Have DDS and Attach reports; now what?

mmogan · January 22, 2012

I had the same problem as another forum member, so I've copied an pasted his post:

Recently, I got infected with a rogue virus. The virus was the one that installs a program called, "Windows XP Anti-virus 2012" << It was something along those lines. Well after a couple of hours, I got rid of the rogue virus. But then after I restarted my computer, on the bottom right of my screen (taskbar), my computer keeps showing a notification saying that Malwarebytes has successfully blocked access to a malicious website. It says that the type is outgoing, and it always shows ip addresses. Here are the ip addresses.

83.133.119.155

83.133.120.186

83.133.124.195

83.133.124.245

83.133.121.147

83.133.124.196

83.133.120.187

It constantly shows these notifications. It has already been a couple of days.

-end of other user's post-

So, I read some other instructions, ran that DSS and saved the reports to my desktop. Will someone review these reports to help me fix the problem?

Mike

Larusso · January 22, 2012

:welcome:

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Please copy/paste the DDS.txt and attach.txt in your next reply

Normally, MBAM shows also the filename which tries to connect to the malicious website. If possible, please let me know.

mmogan · January 24, 2012

Thanks for your help! Here is the DDS.txt:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Michael at 20:31:31 on 2012-01-21

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.457 [GMT -5:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Dell Support\DSAgnt.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Belkin\PCI F5D700F\Wireless Utility\Belkinwcui.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com

uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4061023

uWindow Title = Windows Internet Explorer provided by Comcast

mWindow Title = Windows Internet Explorer provided by Comcast

mSearch Bar = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=w7HqBpCwd0ynN5caqkI2ee56NNg

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz2.dll

uURLSearchHooks: H - No File

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll

BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz2.dll

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz2.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\belkin~1.lnk - c:\program files\belkin\pci f5d700f\wireless utility\Belkinwcui.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee security scan plus.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

LSP: mswsock.dll

DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxps://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab

DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{87F751F6-F027-45F7-8947-8656D586F50B} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{D74FFFF7-6217-4AAC-92D1-44095A22BCA9} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{EA4D8EAB-4480-4F9C-83C7-A0BB5DB5B036} : DhcpNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\michael\application data\mozilla\firefox\profiles\9w90tvvl.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.51204.0\npctrlui.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-6-23 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 67656]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-6-9 652872]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [2011-8-12 1034240]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-6-9 20464]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-10 135664]

S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\drivers\BLKWGDv7.SYS [2007-1-15 303616]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2006-10-23 29744]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-10 135664]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-6-23 12872]

.

=============== Created Last 30 ================

.

2012-01-20 00:42:09 -------- d-----w- c:\windows\system32\wbem\repository\FS

2012-01-20 00:42:09 -------- d-----w- c:\windows\system32\wbem\Repository

.

==================== Find3M ====================

.

2011-12-10 20:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-25 21:57:19 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-18 12:35:08 60416 ----a-w- c:\windows\system32\packager.exe

2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec

2011-11-03 15:28:36 386048 ----a-w- c:\windows\system32\qdvd.dll

2011-11-03 15:28:36 1292288 ----a-w- c:\windows\system32\quartz.dll

2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll

2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll

2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe

.

============= FINISH: 20:33:09.84 ===============

mmogan · January 24, 2012

Here is the attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 10/26/2006 1:40:49 AM

System Uptime: 1/21/2012 8:15:40 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0WG864

Processor: Intel® Pentium® D CPU 2.66GHz | Microprocessor | 2660/533mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 144 GiB total, 34.075 GiB free.

D: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Intel® 82562V 10/100 Network Connection

Device ID: PCI\VEN_8086&DEV_104C&SUBSYS_01DD1028&REV_02\3&172E68DD&0&C8

Manufacturer: Intel

Name: Intel® 82562V 10/100 Network Connection

PNP Device ID: PCI\VEN_8086&DEV_104C&SUBSYS_01DD1028&REV_02\3&172E68DD&0&C8

Service: e1express

.

==== System Restore Points ===================

.

