    16:26:47:687 3544 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

    16:26:47:734 3544 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

    16:26:47:750 3544 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

    16:26:47:796 3544 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys

    16:26:47:843 3544 MPFP (136157e79849b9e5316ba4008d6075a8) C:\WINDOWS\system32\Drivers\Mpfp.sys

    16:26:48:000 3544 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys

    16:26:48:078 3544 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

    16:26:48:125 3544 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

    16:26:48:156 3544 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

    16:26:48:218 3544 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

    16:26:48:250 3544 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

    16:26:48:281 3544 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

    16:26:48:343 3544 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

    16:26:48:375 3544 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

    16:26:48:406 3544 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

    16:26:48:437 3544 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

    16:26:48:453 3544 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

    16:26:48:484 3544 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

    16:26:48:515 3544 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

    16:26:48:546 3544 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

    16:26:48:562 3544 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

    16:26:48:578 3544 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

    16:26:48:609 3544 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

    16:26:48:640 3544 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

    16:26:48:703 3544 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

    16:26:48:718 3544 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

    16:26:48:750 3544 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

    16:26:48:843 3544 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

    16:26:48:875 3544 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

    16:26:48:890 3544 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

    16:26:48:921 3544 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

    16:26:48:953 3544 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

    16:26:48:984 3544 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

    16:26:49:000 3544 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

    16:26:49:015 3544 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

    16:26:49:078 3544 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

    16:26:49:140 3544 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys

    16:26:49:218 3544 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys

    16:26:49:265 3544 pnetmdm (da19e3401f39c10df193be029c7e7bba) C:\WINDOWS\system32\DRIVERS\pnetmdm.sys

    16:26:49:359 3544 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

    16:26:49:375 3544 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

    16:26:49:406 3544 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

    16:26:49:437 3544 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys

    16:26:49:468 3544 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys

    16:26:49:515 3544 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys

    16:26:49:546 3544 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys

    16:26:49:562 3544 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys

    16:26:49:609 3544 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys

    16:26:49:625 3544 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

    16:26:49:656 3544 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

    16:26:49:656 3544 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

    16:26:49:671 3544 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

    16:26:49:687 3544 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

    16:26:49:703 3544 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

    16:26:49:750 3544 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

    16:26:49:781 3544 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

    16:26:49:796 3544 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

    16:26:49:828 3544 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys

    16:26:49:875 3544 RTL8187B (4e812ac89eec95aac9cacea29a0f8dc8) C:\WINDOWS\system32\DRIVERS\wg111v3.sys

    16:26:50:093 3544 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

    16:26:50:140 3544 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

    16:26:50:171 3544 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

    16:26:50:203 3544 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

    16:26:50:281 3544 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys

    16:26:50:281 3544 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

    16:26:50:312 3544 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys

    16:26:50:359 3544 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

    16:26:50:406 3544 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

    16:26:50:468 3544 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys

    16:26:50:562 3544 STHDA (2a2dc39623adef8ab3703ab9fac4b440) C:\WINDOWS\system32\drivers\sthda.sys

    16:26:50:640 3544 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

    16:26:50:687 3544 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

    16:26:50:703 3544 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

    16:26:50:718 3544 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys

    16:26:50:781 3544 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys

    16:26:50:843 3544 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys

    16:26:50:859 3544 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys

    16:26:50:921 3544 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

    16:26:50:984 3544 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

    16:26:51:031 3544 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

    16:26:51:078 3544 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

    16:26:51:109 3544 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

    16:26:51:140 3544 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys

    16:26:51:171 3544 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

    16:26:51:187 3544 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys

    16:26:51:281 3544 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

    16:26:51:312 3544 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

    16:26:51:359 3544 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

    16:26:51:375 3544 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

    16:26:51:421 3544 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

    16:26:51:468 3544 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

    16:26:51:484 3544 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

    16:26:51:500 3544 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

    16:26:51:531 3544 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys

    16:26:51:562 3544 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

    16:26:51:593 3544 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys

    16:26:51:625 3544 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys

    16:26:51:703 3544 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

    16:26:51:718 3544 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

    16:26:51:765 3544 wanatw (0a716c08cb13c3a8f4f51e882dbf7416) C:\WINDOWS\system32\DRIVERS\wanatw4.sys

    16:26:51:843 3544 wceusbsh (4a954a20a4c73d6db13c0fe25f3f1b0c) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys

    16:26:51:953 3544 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys

    16:26:52:093 3544 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

    16:26:52:156 3544 winachsf (f59ed5a43b988a18ef582bb07b2327a7) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

    16:26:52:187 3544 WinUSB (fd600b032e741eb6aab509fc630f7c42) C:\WINDOWS\system32\DRIVERS\WinUSB.sys

    16:26:52:281 3544 WpdUsb (bbaeaca1ffa3c86361cf0998474f6c3a) C:\WINDOWS\system32\Drivers\wpdusb.sys

    16:26:52:343 3544 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

    16:26:52:343 3544

    16:26:52:343 3544 Completed

    16:26:52:343 3544

    16:26:52:343 3544 Results:

    16:26:52:343 3544 Registry objects infected / cured / cured on reboot: 0 / 0 / 0

    16:26:52:343 3544 File objects infected / cured / cured on reboot: 0 / 0 / 0

    16:26:52:343 3544

    16:26:52:359 3544 KLMD(ARK) unloaded successfully

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    I tried your methods, and it didn't seem to help. I looked at the mouse settings and there was nothing out of the ordinar. I know it's not the hardware, since if I hold down the right mouse button on the desktop and drag, it will show the right-click menu the first time, but then it will stop working. The redirects are still coming even with the reset, so I still suspect that my system isn't clean. I'm running MBAM again right now, to see if I maybe messed something up the first time.

