Infected with sirefef.DV virus

[Shiromagius]

Hello,

I have been infected with the sirefef.DV virus NOD32, Spyware Doctor, and Malwarebytes Anti-Malware have all tried to help out and have gotten a lot of the traces, but not all of it. Nod32 says I have an infected svchost.exe process that it cannot clean or quarantine and blocks attacks from a file in //GLOBAL??/(cant remember the rest of the path) folder. I downloaded the dds program and ran it, attached are the logs. Any help would be much appreciated.

Thank you.

dds.txt

attach.txt

[Shiromagius]

Can anyone help me on this? I have been reluctant to use this computer for three weeks now and I would really like to get it back up and running.

Thanks in advance.

[screen317]

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

[Shiromagius]

Thanks for replying! So i turned on the computer today and I was unable to get an internet connection. Windows told me I had limited connectivity. I did an ipconfig -all and found that the DNS servers and gateway were all valid, but I did not have an IP address. Tried an ipconfig -renew and got the message "An error occurred while renewing interface Local Area Connection : The RPC server is unavailable."

That being said, I was unable to update MBAM with the latest definitions. I did manage to download the newest free version on another computer and xfer files over with a flash drive. Here are the latest logs from the infected computer:

Malwarebytes Anti-Malware 1.60.0.1800

www.malwarebytes.org

Database version: v2011.12.24.05

Windows XP Service Pack 2 x86 FAT32

Internet Explorer 8.0.6001.18702

Jade :: CUSTOMERSERVICE [administrator]

1/17/2012 4:07:52 PM

mbam-log-2012-01-17 (16-07-52).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 190165

Time elapsed: 11 minute(s), 22 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 3

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jade\Local Settings\Application Data\dlc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jade\Local Settings\Application Data\dlc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Jade\Local Settings\Application Data\dlc.exe" -a "C:\Program Files\Internet Explorer\IEXPLORE.EXE") Good: (iexplore.exe) -> Quarantined and repaired successfully.

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\Documents and Settings\All Users\Application Data\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.

(end)

And now the DDS results:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by Jade at 16:23:42 on 2012-01-17

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.624 [GMT -8:00]

.

AV: ESET NOD32 Antivirus 4.0 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Norton Internet Worm Protection *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\AOL\1186675143\ee\AOLSoftware.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\WinPatrol\winpatrol.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\PC Tools Security\BDT\FGuard.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\WINDOWS\system32\ctfmon.exe

svchost.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

svchost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://sellercentral.amazon.com/gp/homepage.html

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

uURLSearchHooks: AOLTBSearch Class: {ea756889-2338-43db-8f07-d1ca6fb9c90d} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

uURLSearchHooks: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [intelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [HostManager] c:\program files\common files\aol\1186675143\ee\AOLSoftware.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [WinPatrol] c:\program files\winpatrol\winpatrol.exe -expressboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [PCTools FGuard] c:\program files\pc tools security\bdt\FGuard.exe

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

LSP: mswsock.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 216.151.4.3 216.151.5.3

TCP: Interfaces\{520F0826-CE56-4025-B18D-B5A393821C18} : DhcpNameServer = 216.151.4.3 216.151.5.3

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: igfxcui - igfxsrvc.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news

FF - component: c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll

FF - component: c:\program files\pc tools security\bdt\firefox\platform\winnt_x86-msvc\components\libheuristic.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPAbacheck.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\pc tools security\bdt\Firefox

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-12-28 326688]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-12-28 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2011-12-28 656320]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-29 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-29 96408]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2011-12-28 184536]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools security\bdt\BDTUpdateService.exe [2011-12-28 337872]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-12-28 371472]

S3 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-12-28 1117144]

.

=============== Created Last 30 ================

.

