I need a Christmas miracle

smasher12 · December 22, 2011

Hi, I'm hoping you guys can help because I'm in over my head here. I had/have the AV Cloud 2012 virus. Basically a fake anti virus program would pop up and tell my computer was infected. I searched the net and found some guides on how to deal with it. I downloaded a program called RKill and another program called combofix that I was using to fight the virus. Except it keeps reinstalling itself so I am not able to get rid of it. Yesterday I saw that something was going on with my PC so ran Combo fix.

Combo fix gave an alert stating that I had the "zero access" virus and that it was a particularly nasty virus and that if after running combo fix I could not connect to the internet I should reboot and if that didn't work then I should run combo fix again. Well I did that and I am still unable to connect to the internet (on a friends PC now).

Also I am not able to do a system restore as any time I try the system restore fails.

So I have no idea what to do now. I'm not completely computer illiterate but I'm also no expert either. I could really use some help and I would really appreciate if you can help. Thanks.

Here is the Hijack this log.

-Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 8:48:12 PM, on 12/21/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Real\RealPlayer\update\realsched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe

C:\Documents and Settings\IBUYPOWER\Bluebirds\BlueBirds.exe

c:\program files\avira\antivir desktop\avcenter.exe

C:\Program Files\Avira\AntiVir Desktop\avscan.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Power DVD Player\PowerDVDPlayer.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: CrossRider - {A876E312-7D08-401a-B7A6-FAFC5DC2F292} - C:\Program Files\CrossriderWebApps\Crossrider.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\update\realsched.exe" -osboot

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"

O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\IBUYPOWER\Bluebirds\BlueBirds.exe

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira Mail Protection (AntiVirMailService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Avira Web Protection (AntiVirWebService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 6556 bytes

smasher12 · December 22, 2011

Here is the Malware bytes log I ran last night. This showed something relevant.

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8384

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

12/21/2011 11:09:27 PM

mbam-log-2011-12-21 (23-09-27).txt

Scan type: Full scan (C:\|)

Objects scanned: 232491

Time elapsed: 1 hour(s), 26 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\IBUYPOWER\Local Settings\Application Data\vsi.exe" -a "firefox.exe -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

And the Avira log also showed detections

Avira Antivirus Premium 2012

Report file date: Wednesday, December 21, 2011 19:53

Scanning for 2952372 virus strains and unwanted programs.

The program is running as a fully functional evaluation version.

Online services are available:

Licensee : Arnold Barrett

Serial number : 2218005751-PEPWE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : IBUYPOWE-18F1F5

Version information:

BUILD.DAT : 12.0.0.888 42511 Bytes 12/15/2011 16:53:00

AVSCAN.EXE : 12.1.0.18 490448 Bytes 12/14/2011 09:12:01

AVSCAN.DLL : 12.1.0.17 54224 Bytes 9/24/2011 00:34:57

LUKE.DLL : 12.1.0.17 68304 Bytes 10/12/2011 02:06:29

AVSCPLR.DLL : 12.1.0.21 99536 Bytes 12/14/2011 05:12:13

AVREG.DLL : 12.1.0.27 227536 Bytes 12/14/2011 05:12:13

VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 07:18:34

VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 22:07:39

VBASE002.VDF : 7.11.19.170 14374912 Bytes 12/20/2011 03:32:10

VBASE003.VDF : 7.11.19.171 2048 Bytes 12/20/2011 03:32:10

VBASE004.VDF : 7.11.19.172 2048 Bytes 12/20/2011 03:32:10

VBASE005.VDF : 7.11.19.173 2048 Bytes 12/20/2011 03:32:10

VBASE006.VDF : 7.11.19.174 2048 Bytes 12/20/2011 03:32:11

VBASE007.VDF : 7.11.19.175 2048 Bytes 12/20/2011 03:32:11

VBASE008.VDF : 7.11.19.176 2048 Bytes 12/20/2011 03:32:11

VBASE009.VDF : 7.11.19.177 2048 Bytes 12/20/2011 03:32:11

VBASE010.VDF : 7.11.19.178 2048 Bytes 12/20/2011 03:32:11

VBASE011.VDF : 7.11.19.179 2048 Bytes 12/20/2011 03:32:11

VBASE012.VDF : 7.11.19.180 2048 Bytes 12/20/2011 03:32:11

VBASE013.VDF : 7.11.19.181 2048 Bytes 12/20/2011 03:32:11

VBASE014.VDF : 7.11.19.182 2048 Bytes 12/20/2011 03:32:12

VBASE015.VDF : 7.11.19.183 2048 Bytes 12/20/2011 03:32:12

VBASE016.VDF : 7.11.19.184 2048 Bytes 12/20/2011 03:32:12

VBASE017.VDF : 7.11.19.185 2048 Bytes 12/20/2011 03:32:12

VBASE018.VDF : 7.11.19.186 2048 Bytes 12/20/2011 03:32:12

VBASE019.VDF : 7.11.19.187 2048 Bytes 12/20/2011 03:32:12

VBASE020.VDF : 7.11.19.188 2048 Bytes 12/20/2011 03:32:12

VBASE021.VDF : 7.11.19.189 2048 Bytes 12/20/2011 03:32:13

VBASE022.VDF : 7.11.19.190 2048 Bytes 12/20/2011 03:32:13

VBASE023.VDF : 7.11.19.191 2048 Bytes 12/20/2011 03:32:13

VBASE024.VDF : 7.11.19.192 2048 Bytes 12/20/2011 03:32:13

VBASE025.VDF : 7.11.19.193 2048 Bytes 12/20/2011 03:32:13

VBASE026.VDF : 7.11.19.194 2048 Bytes 12/20/2011 03:32:13

VBASE027.VDF : 7.11.19.195 2048 Bytes 12/20/2011 03:32:13

VBASE028.VDF : 7.11.19.196 2048 Bytes 12/20/2011 03:32:13

VBASE029.VDF : 7.11.19.197 2048 Bytes 12/20/2011 03:32:14

VBASE030.VDF : 7.11.19.198 2048 Bytes 12/20/2011 03:32:14

VBASE031.VDF : 7.11.19.215 169984 Bytes 12/21/2011 03:31:16

Engineversion : 8.2.8.8

AEVDF.DLL : 8.1.2.2 106868 Bytes 12/14/2011 05:12:12

AESCRIPT.DLL : 8.1.3.92 495996 Bytes 12/16/2011 06:05:14

AESCN.DLL : 8.1.7.2 127349 Bytes 9/2/2011 10:46:02

AESBX.DLL : 8.2.4.5 434549 Bytes 12/14/2011 05:12:12

AERDL.DLL : 8.1.9.15 639348 Bytes 9/9/2011 10:16:06

AEPACK.DLL : 8.2.15.1 770423 Bytes 12/14/2011 05:12:11

AEOFFICE.DLL : 8.1.2.24 201084 Bytes 12/16/2011 06:05:13

AEHEUR.DLL : 8.1.3.8 4231543 Bytes 12/16/2011 06:05:12

AEHELP.DLL : 8.1.18.0 254327 Bytes 12/14/2011 05:12:04

AEGEN.DLL : 8.1.5.17 405877 Bytes 12/14/2011 05:12:04

AEEMU.DLL : 8.1.3.0 393589 Bytes 9/2/2011 10:46:01

AECORE.DLL : 8.1.24.2 201080 Bytes 12/16/2011 06:05:07

AEBB.DLL : 8.1.1.0 53618 Bytes 9/2/2011 10:46:01

AVWINLL.DLL : 12.1.0.17 27344 Bytes 10/12/2011 02:06:22

AVPREF.DLL : 12.1.0.17 51920 Bytes 10/12/2011 02:06:18

AVREP.DLL : 12.1.0.17 179920 Bytes 10/12/2011 02:06:19

AVARKT.DLL : 12.1.0.19 208848 Bytes 12/14/2011 09:11:58

AVEVTLOG.DLL : 12.1.0.17 169168 Bytes 10/12/2011 02:06:17

SQLITE3.DLL : 3.7.0.0 398288 Bytes 10/12/2011 02:06:32

AVSMTP.DLL : 12.1.0.17 63440 Bytes 10/12/2011 02:06:20

NETNT.DLL : 12.1.0.17 17104 Bytes 10/12/2011 02:06:30

RCIMAGE.DLL : 12.1.0.17 4493520 Bytes 10/12/2011 02:06:38

RCTEXT.DLL : 12.1.0.16 96208 Bytes 9/24/2011 00:37:28

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: default

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Extended process scan...............: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: extended

Start of the scan: Wednesday, December 21, 2011 19:53

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

Master boot sector HD3

[iNFO] No virus was found!