RP1607: 10/24/2011 1:01:07 PM - System Checkpoint

RP1608: 10/25/2011 1:29:38 PM - System Checkpoint

RP1609: 10/26/2011 2:29:37 PM - System Checkpoint

RP1610: 10/27/2011 3:29:38 PM - System Checkpoint

RP1611: 10/28/2011 4:29:37 PM - System Checkpoint

RP1612: 10/29/2011 5:15:46 PM - System Checkpoint

RP1613: 10/30/2011 5:16:52 PM - System Checkpoint

RP1614: 10/31/2011 6:15:49 PM - System Checkpoint

RP1615: 11/1/2011 7:15:51 PM - System Checkpoint

RP1616: 11/2/2011 8:15:53 PM - System Checkpoint

RP1617: 11/3/2011 9:43:03 PM - System Checkpoint

RP1618: 11/4/2011 10:15:57 PM - System Checkpoint

RP1619: 11/5/2011 10:15:57 PM - System Checkpoint

RP1620: 11/6/2011 11:16:01 PM - System Checkpoint

RP1621: 11/7/2011 11:17:06 PM - System Checkpoint

RP1622: 11/9/2011 12:16:03 AM - System Checkpoint

RP1623: 11/10/2011 1:16:04 AM - System Checkpoint

RP1624: 11/10/2011 3:00:15 AM - Software Distribution Service 3.0

RP1625: 11/11/2011 3:00:14 AM - Software Distribution Service 3.0

RP1626: 11/12/2011 3:21:25 AM - System Checkpoint

RP1627: 11/13/2011 4:21:27 AM - System Checkpoint

RP1628: 11/15/2011 7:54:31 AM - System Checkpoint

RP1629: 11/16/2011 8:23:19 AM - System Checkpoint

RP1630: 11/17/2011 9:23:21 AM - System Checkpoint

RP1631: 11/18/2011 10:23:23 AM - System Checkpoint

RP1632: 11/19/2011 11:23:25 AM - System Checkpoint

RP1633: 11/20/2011 11:24:32 AM - System Checkpoint

RP1634: 11/21/2011 1:04:17 PM - System Checkpoint

RP1635: 11/22/2011 1:23:29 PM - System Checkpoint

RP1636: 11/23/2011 2:47:36 PM - System Checkpoint

RP1637: 11/24/2011 3:45:11 PM - System Checkpoint

RP1638: 11/25/2011 4:23:35 PM - System Checkpoint

RP1639: 11/26/2011 5:55:43 PM - System Checkpoint

RP1640: 11/27/2011 6:23:41 PM - System Checkpoint

RP1641: 11/28/2011 7:26:09 PM - System Checkpoint

RP1642: 11/29/2011 8:23:41 PM - System Checkpoint

RP1643: 11/30/2011 9:53:57 PM - System Checkpoint

RP1644: 12/1/2011 10:23:44 PM - System Checkpoint

RP1645: 12/2/2011 11:23:46 PM - System Checkpoint

RP1646: 12/4/2011 12:23:48 AM - System Checkpoint

RP1647: 12/5/2011 1:23:49 AM - System Checkpoint

RP1648: 12/6/2011 2:23:51 AM - System Checkpoint

RP1649: 12/7/2011 3:23:52 AM - System Checkpoint

RP1650: 12/8/2011 4:23:53 AM - System Checkpoint

RP1651: 12/9/2011 5:23:56 AM - System Checkpoint

RP1652: 12/10/2011 6:23:57 AM - System Checkpoint

RP1653: 12/11/2011 7:23:59 AM - System Checkpoint

RP1654: 12/12/2011 8:24:00 AM - System Checkpoint

RP1655: 12/13/2011 9:24:02 AM - System Checkpoint

RP1656: 12/14/2011 10:24:04 AM - System Checkpoint

RP1657: 12/15/2011 11:24:05 AM - System Checkpoint

RP1658: 12/16/2011 3:00:15 AM - Software Distribution Service 3.0

RP1659: 12/17/2011 3:29:21 AM - System Checkpoint

RP1660: 12/18/2011 4:29:23 AM - System Checkpoint

RP1661: 12/19/2011 5:29:25 AM - System Checkpoint

RP1662: 12/20/2011 6:29:26 AM - System Checkpoint