2012-01-18 00:02:22 709968 ----a-w- c:\windows\isRS-000.tmp

2011-12-28 19:43:06 767952 ----a-w- c:\windows\BDTSupport.dll

2011-12-28 19:43:05 2189264 ----a-w- c:\windows\PCTBDCore.dll

2011-12-28 19:43:05 1533904 ----a-w- c:\windows\PCTBDRes.dll

2011-12-28 19:43:05 149456 ----a-w- c:\windows\SGDetectionTool.dll

2011-12-28 19:39:17 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2011-12-28 19:39:17 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2011-12-28 19:39:16 252712 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2011-12-28 19:39:10 326688 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2011-12-28 19:39:10 162200 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2011-12-28 19:39:06 184536 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-12-28 19:38:57 70664 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2011-12-28 19:38:21 -------- d-----w- c:\program files\common files\PC Tools

2011-12-28 19:38:20 -------- d-----w- c:\program files\PC Tools Security

2011-12-28 17:52:21 -------- d-----w- c:\documents and settings\jade\local settings\application data\Threat Expert

2011-12-28 17:47:52 -------- d-----w- c:\documents and settings\jade\application data\QuickScan

2011-12-28 16:52:59 -------- d-----w- C:\Application Data

.

==================== Find3M ====================

.

2011-12-12 17:35:22 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 23:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-15 18:34:43 1901 ----a-w- c:\windows\panose.bin

2004-04-14 17:33:38 5019280 -c--a-w- c:\program files\zlsSetup_45_594_000.exe

.

============= FINISH: 16:24:51.32 ===============

[screen317]

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[Shiromagius]

When ComboFix was running it located a rootkit and restarted the computer a few times. Here is ComboFix's log:

ComboFix 12-01-21.02 - Jade 01/21/2012 15:12:34.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.713 [GMT -8:00]

Running from: c:\documents and settings\Jade\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 4.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

* Resident AV is active

.

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\All Users\Application Data\TEMP\DFC5A2B2.TMP

c:\documents and settings\Jade\WINDOWS

c:\windows\$NtUninstallKB27321$

c:\windows\$NtUninstallKB27321$\1042530313

c:\windows\$NtUninstallKB27321$\1786511557\@

c:\windows\$NtUninstallKB27321$\1786511557\bckfg.tmp

c:\windows\$NtUninstallKB27321$\1786511557\cfg.ini

c:\windows\$NtUninstallKB27321$\1786511557\Desktop.ini

c:\windows\$NtUninstallKB27321$\1786511557\keywords

c:\windows\$NtUninstallKB27321$\1786511557\kwrd.dll

c:\windows\$NtUninstallKB27321$\1786511557\L\asobptkf

c:\windows\$NtUninstallKB27321$\1786511557\lsflt7.ver

c:\windows\$NtUninstallKB27321$\1786511557\U\00000001.@

c:\windows\$NtUninstallKB27321$\1786511557\U\00000002.@

c:\windows\$NtUninstallKB27321$\1786511557\U\00000004.@

c:\windows\$NtUninstallKB27321$\1786511557\U\80000000.@

c:\windows\$NtUninstallKB27321$\1786511557\U\80000004.@

c:\windows\$NtUninstallKB27321$\1786511557\U\80000032.@

c:\windows\dasetup.log

.

.

((((((((((((((((((((((((( Files Created from 2011-12-21 to 2012-01-21 )))))))))))))))))))))))))))))))

.

.

2012-01-21 23:24 . 2012-01-21 23:24 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2011-12-28 19:43 . 2011-09-01 19:38 767952 ----a-w- c:\windows\BDTSupport.dll

2011-12-28 19:43 . 2011-09-01 19:39 1533904 ----a-w- c:\windows\PCTBDRes.dll

2011-12-28 19:43 . 2011-09-01 19:39 149456 ----a-w- c:\windows\SGDetectionTool.dll