Master boot sector HD4

[iNFO] No virus was found!

Master boot sector HD5

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting search for hidden objects.

The scan of running processes will be started

Scan process 'rsmsink.exe' - '28' Module(s) have been scanned

Scan process 'msdtc.exe' - '40' Module(s) have been scanned

Scan process 'dllhost.exe' - '60' Module(s) have been scanned

Scan process 'dllhost.exe' - '45' Module(s) have been scanned

Scan process 'vssvc.exe' - '48' Module(s) have been scanned

Scan process 'avscan.exe' - '72' Module(s) have been scanned

Scan process 'avcenter.exe' - '72' Module(s) have been scanned

Scan process 'BlueBirds.exe' - '37' Module(s) have been scanned

Scan process 'PSFree.exe' - '30' Module(s) have been scanned

Scan process 'avgnt.exe' - '65' Module(s) have been scanned

Scan process 'mbamgui.exe' - '25' Module(s) have been scanned

Scan process 'jusched.exe' - '21' Module(s) have been scanned

Scan process 'svchost.exe' - '37' Module(s) have been scanned

Scan process 'realsched.exe' - '38' Module(s) have been scanned

Scan process 'RUNDLL32.EXE' - '28' Module(s) have been scanned

Scan process 'alg.exe' - '35' Module(s) have been scanned

Scan process 'AVWEBGRD.EXE' - '38' Module(s) have been scanned

Scan process 'avmailc.exe' - '29' Module(s) have been scanned

Scan process 'avshadow.exe' - '26' Module(s) have been scanned

Scan process 'mbamservice.exe' - '35' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '19' Module(s) have been scanned

Scan process 'jqs.exe' - '35' Module(s) have been scanned

Scan process 'avguard.exe' - '76' Module(s) have been scanned

Scan process 'Explorer.EXE' - '88' Module(s) have been scanned

Scan process 'svchost.exe' - '34' Module(s) have been scanned

Scan process 'sched.exe' - '41' Module(s) have been scanned

Scan process 'spoolsv.exe' - '52' Module(s) have been scanned

Scan process 'svchost.exe' - '28' Module(s) have been scanned

Scan process 'svchost.exe' - '165' Module(s) have been scanned

Scan process 'svchost.exe' - '39' Module(s) have been scanned

Scan process 'svchost.exe' - '53' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '38' Module(s) have been scanned

Scan process 'lsass.exe' - '59' Module(s) have been scanned

Scan process 'services.exe' - '27' Module(s) have been scanned

Scan process 'winlogon.exe' - '71' Module(s) have been scanned

Scan process 'csrss.exe' - '12' Module(s) have been scanned

Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting to scan executable files (registry).

The registry was scanned ( '1350' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\Qoobox\Quarantine\C\Documents and Settings\IBUYPOWER\Local Settings\Application Data\qui.exe.vir

[DETECTION] Is the TR/Fake.Rean.292 Trojan

C:\Qoobox\Quarantine\C\Documents and Settings\IBUYPOWER\Local Settings\Application Data\xxw.exe.vir

[DETECTION] Is the TR/Fake.Rean.827 Trojan

C:\System Volume Information\_restore{DE18B3A4-DB5C-489C-9B92-E542682F5E9D}\RP28\A0007584.exe

[DETECTION] Is the TR/Fake.Rean.827 Trojan

C:\System Volume Information\_restore{DE18B3A4-DB5C-489C-9B92-E542682F5E9D}\RP33\A0009143.sys

[DETECTION] Is the TR/Rootkit.Gen2 Trojan

Beginning disinfection:

C:\System Volume Information\_restore{DE18B3A4-DB5C-489C-9B92-E542682F5E9D}\RP33\A0009143.sys

[DETECTION] Is the TR/Rootkit.Gen2 Trojan

[NOTE] The file was moved to the quarantine directory under the name '4d7841b9.qua'.