RP1663: 12/21/2011 7:29:28 AM - System Checkpoint

RP1664: 12/22/2011 8:29:30 AM - System Checkpoint

RP1665: 12/23/2011 9:29:31 AM - System Checkpoint

RP1666: 12/24/2011 10:29:35 AM - System Checkpoint

RP1667: 12/25/2011 11:29:35 AM - System Checkpoint

RP1668: 12/26/2011 12:29:38 PM - System Checkpoint

RP1669: 12/27/2011 1:29:40 PM - System Checkpoint

RP1670: 12/28/2011 2:29:40 PM - System Checkpoint

RP1671: 12/29/2011 3:29:42 PM - System Checkpoint

RP1672: 12/30/2011 4:29:45 PM - System Checkpoint

RP1673: 12/31/2011 5:30:49 PM - System Checkpoint

RP1674: 1/1/2012 6:29:47 PM - System Checkpoint

RP1675: 1/2/2012 7:29:49 PM - System Checkpoint

RP1676: 1/3/2012 7:50:40 PM - System Checkpoint

RP1677: 1/4/2012 8:29:52 PM - System Checkpoint

RP1678: 1/5/2012 9:29:53 PM - System Checkpoint

RP1679: 1/6/2012 10:29:57 PM - System Checkpoint

RP1680: 1/7/2012 11:29:58 PM - System Checkpoint

RP1681: 1/9/2012 12:29:57 AM - System Checkpoint

RP1682: 1/10/2012 1:30:00 AM - System Checkpoint

RP1683: 1/11/2012 2:30:01 AM - System Checkpoint

RP1684: 1/12/2012 3:00:14 AM - Software Distribution Service 3.0

RP1685: 1/13/2012 3:26:22 AM - System Checkpoint

RP1686: 1/14/2012 4:26:24 AM - System Checkpoint

RP1687: 1/15/2012 4:28:37 AM - System Checkpoint

RP1688: 1/16/2012 5:28:39 AM - System Checkpoint

RP1689: 1/16/2012 10:16:57 PM - Restore Operation

RP1690: 1/17/2012 11:59:31 PM - System Checkpoint

RP1691: 1/19/2012 7:40:03 PM - Restore Operation

RP1692: 1/20/2012 3:00:20 AM - Software Distribution Service 3.0

RP1693: 1/21/2012 1:29:24 PM - System Checkpoint

.

==== Installed Programs ======================

.

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Photoshop v4.0

Adobe Reader 7.1.0

Adobe SVG Viewer 3.0

AiO_Scan_CDA

AiOSoftwareNPI

Akram Audio Converter 3.1

America Online (Choose which version to remove)

Anapod CopyGear (remove only)

Anapod Explorer (remove only)

AOL Coach Version 1.0(Build:20040229.1 en)

AOL Connectivity Services

AOLIcon

Apple Application Support

Apple Mobile Device Support

Apple Software Update

AVS Update Manager 1.0

AVS Video Converter 7

AVS4YOU Software Navigator 1.4

Belkin Wireless G Desktop Card Driver and Utility

Bonjour

BufferChm

BUM

C3100

c3100_Help

Comcast High-Speed Internet Install Wizard

Compatibility Pack for the 2007 Office system

Conexant D850 56K V.9x DFVc Modem

Critical Update for Windows Media Player 11 (KB959772)

Dell CinePlayer

Dell Driver Reset Tool

Dell Resource CD

Dell Support 3.2

Dell System Restore

DesignPro 5.0 Media Edition

Desktop Doctor

Destinations

DeviceManagementQFolder

Digital Content Portal

Digital Line Detect

DocProc

DocProcQFolder

Documentation & Support Launcher

EarthLink Setup Files

EducateU

ESPNMotion

eSupportQFolder

Fax_CDA

Games, Music, & Photos Launcher

GemMaster Mystic

Get High Speed Internet!