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    Alright, I did update and do a full scan with MBAM. It found quite a few things, which I did clear out, but even after all that, it still doesn't seem fully fixed. The computer is definitely faster now, but I still do not have any right-click capabilities, and google searches are still redirecting me to these random sites. Here is the MBAM log:

    Malwarebytes' Anti-Malware 1.46

    www.malwarebytes.org

    Database version: 4305

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 7.0.5730.11

    7/12/2010 2:59:28 PM

    mbam-log-2010-07-12 (14-59-28).txt

    Scan type: Full scan (C:\|)

    Objects scanned: 212597

    Time elapsed: 1 hour(s), 0 minute(s), 21 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 3

    Registry Values Infected: 2

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 21

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    HKEY_CURRENT_USER\SOFTWARE\EWABQAF7KL (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\Software\UBC5AB1IDP (Malware.Trace) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fxcytcrm (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewabqaf7kl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    C:\Qoobox\Quarantine\C\Documents and Settings\Neil Blythe\Application Data\a4deb692.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\Bpaxoa.exe.vir (Trojan.FraudPack) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\hulahake.exe.vir (Rogue.AdvancedVirusRemover) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\ernel32.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\31e9a1k9.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\55cEI.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\931aA3179.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\Q17cE179.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\Qoobox\Quarantine\C\WINDOWS\system32\spool\prtprocs\w32x86\wS79317g.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP154\A0019803.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP155\A0020805.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP155\A0021803.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP155\A0021822.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022913.exe (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022915.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022916.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022917.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022918.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022919.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022920.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP156\A0022921.dll (Trojan.Agent) -> Quarantined and deleted successfully.

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    oh my god... ComboFix got owned by the virus...

    When I first tried to run it, it wouldn't open, and Windows Explorer then closed off & restarted itself. I then renamed it as Combo-Fix, and it did run, but it didn't run right, it looks like. It crashed as it was trying to create a restore point, and I got a BSOD. I don't know what to do anymore, help!

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    1 more thing I forgot to mention, is that I can't use any right-click functions anymore, since nothing pops up from a right-click anymore. Anyways, here are both logs (though they have slightly different names):

    Extras.txt

    OTL Extras logfile created on: 7/12/2010 7:49:43 AM - Run 1

    OTL by OldTimer - Version 3.2.9.0 Folder = C:\Documents and Settings\Neil Blythe\Desktop

    Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

    Internet Explorer (Version = 7.0.5730.11)

    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1,022.00 Mb Total Physical Memory | 539.00 Mb Available Physical Memory | 53.00% Memory free

    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 75.00% Paging File free

    Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

    Drive C: | 144.30 Gb Total Space | 113.66 Gb Free Space | 78.76% Space Free | Partition Type: NTFS

    D: Drive not present or media not loaded

    E: Drive not present or media not loaded

    F: Drive not present or media not loaded

    Drive G: | 7.47 Gb Total Space | 4.67 Gb Free Space | 62.46% Space Free | Partition Type: FAT32

    H: Drive not present or media not loaded

    I: Drive not present or media not loaded

    Computer Name: DELL-0706

    Current User Name: Neil Blythe

    Logged in as Administrator.

    Current Boot Mode: Normal

    Scan Mode: All users

    Company Name Whitelist: Off

    Skip Microsoft Files: Off

    File Age = 30 Days

    Output = Standard

    ========== Extra Registry (SafeList) ==========

    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

    batfile [open] -- "%1" %*

    cmdfile [open] -- "%1" %*

    comfile [open] -- "%1" %*

    exefile [open] -- "%1" %*

    htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

    htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

    piffile [open] -- "%1" %*

    regfile [merge] -- Reg Error: Key error.

    scrfile [config] -- "%1"

    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

    scrfile [open] -- "%1" /S

    txtfile [edit] -- Reg Error: Key error.

    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

    "FirstRunDisabled" = 1

    "AntiVirusOverride" = 0

    "FirewallOverride" = 0

    "AntiVirusDisableNotify" = 0

    "FirewallDisableNotify" = 0

    "UpdatesDisableNotify" = 0

    "UacDisableNotify" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

    "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

    "EnableFirewall" = 0

    "DoNotAllowExceptions" = 1

    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

    "26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

    "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

    "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

    "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

    "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

    "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)

    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)

    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)

    "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)

    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)

    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)

    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

    "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)

    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)

    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)

    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Computer, Inc.)

    "C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager -- (Microsoft Corporation)

    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager -- (Microsoft Corporation)

    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application -- (Microsoft Corporation)

    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)

    "C:\Program Files\McAfee\MSC\mcupdui.exe" = C:\Program Files\McAfee\MSC\mcupdui.exe:*:Enabled:mcupdui -- (McAfee, Inc.)

    "C:\Program Files\McAfee\MSC\mcupdmgr.exe" = C:\Program Files\McAfee\MSC\mcupdmgr.exe:*:Enabled:mcupdmgr -- (McAfee, Inc.)

    "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent -- (McAfee, Inc.)