C:\System Volume Information\_restore{DE18B3A4-DB5C-489C-9B92-E542682F5E9D}\RP28\A0007584.exe

[DETECTION] Is the TR/Fake.Rean.827 Trojan

[NOTE] The file was moved to the quarantine directory under the name '55ef6e1e.qua'.

C:\Qoobox\Quarantine\C\Documents and Settings\IBUYPOWER\Local Settings\Application Data\xxw.exe.vir

[DETECTION] Is the TR/Fake.Rean.827 Trojan

[NOTE] The file was moved to the quarantine directory under the name '07fb372e.qua'.

C:\Qoobox\Quarantine\C\Documents and Settings\IBUYPOWER\Local Settings\Application Data\qui.exe.vir

[DETECTION] Is the TR/Fake.Rean.292 Trojan

[NOTE] The file was moved to the quarantine directory under the name '61fe78f1.qua'.

End of the scan: Wednesday, December 21, 2011 21:09

Used time: 1:15:39 Hour(s)

The scan has been done completely.

8147 Scanned directories

237760 Files were scanned

4 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 Files were deleted

0 Viruses and unwanted programs were repaired

4 Files were moved to quarantine

0 Files were renamed

0 Files cannot be scanned

237756 Files not concerned

1615 Archives were scanned

0 Warnings

4 Notes

366008 Objects were scanned with rootkit scan

0 Hidden objects were found

smasher12 · December 22, 2011

Here is the log from combofix which was running when I was typing up the first post. Doesn't appear to show anything but like I said I am in over my head, so I may be missing a lot.

ComboFix 11-12-21.02 - IBUYPOWER 12/22/2011 16:27:39.15.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1504 [GMT -11:00]

Running from: c:\documents and settings\IBUYPOWER\My Documents\Downloads\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

((((((((((((((((((((((((( Files Created from 2011-11-23 to 2011-12-23 )))))))))))))))))))))))))))))))

.

2011-12-19 00:58 . 2011-12-19 00:58 388096 ----a-r- c:\documents and settings\IBUYPOWER\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-12-19 00:58 . 2011-12-19 00:58 -------- d-----w- c:\program files\Trend Micro

2011-12-16 05:36 . 2011-07-15 13:29 456320 -c--a-w- c:\windows\system32\dllcache\mrxsmb.sys

2011-12-16 05:36 . 2011-07-15 13:29 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-12-14 05:11 . 2011-12-14 05:11 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\Avira

2011-12-14 05:11 . 2011-12-14 09:12 134856 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-12-14 05:11 . 2011-12-14 05:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2011-12-14 05:11 . 2011-12-14 05:11 -------- d-----w- c:\program files\Avira

2011-12-14 05:11 . 2011-10-12 02:06 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-12-14 05:11 . 2011-10-12 02:06 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2011-12-14 03:34 . 2008-04-14 12:00 64512 -c--a-w- c:\windows\system32\dllcache\serial.sys

2011-12-14 03:34 . 2008-04-14 12:00 64512 ----a-w- c:\windows\system32\drivers\serial.sys

2011-12-13 06:20 . 2011-12-13 06:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-13 06:20 . 2011-09-01 04:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-13 06:05 . 2008-04-14 11:10 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys

2011-12-13 06:05 . 2008-04-14 11:10 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys

2011-12-13 05:29 . 2011-12-13 05:29 -------- d-----w- c:\windows\system32\wbem\Repository

2011-11-24 20:39 . 2011-11-24 20:39 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\FS1ivD3on

2011-11-24 20:39 . 2011-11-24 20:39 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\EhYXwjUVeOtPy

2011-11-24 20:29 . 2011-11-24 20:29 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\xlIBtzPNyAiDoFa