Google Chrome

Google Desktop

Google Toolbar for Internet Explorer

Google Update Helper

High Definition Audio Driver Package - KB835221

HijackThis 2.0.2

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 10 (KB903157)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

HP Imaging Device Functions 7.0

HP Photosmart and Deskjet 7.0.A

HP Photosmart Essential

HP Product Assistant

HP Solution Center 7.0

HP Update

HPPhotoSmartExpress

HPProductAssistant

HPSSupply

InstantShareDevicesMFC

Intel® Matrix Storage Manager

Intel® PRO Network Connections

Internet Service Offers Launcher

iTunes

J2SE Runtime Environment 5.0 Update 6

KODAK EASYSHARE Gallery Easy Upload, v2.1

KODAK EASYSHARE Gallery Upload ActiveX Control

Learn2 Player (Uninstall Only)

LimeWire 4.16.6

Malwarebytes Anti-Malware version 1.60.0.1800

McAfee Security Scan Plus

MCU

Microsoft .NET Framework 1.0 Hotfix (KB2572066)

Microsoft .NET Framework 1.0 Hotfix (KB953295)

Microsoft .NET Framework 1.0 Hotfix (KB979904)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2656353)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Office Professional Edition 2003

Microsoft Plus! Digital Media Edition Installer

Microsoft Plus! Photo Story 2 LE

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Works

MobileMe Control Panel

Modem Helper

Mozilla Firefox 9.0.1 (x86 en-US)

MSXML 4.0

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NetWaiting

NewCopy_CDA

NVIDIA Drivers

OCR Software by I.R.I.S 7.0

Otto

PanoStandAlone

ProductContextNPI

QuickTime

Readme

RealPlayer Basic

Roxio DLA

Roxio MyDVD LE

Roxio RecordNow Audio

Roxio RecordNow Copy

Roxio RecordNow Data

Safari

Scan

ScannerCopy

SearchAssist

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB976325)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Encoder (KB2447961)

Security Update for Windows Media Encoder (KB954156)

Security Update for Windows Media Encoder (KB979332)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 10 (KB917734)

Security Update for Windows Media Player 11 (KB936782)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Media Player 6.4 (KB925398)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923689)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950759)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951376)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB953838)

Security Update for Windows XP (KB953839)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956390)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB963027)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Shop for HP Supplies

Skype™ 3.2

SolutionCenter

Sonic Activation Module

Sonic Encoders

Sonic Update Manager

Status

SUPERAntiSpyware Free Edition

Toolbox

TrayApp

Ulead VideoStudio 7 SE VCD

Unload

Update for Windows Internet Explorer 8 (KB971930)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows Internet Explorer 8 (KB976749)

Update for Windows Internet Explorer 8 (KB980182)

Update for Windows Media Player 10 (KB910393)

Update for Windows Media Player 10 (KB913800)

Update for Windows Media Player 10 (KB926251)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951072-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update Rollup 2 for Windows XP Media Center Edition 2005

URL Assistant

VideoLAN VLC media player 0.8.6f

Viewpoint Media Player

Visual C++ 8.0 CRT (x86) WinSXS MSM

Vuze

Vuze Remote Toolbar

WeatherBug

Web Studio 4.0

WebFldrs XP

WebReg

Winamp

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Installer 3.1 (KB893803)

Windows Internet Explorer 8

Windows Live Messenger

Windows Media Encoder 9 Series

Windows Media Format 11 runtime

Windows Media Player 10

Windows Media Player 10 Hotfix [see EmeraldQFE2 for more information]

Windows Media Player 11

Windows XP Media Center Edition 2005 KB2502898

Windows XP Media Center Edition 2005 KB2619340

Windows XP Media Center Edition 2005 KB2628259

Windows XP Media Center Edition 2005 KB908246

Windows XP Media Center Edition 2005 KB925766

Windows XP Media Center Edition 2005 KB973768

Windows XP Service Pack 3

XviD MPEG-4 Video Codec

.

==== Event Viewer Messages From Past Week ========

.

1/19/2012 7:34:45 PM, error: Service Control Manager [7034] - The Terminal Services service terminated unexpectedly. It has done this 1 time(s).