    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

    "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation)

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

    "{00A148E8-2D9A-422E-9473-E5850C135F2A}" = Treo 700wx User Guide

    "{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data

    "{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel

    "{0D6D96F4-0CAF-4522-B05F-70A88EDECDFD}" = ArcSoft Print Creations

    "{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE

    "{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = Qualxserve Service Agreement

    "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA

    "{1CA2E5E4-F4FE-44B4-95E9-77523FB95838}" = EPSON Stylus Photo RX595 Series Scanner Driver Update

    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool

    "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Roxio MyDVD LE

    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

    "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java 6 Update 18

    "{26E76762-7F20-4694-AD06-CC3A9B547A71}" = Microsoft Office Live Meeting 2007

    "{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D

    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager

    "{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10

    "{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)

    "{34C17174-BEA7-45A8-9BD0-7E5AF3639B3E}" = Kodak EasyShare software

    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

    "{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers

    "{390FF986-468D-4CA9-8830-2C4B313F447F}" = ATI Parental Control

    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant

    "{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting

    "{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer

    "{446DBFFA-4088-48E3-8932-74316BA4CAE4}" = iTunes

    "{4667B940-BB01-428B-986E-A0CC46497BF7}" = ELIcon

    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

    "{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack

    "{50D8FFDD-90CD-4859-841F-AA1961C7767A}" = QuickTime

    "{5396FBD8-8BD7-47F9-92AE-F62F13D5A11D}" = NETGEAR WG111v3 wireless USB 2.0 adapter

    "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool

    "{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module

    "{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon

    "{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail

    "{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal

    "{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer

    "{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK

    "{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}" = EarthLink setup files

    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

    "{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore

    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

    "{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)

    "{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar

    "{7A3F0566-5E05-4919-9C98-456F6B5CF831}" = Get High Speed Internet!

    "{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport

    "{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper

    "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials

    "{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel® PROSet for Wired Connections

    "{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync

    "{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    A few things I forgot to mention in my last post:

    The computer is running at a snail's pace right now, and I basically can barely do anything. I also had to rename combofix to a random name before I could run it, even though it crashed very soon afterward. I haven't tried FF yet, and I don't have Chrome.

    Hopefully this might add a bit more, and thanks in advance for any help!

    google search redirecting

    in Resolved Malware Removal Logs

    Posted

    Hi,

    recently, I've noticed that anytime I search stuff up with Google, whenver I click on the link, it seems to redirect me to another search engine site (which is obvious now that it's a virus doing this). After a little looking around, it seems that I might have a browser hijacker virus. So, I tried to run my MBAM (which I haven't done for a few months now...), and it won't let me run it. I then used a randomly named MBAM exe. file, which ran, but will not let me update (Error Code: 732 (12007, 0) ).

    That's where I started to panic. I then tried to run ComboFix, but after a few minutes, the computer suddenly crashed on me, and so now I'm kind of scared to touch it again. I DID manage to successfully get both the DDR and GMER logs, but DeFogger gave me an error log after I tried to run it.

    I'm currently typing this from another computer that is not infected, since my infected computer will not let me access this site. I copied the files over with a flash drive, is that safe?

    DDS.txt

    DDS (Ver_10-03-17.01) - NTFSx86

    Run by Neil Blythe at 8:27:02.57 on Thu 07/08/2010

    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_18

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.323 [GMT -4:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost -k DcomLaunch

    svchost.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    svchost.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\WINDOWS\system32\drivers\dcfssvc.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\WINDOWS\ehome\ehtray.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\WINDOWS\stsystra.exe

    C:\Program Files\Dell\Media Experience\DMXLauncher.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\WINDOWS\System32\DLA\DLACTRLW.EXE

    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\AOL\1173656309\ee\AOLSoftware.exe

    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    C:\Program Files\McAfee.com\Agent\mcagent.exe

    C:\Program Files\Common Files\Java\Java Update\jusched.exe

    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\PROGRA~1\MI3AA1~1\wcescomm.exe

    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\PROGRA~1\MI3AA1~1\rapimgr.exe

    C:\DOCUME~1\NEILBL~1\LOCALS~1\Temp\Bvl.exe

    C:\WINDOWS\Bpaxoa.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\Common Files\AOL\Loader\aolload.exe

    C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    svchost.exe

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

    C:\Program Files\NETGEAR\WG111v3\WG111v3.exe

    C:\WINDOWS\system32\svchost.exe -k imgsvc

    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

    C:\Program Files\PdaNet for Android\PdaNetPC.exe

    C:\Documents and Settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe

    C:\WINDOWS\wanmpsvc.exe

    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    C:\Program Files\McAfee\MPF\MPFSrv.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\Program Files\McAfee\MSK\MskSrver.exe

    C:\Documents and Settings\Neil Blythe\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

    uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll

    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

    uRun: [H/PC Connection Agent] "c:\progra~1\mi3aa1~1\wcescomm.exe"

    uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe"

    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background

    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

    uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    uRun: [fxcytcrm] c:\documents and settings\neil blythe\local settings\application data\ndlrnsdax\nbnaypitssd.exe

    uRun: [EWABQAF7KL] c:\docume~1\neilbl~1\locals~1\temp\Bvl.exe

    mRun: [ehTray] c:\windows\ehome\ehtray.exe

    mRun: [sigmatelSysTrayApp] stsystra.exe

    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"

    mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe

    mRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup

    mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

    mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

    mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe

    mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    mRun: [HostManager] c:\program files\common files\aol\1173656309\ee\AOLSoftware.exe

    mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    mRun: [iMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE

    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

    mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

    mRun: [Easy Dock]

    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

    mRun: [fxcytcrm] c:\documents and settings\neil blythe\local settings\application data\ndlrnsdax\nbnaypitssd.exe

    dRunOnce: [RunNarrator] Narrator.exe

    StartupFolder: c:\docume~1\neilbl~1\startm~1\programs\startup\pdanet~1.lnk - c:\program files\pdanet for android\PdaNetPC.exe

    StartupFolder: c:\docume~1\neilbl~1\startm~1\programs\startup\rcadet~1.lnk - c:\documents and settings\neil blythe\my documents\rca detective\RCADetective.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v3\WG111v3.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe

    mPolicies-system: EnableLUA = 0 (0x0)

    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: internet

    Trusted Zone: mcafee.com

    Trusted Zone: musicmatch.com\online

    DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab

    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab

    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

    TCP: NameServer = 93.188.162.221,93.188.166.201

    TCP: {29D3941F-2A16-478E-AD06-4C370D293DD4} = 93.188.162.221,93.188.166.201

    TCP: {3768CEA1-5912-4D07-8921-FE790A066455} = 93.188.162.221,93.188.166.201

    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

    ============= SERVICES / DRIVERS ===============

    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-7-8 214664]

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-10-2 210216]

    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-10-2 359952]

    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-10-2 144704]

    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-10-2 606736]

    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-10-2 79816]

    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-10-2 35272]

    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-10-2 40552]

    R3 pnetmdm;PdaNet Modem;c:\windows\system32\drivers\pnetmdm.sys [2010-2-27 9472]

    S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

    S2 PEVSystemStart;PEVSystemStart;c:\asdfge4h3\PEV.cfxxe [2010-7-8 256512]

    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-10-2 34248]

    S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys [2007-4-23 224896]

    =============== Created Last 30 ================

    2010-07-08 12:00:24 0 d-s---w- C:\asdfge4h3

    2010-07-08 11:31:40 0 d-sh--w- C:\found.000

    2010-07-08 01:50:57 173056 ----a-w- c:\windows\Bpaxoa.exe

    2010-07-08 01:50:44 62976 ----a-w- c:\windows\system32\ernel32.dll

    2010-07-08 01:50:39 62976 ----a-w- c:\docume~1\neilbl~1\applic~1\a4deb692.exe

    2010-07-06 12:48:06 0 d-----w- C:\OEMSettings

    2010-06-26 14:25:41 82696 ----a-w- c:\windows\system32\lmdimon8.dll

    2010-06-26 14:24:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Applications

    2010-06-20 00:19:35 54156 ---ha-w- c:\windows\QTFont.qfn

    2010-06-20 00:19:35 1409 ----a-w- c:\windows\QTFont.for

    ==================== Find3M ====================

    2010-05-04 12:39:27 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe

    2010-05-04 12:39:27 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe

    2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

    2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys

    2010-04-26 19:58:12 256512 ----a-w- c:\windows\PEV.exe

    2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\atmfd.dll

    2010-04-20 05:30:08 285696 ------w- c:\windows\system32\dllcache\atmfd.dll

    2010-04-16 11:43:25 634656 ------w- c:\windows\system32\dllcache\iexplore.exe

    2010-04-16 11:43:23 161792 ------w- c:\windows\system32\dllcache\ieakui.dll

    2008-11-07 21:18:29 251 ----a-w- c:\program files\wt3d.ini

    2007-04-23 18:21:16 269824 ----a-w- c:\windows\inf\wg111v3\vista64\wg111v3.sys

    2007-04-23 18:11:54 224896 ----a-w- c:\windows\inf\wg111v3\wg111v3.sys

    2006-12-15 15:30:36 98304 ----a-w- c:\windows\inf\wg111v3\UScanM.exe

    2006-12-15 15:30:36 66048 ----a-w- c:\windows\inf\wg111v3\EAPPkt.sys

    2006-12-15 15:30:36 315392 ----a-w- c:\windows\inf\wg111v3\InstallDriver.exe

    2006-12-15 15:30:36 28672 ----a-w- c:\windows\inf\wg111v3\SetDrv.exe

    2006-12-15 15:30:36 212992 ----a-w- c:\windows\inf\wg111v3\CopyWHQLDriver.exe

    2006-12-15 15:30:36 20480 ----a-w- c:\windows\inf\wg111v3\RTWUPath.exe

    2006-12-15 15:30:36 19968 ----a-w- c:\windows\inf\wg111v3\RTWREFU.EXE

    2009-03-14 00:34:13 88 --sh--r- c:\windows\system32\4F5CF89AFC.sys

    2009-03-14 00:34:21 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys

    2009-01-05 01:51:52 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010420090105\index.dat

    ============= FINISH: 8:29:41.40 ===============

    Attach.zip

    Ad trojans, MBAM disabled

    in Resolved Malware Removal Logs

    Posted

    You're right, I'm sorry about that, here are the items you requested:

    F-Secure log: (I hope this is the one you're looking for)

    Scanning Report

    Tuesday, January 19, 2010 08:53:42 - 10:08:29

    Computer name: DELL-0706

    Scanning type: Scan system for malware, spyware and rootkits

    Target: C:\ E:\

    --------------------------------------------------------------------------------

    12 malware found

    TrackingCookie.Questionmarket (spyware)

    System (Disinfected)