2011-12-28 19:43 . 2011-09-01 19:39 2189264 ----a-w- c:\windows\PCTBDCore.dll

2011-12-28 19:39 . 2010-07-16 22:59 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2011-12-28 19:39 . 2010-07-16 22:59 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2011-12-28 19:39 . 2011-07-19 17:18 252712 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2011-12-28 19:39 . 2011-08-23 19:45 326688 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2011-12-28 19:39 . 2011-03-02 19:39 162200 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2011-12-28 19:39 . 2011-08-18 17:31 184536 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-12-28 19:38 . 2011-07-19 17:23 70664 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2011-12-28 19:38 . 2011-12-28 19:43 -------- d-----w- c:\program files\Common Files\PC Tools

2011-12-28 19:38 . 2011-12-29 01:45 -------- d-----w- c:\program files\PC Tools Security

2011-12-28 17:52 . 2011-12-28 17:52 -------- d-----w- c:\documents and settings\Jade\Local Settings\Application Data\Threat Expert

2011-12-28 17:47 . 2011-12-28 17:47 -------- d-----w- c:\documents and settings\Jade\Application Data\QuickScan

2011-12-28 16:52 . 2011-12-28 16:52 -------- d-----w- C:\Application Data

2011-12-27 22:55 . 2011-12-27 22:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-12 17:35 . 2011-08-19 16:48 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 23:24 . 2010-01-14 20:34 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2004-04-14 17:33 . 2004-04-14 17:33 5019280 -c--a-w- c:\program files\zlsSetup_45_594_000.exe

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-11-13 98304]

"HostManager"="c:\program files\Common Files\AOL\1186675143\ee\AOLSoftware.exe" [2006-09-26 50736]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]

"WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-10-10 320832]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2006-10-04 53760]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-14 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-06-22 07:44 126976 ----a-w- c:\windows\SYSTEM32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2005-06-22 07:48 155648 ----a-w- c:\windows\SYSTEM32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\aol\\1186675143\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7445:TCP"= 7445:TCP:*:Disabled:BitComet 7445 TCP

"7445:UDP"= 7445:UDP:*:Disabled:BitComet 7445 UDP

.

R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [12/28/2011 11:39 AM 326688]

R0 pctDS;PC Tools Data Store;c:\windows\SYSTEM32\DRIVERS\pctDS.sys [12/28/2011 11:39 AM 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\pctEFA.sys [12/28/2011 11:39 AM 656320]

R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [9/29/2009 1:02 PM 108792]

R1 epfwtdir;epfwtdir;c:\windows\SYSTEM32\DRIVERS\epfwtdir.sys [9/29/2009 1:05 PM 96408]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\SYSTEM32\DRIVERS\PCTSD.sys [12/28/2011 11:39 AM 184536]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [12/28/2011 11:43 AM 337872]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/29/2009 1:03 PM 735960]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [12/28/2011 11:38 AM 371472]

.

.

------- Supplementary Scan -------

.

uStart Page = https://sellercentral.amazon.com/gp/homepage.html

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

TCP: DhcpNameServer = 216.151.4.3 216.151.5.3

FF - ProfilePath - c:\documents and settings\Jade\Application Data\Mozilla\Firefox\Profiles\f5qp1qzg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\PC Tools Security\BDT\Firefox

FF - user.js: yahoo.homepage.dontask - true

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-01-21 15:25

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(3120)

c:\windows\system32\WININET.dll

c:\program files\WinPatrol\PATROLPRO.DLL

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\AOL\ACS\AOLAcsd.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2012-01-21 15:33:00 - machine was rebooted

ComboFix-quarantined-files.txt 2012-01-21 23:32

.

Pre-Run: 9,278,849,024 bytes free

Post-Run: 9,481,515,008 bytes free

.

- - End Of File - - F028CE02C2F302E493FDDDCAF058F251

And a fresh dds scan gave me this log file:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by Jade at 15:36:26 on 2012-01-21

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.620 [GMT -8:00]

.