2011-11-24 19:01 . 2011-11-24 22:34 -------- d-----w- c:\program files\C4ED1

2011-11-24 19:00 . 2011-11-24 19:00 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\UXXXqjYYCeIBrO

2011-11-24 19:00 . 2011-11-24 19:01 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\F0FC4

2011-11-24 19:00 . 2011-11-24 19:00 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\yYYYCwkkIVl

2011-11-24 19:00 . 2011-11-24 19:00 -------- d-----w- c:\documents and settings\IBUYPOWER\Application Data\t77fRRL9hT

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-03 20:23 . 2011-07-22 00:08 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-23 13:25 . 2008-04-14 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-12 22:01 . 2008-04-14 12:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys

2011-11-08 03:45 . 2011-11-08 03:45 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE2C836D-6B25-4643-BCC7-B8846728E6BF}\offreg.dll

2011-11-04 19:20 . 2008-04-14 12:00 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20 . 2008-04-14 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20 . 2008-04-14 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23 . 2008-04-14 12:00 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07 . 2008-04-14 12:00 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31 . 2008-04-14 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:37 . 2008-04-14 12:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-18 11:13 . 2008-04-14 12:00 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:22 . 2009-07-27 18:20 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-10-07 03:48 . 2011-11-06 20:01 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FE2C836D-6B25-4643-BCC7-B8846728E6BF}\mpengine.dll

2011-10-07 03:48 . 2010-01-01 00:51 6668624 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-09-28 07:06 . 2008-04-14 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 22:41 . 2008-07-30 02:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 22:41 . 2008-04-14 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 22:41 . 2008-04-14 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

.

((((((((((((((((((((((((((((( SnapShot_2011-12-16_05.50.22 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-12-23 03:24 . 2011-12-23 03:24 16384 c:\windows\temp\Perflib_Perfdata_1f0.dat

+ 2008-04-14 12:00 . 2011-12-23 03:29 68796 c:\windows\system32\perfc009.dat

- 2008-04-14 12:00 . 2011-12-16 05:53 68796 c:\windows\system32\perfc009.dat

+ 2011-12-17 22:51 . 2011-12-17 22:51 19968 c:\windows\Installer\8ef20.msi

+ 2008-04-14 12:00 . 2011-12-23 03:29 436026 c:\windows\system32\perfh009.dat

- 2008-04-14 12:00 . 2011-12-16 05:53 436026 c:\windows\system32\perfh009.dat

+ 2011-12-22 05:52 . 2011-12-13 05:25 143000 c:\windows\pchealth\helpctr\Config\Cache\Personal_32_1033.dat

+ 2011-01-14 18:10 . 2011-01-14 18:10 155520 c:\windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130\GKWORD6.DLL

+ 2011-01-14 18:10 . 2011-01-14 18:10 140160 c:\windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130\GKEXCEL2.DLL

+ 2009-09-11 03:31 . 2011-12-22 08:38 1590688 c:\windows\system32\Restore\rstrlog.dat

+ 2011-07-21 23:34 . 2011-07-21 23:34 3456000 c:\windows\Installer\169d917.msp

+ 2011-12-19 00:58 . 2011-12-19 00:58 1094656 c:\windows\Installer\1241bbc.msi

+ 2011-01-14 18:10 . 2011-01-14 18:10 2395008 c:\windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130\GKWORD.DLL

+ 2011-01-14 18:10 . 2011-01-14 18:10 2180992 c:\windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130\GKPOWERPOINT.DLL

+ 2011-01-14 18:10 . 2011-01-14 18:10 3443072 c:\windows\Installer\$PatchCache$\Managed\00004109500200000000000000F01FEC\14.0.5130\GKEXCEL.DLL

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]

"bluebirds"="c:\documents and settings\IBUYPOWER\Bluebirds\BlueBirds.exe" [2009-04-29 270336]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nwiz"="nwiz.exe" [2009-06-10 1657376]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-06-10 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-10 13758464]