    TrackingCookie.2o7 (spyware)

    System (Disinfected)

    TrackingCookie.Advertising (spyware)

    System (Disinfected)

    TrackingCookie.Atdmt (spyware)

    System (Disinfected)

    TrackingCookie.Doubleclick (spyware)

    System (Disinfected)

    TrackingCookie.Revsci (spyware)

    System (Disinfected)

    TrackingCookie.Adrevolver (spyware)

    System (Disinfected)

    TrackingCookie.Adbrite (spyware)

    System (Disinfected)

    TrackingCookie.Mediaplex (spyware)

    System (Disinfected)

    TrackingCookie.Statcounter (spyware)

    System (Disinfected)

    TrackingCookie.Atwola (spyware)

    System (Disinfected)

    TrackingCookie.Yieldmanager (spyware)

    System (Disinfected)

    --------------------------------------------------------------------------------

    Statistics

    Scanned:

    Files: 48428

    System: 4175

    Not scanned: 15

    Actions:

    Disinfected: 12

    Renamed: 0

    Deleted: 0

    Not cleaned: 0

    Submitted: 0

    Files not scanned:

    C:\PAGEFILE.SYS

    C:\WINDOWS\TEMP\MCMSC_HRR9YOMJQRUVM7N

    C:\WINDOWS\TEMP\SQLITE_GAZNBRJ9MD5P6DK

    C:\WINDOWS\TEMP\SQLITE_SDII7BVKVNOLFZZ

    C:\WINDOWS\TEMP\SQLITE_Z98CVVF8X19BXR7

    C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

    C:\WINDOWS\SYSTEM32\CONFIG\SAM

    C:\WINDOWS\SYSTEM32\CONFIG\SECURITY

    C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

    C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

    C:\PROGRAM FILES\WINDOWS DEFENDER\MSMPENG.EXE

    C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE

    C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE

    C:\DOCUMENTS AND SETTINGS\ALL USERS\DOCUMENTS\RECORDED TV\TEMPREC\TEMPSBE\MSDVRMM_3496824715_6684672_27943

    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\3AD391678A806EC4D691E83AAA393B6F_24ADF822-76F7-4481-B30B-FF1B40F8687F

    --------------------------------------------------------------------------------

    Options

    Scanning engines:

    Scanning options:

    Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR

    Use advanced heuristics

    --------------------------------------------------------------------------------

    Copyright

    Ad trojans, MBAM disabled

    in Resolved Malware Removal Logs

    Posted

    Sorry for the late response, the holidays got the better of me.

    I've attached both combofix and hijackthis logs and pasted them on here too just in case.

    Combofix:

    ComboFix 10-01-03.05 - Neil Blythe 01/04/2010 9:01.1.2 - x86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.442 [GMT -5:00]

    Running from: c:\documents and settings\Neil Blythe\Desktop\ComboFix.exe

    AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    c:\windows\system32\g

    c:\windows\Tasks\jkmtazej.job

    .

    ((((((((((((((((((((((((( Files Created from 2009-12-04 to 2010-01-04 )))))))))))))))))))))))))))))))

    .

    2010-01-02 20:19 . 2010-01-02 20:19 -------- d-----w- c:\documents and settings\Neil Blythe\Local Settings\Application Data\assembly

    2010-01-02 20:05 . 2010-01-02 20:05 -------- d-----w- c:\documents and settings\Neil Blythe\Local Settings\Application Data\IsolatedStorage

    2010-01-02 20:00 . 2010-01-02 20:04 -------- d-----w- c:\program files\Virtual Earth 3D

    2009-12-25 17:36 . 2009-12-03 21:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-12-25 17:36 . 2009-12-25 17:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-12-25 17:36 . 2009-12-03 21:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-12-09 04:13 . 2006-07-06 03:59 -------- d-----w- c:\program files\Microsoft ActiveSync

    2009-11-22 18:17 . 2009-10-03 01:37 -------- d-----w- c:\program files\McAfee

    2009-11-22 00:03 . 2008-10-04 20:59 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore

    2009-11-08 03:59 . 2006-08-05 15:01 79664 ----a-w- c:\documents and settings\Neil Blythe\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-11-08 03:57 . 2008-04-02 03:04 -------- d-----w- c:\program files\Windows Live

    2009-11-08 03:57 . 2008-04-02 03:46 -------- d-----w- c:\program files\Windows Live Toolbar

    2009-11-08 03:57 . 2009-11-08 03:57 -------- d-----w- c:\program files\Microsoft Sync Framework

    2009-11-08 03:56 . 2009-11-08 03:56 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

    2009-11-08 03:52 . 2009-11-08 03:52 -------- d-----w- c:\program files\Microsoft

    2009-11-08 03:52 . 2009-11-08 03:52 -------- d-----w- c:\program files\Windows Live SkyDrive

    2009-11-08 03:32 . 2009-11-08 03:32 -------- d-----w- c:\program files\Common Files\Windows Live

    2009-10-29 07:46 . 2005-08-16 08:18 832512 ----a-w- c:\windows\system32\wininet.dll

    2009-10-29 07:46 . 2005-08-16 08:18 78336 ----a-w- c:\windows\system32\ieencode.dll

    2009-10-29 07:46 . 2005-08-16 08:18 17408 ----a-w- c:\windows\system32\corpol.dll

    2009-10-21 05:38 . 2005-08-16 08:18 75776 ----a-w- c:\windows\system32\strmfilt.dll