AV: ESET NOD32 Antivirus 4.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Norton Internet Worm Protection *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\AOL\1186675143\ee\AOLSoftware.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\WinPatrol\winpatrol.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\DellSupport\DSAgnt.exe

svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://sellercentral.amazon.com/gp/homepage.html

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

uURLSearchHooks: AOLTBSearch Class: {ea756889-2338-43db-8f07-d1ca6fb9c90d} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

uURLSearchHooks: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools security\bdt\PCTBrowserDefender.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

mRun: [intelMeM] c:\program files\intel\modem event monitor\IntelMEM.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [HostManager] c:\program files\common files\aol\1186675143\ee\AOLSoftware.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [WinPatrol] c:\program files\winpatrol\winpatrol.exe -expressboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [PCTools FGuard] c:\program files\pc tools security\bdt\FGuard.exe

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-us\local\search.html

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 5.0\aoltb.dll

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 216.151.4.3 216.151.5.3

TCP: Interfaces\{520F0826-CE56-4025-B18D-B5A393821C18} : DhcpNameServer = 216.151.4.3 216.151.5.3

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: igfxcui - igfxsrvc.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news

FF - component: c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\documents and settings\jade\application data\mozilla\firefox\profiles\f5qp1qzg.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll

FF - component: c:\program files\pc tools security\bdt\firefox\platform\winnt_x86-msvc\components\libheuristic.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPAbacheck.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\pc tools security\bdt\Firefox

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

.

============= SERVICES / DRIVERS ===============

.

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-12-28 326688]

R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-12-28 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2011-12-28 656320]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-29 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-29 96408]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2011-12-28 184536]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools security\bdt\BDTUpdateService.exe [2011-12-28 337872]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools security\pctsAuxs.exe [2011-12-28 371472]

S3 sdCoreService;PC Tools Security Service;c:\program files\pc tools security\pctsSvc.exe [2011-12-28 1117144]

.

=============== Created Last 30 ================

.

2012-01-21 23:01:12 98816 ----a-w- c:\windows\sed.exe

2012-01-21 23:01:12 518144 ----a-w- c:\windows\SWREG.exe

2012-01-21 23:01:12 256000 ----a-w- c:\windows\PEV.exe

2012-01-21 23:01:12 208896 ----a-w- c:\windows\MBR.exe

2011-12-28 19:43:06 767952 ----a-w- c:\windows\BDTSupport.dll

2011-12-28 19:43:05 2189264 ----a-w- c:\windows\PCTBDCore.dll

2011-12-28 19:43:05 1533904 ----a-w- c:\windows\PCTBDRes.dll

2011-12-28 19:43:05 149456 ----a-w- c:\windows\SGDetectionTool.dll

2011-12-28 19:39:17 656320 ----a-w- c:\windows\system32\drivers\pctEFA.sys

2011-12-28 19:39:17 338880 ----a-w- c:\windows\system32\drivers\pctDS.sys

2011-12-28 19:39:16 252712 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2011-12-28 19:39:10 326688 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2011-12-28 19:39:10 162200 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2011-12-28 19:39:06 184536 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-12-28 19:38:57 70664 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2011-12-28 19:38:21 -------- d-----w- c:\program files\common files\PC Tools

2011-12-28 19:38:20 -------- d-----w- c:\program files\PC Tools Security

2011-12-28 17:52:21 -------- d-----w- c:\documents and settings\jade\local settings\application data\Threat Expert

2011-12-28 17:47:52 -------- d-----w- c:\documents and settings\jade\application data\QuickScan

2011-12-28 16:52:59 -------- d-----w- C:\Application Data

.

==================== Find3M ====================

.

2011-12-12 17:35:22 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 23:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-15 18:34:43 1901 ----a-w- c:\windows\panose.bin

2004-04-14 17:33:38 5019280 -c--a-w- c:\program files\zlsSetup_45_594_000.exe

.

============= FINISH: 15:36:55.50 ===============

[screen317]

Hi,

I apologize for the extended delay. The new forum software made finding my topics difficult, and yours slipped through.

Is your antivirus up to date?