"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-04-03 273544]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-12 258512]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^IBUYPOWER^Start Menu^Programs^Startup^Webshots.lnk]

path=c:\documents and settings\IBUYPOWER\Start Menu\Programs\Startup\Webshots.lnk

backup=c:\windows\pss\Webshots.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bluebirds]

2009-04-29 09:02 270336 ----a-r- c:\documents and settings\IBUYPOWER\Bluebirds\BlueBirds.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrossRiderPlugin]

2011-05-15 22:01 478720 ----a-w- c:\program files\CrossriderWebApps\Crossrider.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2011-08-02 07:33 4910912 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]

2008-08-15 03:13 30003200 ----a-r- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2009-08-20 20:25 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power DVD Player]

2007-09-06 07:28 391168 ----a-w- c:\program files\Power DVD Player\PowerDVDPlayer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]

2009-10-06 00:14 2075384 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

"c:\\Program Files\\Vietcong\\vietcong.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\WINDOWS\\system32\\dpnsvr.exe"=

"c:\\Documents and Settings\\IBUYPOWER\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=

"c:\\Program Files\\FrostWire\\FrostWire.exe"=

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [12/13/2011 6:11 PM 36000]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [9/4/2011 12:47 AM 232512]

R2 AntiVirMailService;Avira Mail Protection;c:\program files\Avira\AntiVir Desktop\avmailc.exe [12/13/2011 6:11 PM 342480]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [12/13/2011 6:11 PM 86224]

R2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [12/13/2011 6:11 PM 463824]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/12/2011 7:20 PM 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/12/2011 7:20 PM 22216]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [7/27/2009 7:54 AM 845184]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2009-08-20 20:24 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-23 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1935655697-796845957-682003330-1004.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 21:25]

.

2011-12-21 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1935655697-796845957-682003330-1004.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-01-24 21:25]

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 167.206.254.1 167.206.254.2

FF - ProfilePath - c:\documents and settings\IBUYPOWER\Application Data\Mozilla\Firefox\Profiles\ekruw1do.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: Veehd Plugin: {3DB5ABE1-407D-458F-AD5D-8D89BD625CCC} - %profile%\extensions\{3DB5ABE1-407D-458F-AD5D-8D89BD625CCC}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - Ext: Premiumplay Codec-C: crossriderapp435@crossrider.com - c:\documents and settings\All Users\Application Data\CodecCheck\firefox

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-22 16:34

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'lsass.exe'(708)

c:\program files\Avira\AntiVir Desktop\avsda.dll

.

- - - - - - - > 'explorer.exe'(304)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2011-12-22 16:35:25

ComboFix-quarantined-files.txt 2011-12-23 03:35

ComboFix2.txt 2011-12-22 06:40

ComboFix3.txt 2011-12-22 06:13

ComboFix4.txt 2011-12-22 05:21

ComboFix5.txt 2011-12-23 03:26

.

Pre-Run: 211,307,036,672 bytes free

Post-Run: 211,295,657,984 bytes free

.

- - End Of File - - C06E0CEC8ACC4A0C98BFA11AA3A66B52

smasher12 · December 22, 2011

I saw the sticky at the top of the forum and ran the DDS scan, it didn't appear to find anything. Here is the log.

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: Veehd Plugin: {3DB5ABE1-407D-458F-AD5D-8D89BD625CCC} - %profile%\extensions\{3DB5ABE1-407D-458F-AD5D-8D89BD625CCC}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext

FF - Ext: Premiumplay Codec-C: crossriderapp435@crossrider.com - c:\documents and settings\all users\application data\codeccheck\firefox

.

============= SERVICES / DRIVERS ===============

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-12-13 36000]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-9-4 232512]

R2 AntiVirMailService;Avira Mail Protection;c:\program files\avira\antivir desktop\avmailc.exe [2011-12-13 342480]

R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-12-13 86224]

R2 AntiVirService;Avira Realtime Protection;c:\program files\avira\antivir desktop\avguard.exe [2011-12-13 110032]

R2 AntiVirWebService;Avira Web Protection;c:\program files\avira\antivir desktop\avwebgrd.exe [2011-12-13 463824]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-12-13 74640]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-12 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-12 22216]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-7-27 845184]

R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-12-22 41272]

S0 vkquwexg;vkquwexg;c:\windows\system32\drivers\combo-fix.sys --> c:\windows\system32\drivers\Combo-Fix.sys [?]