    2009-10-21 05:38 . 2005-08-16 08:18 25088 ----a-w- c:\windows\system32\httpapi.dll

    2009-10-20 16:20 . 2004-08-04 03:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

    2009-10-13 10:30 . 2005-08-16 08:18 270336 ----a-w- c:\windows\system32\oakley.dll

    2009-10-12 13:38 . 2005-08-16 08:18 149504 ----a-w- c:\windows\system32\rastls.dll

    2009-10-12 13:38 . 2005-08-16 08:18 79872 ----a-w- c:\windows\system32\raschap.dll

    2008-11-07 21:18 . 2008-11-07 21:18 251 ----a-w- c:\program files\wt3d.ini

    2009-03-14 00:34 . 2006-08-05 15:00 88 --sh--r- c:\windows\system32\4F5CF89AFC.sys

    2009-03-14 00:34 . 2006-08-05 15:00 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

    "OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-05-28 95800]

    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856]

    "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]

    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-15 1998576]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]

    "SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 339968]

    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]

    "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]

    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]

    "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]

    "AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]

    "Ink Monitor"="c:\program files\EPSON\Ink Monitor\InkMonitor.exe" [2001-12-07 258118]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

    "HostManager"="c:\program files\Common Files\AOL\1173656309\ee\AOLSoftware.exe" [2006-09-26 50736]

    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]

    "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-10 44032]

    "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-10 59392]

    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]

    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]

    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]

    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-01 149280]

    "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    "RunNarrator"="Narrator.exe" [2008-04-14 53760]

    c:\documents and settings\Neil Blythe\Start Menu\Programs\Startup\

    RCA Detective.lnk - c:\documents and settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe [2009-6-21 942592]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-7-5 24576]

    EPSON Status Monitor 3 Environment Check 2.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2007-2-28 127488]

    Kodak EasyShare software.lnk - c:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2002-6-26 290816]

    Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

    "NoSetActiveDesktop"= 1 (0x1)

    "NoActiveDesktopChanges"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

    "c:\\Program Files\\America Online 9.0\\waol.exe"=

    "c:\\Program Files\\Messenger\\msmsgs.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

    "c:\\WINDOWS\\system32\\taskmgr.exe"=

    "c:\\Program Files\\McAfee\\MSC\\mcupdui.exe"=

    "c:\\Program Files\\McAfee\\MSC\\mcupdmgr.exe"=

    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [10/2/2009 8:42 PM 210216]

    S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]

    .

    Contents of the 'Scheduled Tasks' folder

    2009-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 22:13]

    2009-10-03 c:\windows\Tasks\McDefragTask.job

    - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-03 16:22]

    2009-10-03 c:\windows\Tasks\McQcTask.job

    - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-03 16:22]

    .

    .

    ------- Supplementary Scan -------

    .

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    mStart Page = hxxp://www.google.com

    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

    uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    Trusted Zone: internet

    Trusted Zone: mcafee.com

    Trusted Zone: musicmatch.com\online

    .

    - - - - ORPHANS REMOVED - - - -

    HKU-Default-Run-Install - c:\documents and settings\Neil Blythe\Application Data\1060356438\1060356438.bat

    AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2010-01-04 09:06

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    Completion time: 2010-01-04 09:09:22

    ComboFix-quarantined-files.txt 2010-01-04 14:09

    ComboFix2.txt 2009-10-01 22:45

    ComboFix3.txt 2009-09-26 15:53

    Pre-Run: 127,955,591,168 bytes free

    Post-Run: 128,051,658,752 bytes free

    - - End Of File - - 506A46A793620C8CC60A47628B9E67BE

    hijackthis:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 9:19:27 AM, on 1/4/2010

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16945)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\stsystra.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\WINDOWS\System32\DLA\DLACTRLW.EXE

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\AOL\1173656309\ee\AOLSoftware.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\McAfee.com\Agent\mcagent.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\PROGRA~1\MI3AA1~1\wcescomm.exe

    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\MI3AA1~1\rapimgr.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\Documents and Settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\McAfee\MPF\MPFSrv.exe

    C:\Program Files\McAfee\MSK\MskSrver.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\wanmpsvc.exe

    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\dllhost.exe

    C:\WINDOWS\eHome\ehmsas.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\WINDOWS\explorer.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Windows Live\Toolbar\wltuser.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    C:\Documents and Settings\Neil Blythe\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s

    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

    O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

    O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

    O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

    O4 - HKLM\..\Run: [iSUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

    O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    O4 - HKLM\..\Run: [ink Monitor] C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1173656309\ee\AOLSoftware.exe

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe"

    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

    O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

    O4 - Startup: RCA Detective.lnk = C:\Documents and Settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O15 - Trusted Zone: http://*.mcafee.com

    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase6796.cab

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

    O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --

    End of file - 11875 bytes

    combofix_log.txt

    hijackthis.txt

    Ad trojans, MBAM disabled

    in Resolved Malware Removal Logs

    Posted

    A little while ago I made a report here, and thanks to the helpful people here my computer was disinfected - or so I thought. It appears that this virus is back, now constantly throwing pop-ups for trojans. My first thought was to follow the instructions again, but I ran into a problem with MBAM, and had to follow the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=29028 to fix it.

    I managed to get through all the steps though, and I've attached all logs.