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[Shiromagius]

Hi screen317,

So I followed your steps as your outlined, but was unable to connect to the internet to do the ESET online scanner. I restarted the machine thinking that possibly may solve my internet issue, but it didnt. Windows says I have limited connectivity. The DNS servers are correct and even the default gateway is correct, but I am not getting an IP. Going to a command prompt and doing "ipconfig /renew" yields the message "An error occured while renewing Local Area Connection : The RPC server is unavailable." The last installed ESET definitions on the machine are virus definitions 6750 dated 12/28/2011.

I did manage to download (from another machine) and copy over your security check program. That log file is as follows:

Results of screen317's Security Check version 0.99.30

Windows XP Service Pack 2 x86

Out of date service pack!!

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

ESET NOD32 Antivirus

ESET Online Scanner v3

```````````````````````````````

Anti-malware/Other Utilities Check:

WinPatrol 2009 (Outdated! Latest version is WinPatrol 2011)

MVPS Hosts File

Spyware Doctor 8.0

Java™ 6 Update 26

Java version out of date!

Adobe Flash Player 9 Flash Player out of date!

Adobe Flash Player 11.1.102.55

Mozilla Firefox (3.6.4) Firefox out of Date!

````````````````````````````````

Process Check:

objlist.exe by Laurent

WinPatrol winpatrol.exe

WinPatrol winpatrol.exe

``````````End of Log````````````

[screen317]

How are you trying to connect? Grab a fresh copy of ComboFix, run it, and post its log.

Can you connect in Safe Mode with Networking?

[Shiromagius]

I am trying to connect to the internet normally. Let windows boot up just like normal, and open a browser. I also tried connecting through safe mode with networking, and had the same results - cannot connect. God the same results with an ipconfig /all as well as an ipconfig /renew while in safe mode that i got when i was not in safe mode.

Here is a copy of the comboFix log (downloaded fresh copy from bleeping computer mirror from link you sent earlier in this thread). I disabled ESET before running.

ComboFix 12-02-02.02 - Jade 02/02/2012 13:43:24.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.656 [GMT -8:00]

Running from: c:\documents and settings\Jade\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 4.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\TEMP

.

.

((((((((((((((((((((((((( Files Created from 2012-01-02 to 2012-02-02 )))))))))))))))))))))))))))))))

.

.

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-12 17:35 . 2011-08-19 16:48 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-10 23:24 . 2010-01-14 20:34 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2004-04-14 17:33 . 2004-04-14 17:33 5019280 -c--a-w- c:\program files\zlsSetup_45_594_000.exe

.

.

((((((((((((((((((((((((((((( SnapShot@2012-01-21_23.25.58 )))))))))))))))))))))))))))))))))))))))))

.

+ 2012-02-02 21:38 . 2012-02-02 21:38 16384 c:\windows\temp\Perflib_Perfdata_430.dat

- 2011-10-28 18:39 . 2011-12-30 18:26 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2011-10-28 18:39 . 2012-01-31 22:33 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2004-01-22 21:58 . 2012-01-31 22:33 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

- 2004-01-22 21:58 . 2011-12-30 18:26 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

+ 2012-01-31 22:33 . 2012-01-31 22:33 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat

- 2011-10-28 18:39 . 2011-12-30 18:26 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-11-13 98304]

"HostManager"="c:\program files\Common Files\AOL\1186675143\ee\AOLSoftware.exe" [2006-09-26 50736]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]

"WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-10-10 320832]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-09-01 247760]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2006-10-04 53760]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-14 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-06-22 07:44 126976 ----a-w- c:\windows\SYSTEM32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2005-06-22 07:48 155648 ----a-w- c:\windows\SYSTEM32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\aol\\1186675143\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"7445:TCP"= 7445:TCP:*:Disabled:BitComet 7445 TCP

"7445:UDP"= 7445:UDP:*:Disabled:BitComet 7445 UDP

.

R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [12/28/2011 11:39 AM 326688]

R0 pctDS;PC Tools Data Store;c:\windows\SYSTEM32\DRIVERS\pctDS.sys [12/28/2011 11:39 AM 338880]