S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\mpfilter.sys --> c:\windows\system32\drivers\MpFilter.sys [?]

.

=============== Created Last 30 ================

.

2011-12-23 04:05:55 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-12-23 03:26:39 -------- d-----w- C:\ComboFix

2011-12-19 00:58:29 388096 ----a-r- c:\documents and settings\ibuypower\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-12-19 00:58:29 -------- d-----w- c:\program files\Trend Micro

2011-12-16 05:36:49 456320 -c--a-w- c:\windows\system32\dllcache\mrxsmb.sys

2011-12-16 05:36:49 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-12-14 05:11:31 -------- d-----w- c:\documents and settings\ibuypower\application data\Avira

2011-12-14 05:11:01 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-12-14 05:11:01 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys

2011-12-14 05:11:01 -------- d-----w- c:\program files\Avira

2011-12-14 05:11:01 -------- d-----w- c:\documents and settings\all users\application data\Avira

2011-12-14 03:34:43 64512 -c--a-w- c:\windows\system32\dllcache\serial.sys

2011-12-14 03:34:43 64512 ----a-w- c:\windows\system32\drivers\serial.sys

2011-12-13 06:20:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-13 06:20:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-13 06:05:22 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys

2011-12-13 06:05:22 62976 ----a-w- c:\windows\system32\drivers\cdrom.sys

2011-12-13 05:50:39 98816 ----a-w- c:\windows\sed.exe

2011-12-13 05:50:39 518144 ----a-w- c:\windows\SWREG.exe

2011-12-13 05:50:39 256000 ----a-w- c:\windows\PEV.exe

2011-12-13 05:50:39 208896 ----a-w- c:\windows\MBR.exe

2011-12-13 05:29:38 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-12-13 05:29:38 -------- d-----w- c:\windows\system32\wbem\Repository

2011-11-24 20:39:29 -------- d-----w- c:\documents and settings\ibuypower\application data\FS1ivD3on

2011-11-24 20:39:29 -------- d-----w- c:\documents and settings\ibuypower\application data\EhYXwjUVeOtPy

2011-11-24 20:29:55 -------- d-----w- c:\documents and settings\ibuypower\application data\xlIBtzPNyAiDoFa

2011-11-24 19:01:10 -------- d-----w- c:\program files\C4ED1

2011-11-24 19:00:38 -------- d-----w- c:\documents and settings\ibuypower\application data\UXXXqjYYCeIBrO

2011-11-24 19:00:37 -------- d-----w- c:\documents and settings\ibuypower\application data\F0FC4

2011-11-24 19:00:32 -------- d-----w- c:\documents and settings\ibuypower\application data\yYYYCwkkIVl

2011-11-24 19:00:32 -------- d-----w- c:\documents and settings\ibuypower\application data\t77fRRL9hT

.

==================== Find3M ====================

.

2011-12-03 20:23:01 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-12 22:01:38 138496 ----a-w- c:\windows\system32\drivers\afd.sys

2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec

2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll

2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 22:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 22:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 22:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll

.

============= FINISH: 17:15:12.42 ===============

screen317 · December 22, 2011

Hi and welcome to Malwarebytes.

I notice that you are using more than one antivirus program (Microsoft and Avira). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Download the file TDSSKiller.zip and extract it into a folder on the infected PC.
Execute the file TDSSKiller.exe by double-clicking on it.
Wait for the scan and disinfection process to be over.
When its work is over, the utility prompts for a reboot to complete the disinfection.

By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).

The log is like UtilityName.Version_Date_Time_log.txt.

for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.

Please post that log here.

smasher12 · December 22, 2011

Thank you for the reply. As far as I know I uninstalled microsoft security essentials. It is not listed in the ADD/Remove programs. But it keeps being listed when I run combofix. I'm not sure what is going on there.

Here is the log. It didn't not appear to find anything.