    DDS log:

    DDS (Ver_09-11-24.02) - NTFSx86

    Run by Neil Blythe at 13:01:08.75 on Fri 12/25/2009

    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_16

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.406 [GMT -5:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost -k DcomLaunch

    svchost.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\stsystra.exe

    C:\Program Files\Dell\Media Experience\DMXLauncher.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\WINDOWS\System32\DLA\DLACTRLW.EXE

    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\AOL\1173656309\ee\AOLSoftware.exe

    svchost.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\WINDOWS\system32\drivers\dcfssvc.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\McAfee.com\Agent\mcagent.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\McAfee\MPF\MPFSrv.exe

    C:\Program Files\McAfee\MSK\MskSrver.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    svchost.exe

    C:\WINDOWS\system32\svchost.exe -k imgsvc

    C:\WINDOWS\wanmpsvc.exe

    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\dllhost.exe

    C:\WINDOWS\eHome\ehmsas.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\PROGRA~1\MI3AA1~1\wcescomm.exe

    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\PROGRA~1\MI3AA1~1\rapimgr.exe

    C:\WINDOWS\System32\svchost.exe -k HTTPFilter

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

    C:\Documents and Settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\Program Files\Windows Live\Toolbar\wltuser.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    C:\Program Files\Malwarebytes' Anti-Malware\RBtSrMWLs.exe

    C:\WINDOWS\system32\rundll32.exe

    C:\Documents and Settings\Neil Blythe\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    mStart Page = hxxp://www.google.com

    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

    uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll

    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

    uRun: [H/PC Connection Agent] "c:\progra~1\mi3aa1~1\wcescomm.exe"

    uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe"

    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background

    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

    uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    mRun: [ehTray] c:\windows\ehome\ehtray.exe

    mRun: [sigmatelSysTrayApp] stsystra.exe

    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"

    mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe

    mRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup

    mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

    mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

    mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe

    mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    mRun: [HostManager] c:\program files\common files\aol\1173656309\ee\AOLSoftware.exe

    mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    mRun: [iMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE

    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

    mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

    dRun: [install] c:\documents and settings\neil blythe\application data\1060356438\1060356438.bat

    dRunOnce: [RunNarrator] Narrator.exe

    StartupFolder: c:\docume~1\neilbl~1\startm~1\programs\startup\rcadet~1.lnk - c:\documents and settings\neil blythe\my documents\rca detective\RCADetective.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe

    dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)

    dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: internet

    Trusted Zone: mcafee.com

    Trusted Zone: musicmatch.com\online

    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

    AppInit_DLLs: poliwapu.dll

    ============= SERVICES / DRIVERS ===============

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-10-2 210216]

    R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]

    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]

    S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

    =============== Created Last 30 ================

    2009-12-25 17:36:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-12-25 17:36:19 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-12-25 17:36:19 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-12-25 17:04:52 0 ----a-w- c:\documents and settings\neil blythe\defogger_reenable

    2009-11-28 21:35:38 0 ----a-w- c:\documents and settings\neil blythe\defogger_renable

    ==================== Find3M ====================

    2009-10-28 14:36:11 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe

    2009-10-28 14:36:11 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe

    2009-10-28 06:54:16 634632 ------w- c:\windows\system32\dllcache\iexplore.exe

    2009-10-28 06:52:46 161792 ------w- c:\windows\system32\dllcache\ieakui.dll

    2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll

    2009-10-21 05:38:36 75776 ------w- c:\windows\system32\dllcache\strmfilt.dll

    2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll

    2009-10-21 05:38:36 25088 ------w- c:\windows\system32\dllcache\httpapi.dll

    2009-10-20 16:20:16 265728 ------w- c:\windows\system32\dllcache\http.sys

    2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll

    2009-10-13 10:30:16 270336 ------w- c:\windows\system32\dllcache\oakley.dll

    2009-10-12 13:38:19 149504 ----a-w- c:\windows\system32\rastls.dll

    2009-10-12 13:38:19 149504 ------w- c:\windows\system32\dllcache\rastls.dll

    2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll

    2009-10-12 13:38:18 79872 ------w- c:\windows\system32\dllcache\raschap.dll

    2009-10-01 23:05:44 121675 ----a-w- C:\MGlogs.zip

    2009-10-01 22:59:47 411368 ----a-w- c:\windows\system32\deploytk.dll

    2008-11-07 21:18:29 251 ----a-w- c:\program files\wt3d.ini

    2009-03-14 00:34:13 88 --sh--r- c:\windows\system32\4F5CF89AFC.sys

    2009-03-14 00:34:21 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys

    2009-01-05 01:51:52 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010420090105\index.dat

    ============= FINISH: 13:02:13.29 ===============

    mbam_log_2009_12_25__12_53_38_.txt

    Attach.zip

    Trojans

    in Resolved Malware Removal Logs

    Posted

    When I booted up my computer today, I was greeted with a trojan that pretended to be security software. I then followed the instructions here: http://www.malwarebytes.org/forums/index.php?showtopic=9573

    After running MBAM, I don't see any more problems, but I do want to just attach the logs to make sure. Thanks!

    P.S. DeFogger didn't ask me to reboot, but it gave no error messages, but I'll attach defogger_disable too, just in case:

    defogger_disable by jpshortstuff (27.11.09.1)

    Log created at 16:36 on 28/11/2009 (Neil Blythe)

    Checking for autostart values...

    HKCU\~\Run values retrieved.

    HKLM\~\Run values retrieved.

    Checking for services/drivers...