R0 pctEFA;PC Tools Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\pctEFA.sys [12/28/2011 11:39 AM 656320]

R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [9/29/2009 1:02 PM 108792]

R1 epfwtdir;epfwtdir;c:\windows\SYSTEM32\DRIVERS\epfwtdir.sys [9/29/2009 1:05 PM 96408]

R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\SYSTEM32\DRIVERS\PCTSD.sys [12/28/2011 11:39 AM 184536]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [12/28/2011 11:43 AM 337872]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/29/2009 1:03 PM 735960]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [12/28/2011 11:38 AM 371472]

.

.

------- Supplementary Scan -------

.

uStart Page = https://sellercentral.amazon.com/gp/homepage.html

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

TCP: DhcpNameServer = 216.151.4.3 216.151.5.3

FF - ProfilePath - c:\documents and settings\Jade\Application Data\Mozilla\Firefox\Profiles\f5qp1qzg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Browser Defender Toolbar: {cb84136f-9c44-433a-9048-c5cd9df1dc16} - c:\program files\PC Tools Security\BDT\Firefox

FF - user.js: yahoo.homepage.dontask - true

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-02-02 13:51

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1436)

c:\windows\system32\WININET.dll

c:\program files\WinPatrol\PATROLPRO.DLL

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

Completion time: 2012-02-02 13:54:24

ComboFix-quarantined-files.txt 2012-02-02 21:54

ComboFix2.txt 2012-01-21 23:33

.

Pre-Run: 9,450,872,832 bytes free

Post-Run: 9,425,158,144 bytes free

.

- - End Of File - - 15F080444125BB81277BAB7DD7C66F5C

[screen317]

What I meant was, what does your network look like? Are you connected through a router? Are you wireless/hardwired?

[Shiromagius]

Oh, hehe. We are wired through a router via ethernet cables. The computer in question is currently sitting on a switch that is in turn connected to a router but other computers are functioning just fine off of that switch.

[screen317]

Hi,

My apologies for the delay.

I would like you to install XP Service Pack 3. This will overwrite your system files with updated versions. There's a chance that this will repair your connection.

Download it from here and transfer it over:

http://www.microsoft.com/download/en/details.aspx?id=10767

[Shiromagius]

So I downloaded SP3 and transferred it over to the computer and installed. It finished installing and needed to restart. Said that was ok, it rebooted and on the windows loading splash screen I got a blue screen of death with following tech info:

*** STOP: 0x0000007E (0xC0000005, 0xF77B5A3B, 0xF7C7C328, 0xF7C7C024)

*** fltmgr.sys - Address F77B5A3B base at F77AE000, datestamp 480251da

I am able to get into safe mode, but not safe mode with networking or regular mode. When trying to get into safe mode with networking or regular windows, I get the same BSOD message. I ran a chkdsk on the drive while in safe mode and it found some errors so I added the /f switch to it to schedule a check of the disk on next boot, but i got the BSOD before chkdsk was able to run. I then booted into the recovery console and ran chkdsk /R on the drive and it found and corrected some problems. I tried to boot normally again and once again got the BSOD.

Am I screwed now?

[screen317]

Yikes. It looks like there is more corruption here than I thought.

Would you be interested in backing up your data, formatting your hard drive, and reinstalling Windows? At this point, I believe starting fresh would be the best course of action.

[Shiromagius]

A reformat is always my last plan of action if all else fails. Thought might be able to get around a reformat, but guess that is what is going to have to happen. Thanks again for all your help in this matter screen317. Feel free to close this thread.

[screen317]

You are very welcome.

When you reinstall Windows after formatting, getting protection immediately is imperative. Here is my standard prevention speech:

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) It is imperative that you have an antivirus. You are basically asking for infection without one.

All of the following are excellent free antiviruses. Be sure to only install one.

Microsoft Security Essentials

AntiVir

avast!.

2) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

3) Download and install IE-Spyad, which will place over 5000 'bad' sites on your Internet Explorer Restricted List. A tutorial on it can be found here.

4) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

5) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

6) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

7) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!