    -=E.O.F=-

    DDS log:

    DDS (Ver_09-11-24.02) - NTFSx86

    Run by Neil Blythe at 16:37:55.56 on Sat 11/28/2009

    Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_16

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.481 [GMT -5:00]

    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost -k DcomLaunch

    svchost.exe

    C:\WINDOWS\System32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\ehome\ehtray.exe

    C:\WINDOWS\stsystra.exe

    C:\Program Files\Dell\Media Experience\DMXLauncher.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\WINDOWS\System32\DLA\DLACTRLW.EXE

    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\AOL\1173656309\ee\AOLSoftware.exe

    svchost.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\McAfee.com\Agent\mcagent.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\PROGRA~1\MI3AA1~1\wcescomm.exe

    C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\WINDOWS\system32\drivers\dcfssvc.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\WINDOWS\eHome\ehRecvr.exe

    C:\PROGRA~1\MI3AA1~1\rapimgr.exe

    C:\WINDOWS\eHome\ehSched.exe

    C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe

    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    C:\Documents and Settings\Neil Blythe\My Documents\RCA Detective\RCADetective.exe

    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE

    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\McAfee\MPF\MPFSrv.exe

    C:\Program Files\McAfee\MSK\MskSrver.exe

    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    svchost.exe

    C:\WINDOWS\system32\svchost.exe -k imgsvc

    C:\WINDOWS\wanmpsvc.exe

    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\WINDOWS\system32\dllhost.exe

    C:\WINDOWS\eHome\ehmsas.exe

    C:\WINDOWS\System32\svchost.exe -k HTTPFilter

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    C:\Program Files\Windows Live\Toolbar\wltuser.exe

    C:\Program Files\Java\jre6\bin\jucheck.exe

    C:\Program Files\internet explorer\iexplore.exe

    C:\Documents and Settings\Neil Blythe\Desktop\dds.scr

    C:\WINDOWS\SYSTEM32\NOTEPAD.EXE

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    mStart Page = hxxp://www.google.com

    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

    uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll

    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

    TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

    uRun: [H/PC Connection Agent] "c:\progra~1\mi3aa1~1\wcescomm.exe"

    uRun: [OM2_Monitor] "c:\program files\olympus\olympus master 2\MMonitor.exe"

    uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background

    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

    uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    mRun: [ehTray] c:\windows\ehome\ehtray.exe

    mRun: [sigmatelSysTrayApp] stsystra.exe

    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"

    mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe

    mRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup

    mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

    mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

    mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe

    mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

    mRun: [HostManager] c:\program files\common files\aol\1173656309\ee\AOLSoftware.exe

    mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    mRun: [iMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE

    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

    mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

    mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

    mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

    dRun: [install] c:\documents and settings\neil blythe\application data\1060356438\1060356438.bat

    dRunOnce: [RunNarrator] Narrator.exe

    StartupFolder: c:\docume~1\neilbl~1\startm~1\programs\startup\rcadet~1.lnk - c:\documents and settings\neil blythe\my documents\rca detective\RCADetective.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe

    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe

    dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)

    dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: internet

    Trusted Zone: mcafee.com

    Trusted Zone: musicmatch.com\online

    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6796.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

    ============= SERVICES / DRIVERS ===============

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-10-2 210216]

    R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]

    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]

    S1 SASKUTIL;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

    =============== Created Last 30 ================

    2009-11-28 21:35:38 0 ----a-w- c:\documents and settings\neil blythe\defogger_renable

    2009-11-28 21:10:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-11-28 21:10:19 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-11-28 21:10:19 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-11-08 03:59:23 0 d-----w- c:\documents and settings\neil blythe\Tracing

    2009-11-08 03:56:12 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll

    2009-11-08 03:56:01 0 d-----w- c:\program files\Microsoft SQL Server Compact Edition

    2009-11-08 03:52:45 0 d-----w- c:\program files\Microsoft

    2009-11-08 03:52:29 0 d-----w- c:\program files\Windows Live SkyDrive

    2009-11-08 03:32:41 0 d-----w- c:\program files\common files\Windows Live

    2009-11-06 22:44:09 54156 ---ha-w- c:\windows\QTFont.qfn

    2009-11-06 22:44:09 1409 ----a-w- c:\windows\QTFont.for

    ==================== Find3M ====================

    2009-10-21 04:08:54 3598336 ----a-w- c:\windows\system32\dllcache\mshtml.dll

    2009-10-01 23:05:44 121675 ----a-w- C:\MGlogs.zip

    2009-10-01 22:59:47 411368 ----a-w- c:\windows\system32\deploytk.dll

    2009-09-22 01:06:40 2381452 ----a-w- C:\MGtools.exe

    2009-09-22 00:18:48 61224 ----a-w- c:\documents and settings\neil blythe\GoToAssistDownloadHelper.exe

    2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-11 14:18:39 136192 ------w- c:\windows\system32\dllcache\msv1_0.dll

    2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll

    2009-09-04 21:03:36 58880 ------w- c:\windows\system32\dllcache\msasn1.dll

    2008-11-07 21:18:29 251 ----a-w- c:\program files\wt3d.ini

    2009-03-14 00:34:13 88 --sh--r- c:\windows\system32\4F5CF89AFC.sys

    2009-03-14 00:34:21 3350 --sha-w- c:\windows\system32\KGyGaAvL.sys

    2009-01-05 01:51:52 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010420090105\index.dat

    ============= FINISH: 16:38:58.14 ===============

    mbam_log_2009_11_28__16_25_26_.txt

    Attach.zip

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.