1/19/2012 7:34:45 PM, error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

1/19/2012 7:34:40 PM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).

1/19/2012 7:34:32 PM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).

1/19/2012 7:34:32 PM, error: Service Control Manager [7031] - The Remote Registry service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.

1/18/2012 12:31:39 AM, error: Service Control Manager [7023] - The Network Location Awareness (NLA) service terminated with the following error: The specified procedure could not be found.

1/17/2012 11:11:36 PM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

1/17/2012 11:11:36 PM, error: iastor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.

1/16/2012 10:16:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

1/16/2012 10:15:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm SASDIFSV SASKUTIL

1/16/2012 10:05:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

1/16/2012 10:04:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SASDIFSV SASKUTIL Tcpip

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

1/16/2012 10:04:58 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

.

==== End Of File ===========================

mmogan · January 24, 2012

The Maylwarebytes Anti-Malware message does not give a file name when the message pops up. It just says, "Successfully blocked access to a potentially malicious website: 83.133.124.245. Type: outgoing"

Larusso · January 25, 2012

Sorry for the delay. I did not get a notification that you have replied.

Please download Gmer from here and save it to your Desktop.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
[*] Then click the Scan button & wait for it to finish.
[*] Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
[*]Save it where you can easily find it, such as your desktop

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Please post in your next reply

ark.txt

Larusso · January 28, 2012

Hello, are you still with us?

If you do not reply within 24 hours this topic will be closed.

mmogan · January 29, 2012

Here is the report from the ark.txt file:

GMER 1.0.15.15641 - http://www.gmer.net

Rootkit scan 2012-01-29 10:50:01

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.ZM10

Running: 1f13cylb.exe; Driver: C:\DOCUME~1\Michael\LOCALS~1\Temp\uxtyapod.sys

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF619D360, 0x21235D, 0xE8000020]

.text ipsec.sys!Ganwdxxgdy ECDF3000 19 Bytes [EC, FF, B5, 04, FF, FF, FF, ...]

.text ipsec.sys!Ganwdxxgdy ECDF3014 224 Bytes [00, 57, 1B, DB, 81, E3, C0, ...]

.text ipsec.sys!Ganwdxxgdy ECDF31A2 105 Bytes [4C, 00, 6F, 00, 67, 00, 49, ...]

.text ipsec.sys!Ganwdxxgdy ECDF320C 11 Bytes [45, 00, 78, 00, 65, 00, 6D, ...]

.text ipsec.sys!Ganwdxxgdy ECDF3219 30 Bytes [00, 45, 00, 6E, 00, 61, 00, ...]

.text ...

.text ipsec.sys!IsAkpidxdwe + 4D ECDF3457 43 Bytes CALL ECE02575 \SystemRoot\system32\DRIVERS\ipsec.sys (IPSec Driver/Microsoft Corporation)

.text ipsec.sys!IsAkpidxdwe + 79 ECDF3483 14 Bytes [90, 90, 90, 90, 8B, FF, 55, ...]

.text ipsec.sys!IsAkpidxdwe + 88 ECDF3492 80 Bytes [A1, A8, 1B, E0, EC, 56, 57, ...]

.text ipsec.sys!Drqahmbbbg + 2F ECDF34E3 78 Bytes [F0, 3B, F7, 0F, 8D, A8, 0A, ...]

.text ipsec.sys!AddLrgvirwpmy + 36 ECDF3532 1 Byte [65]

.text ipsec.sys!AddLrgvirwpmy + 36 ECDF3532 45 Bytes [65, 00, 5C, 00, 53, 00, 79, ...]

.text ipsec.sys!AddLrgvirwpmy + 64 ECDF3560 9 Bytes [53, 00, 65, 00, 74, 00, 5C, ...]

.text ipsec.sys!AddLrgvirwpmy + 6E ECDF356A 9 Bytes [65, 00, 72, 00, 76, 00, 69, ...]

.text ipsec.sys!AddLrgvirwpmy + 78 ECDF3574 46 Bytes [65, 00, 73, 00, 5C, 00, 49, ...]

.text ...

.text ipsec.sys!Ganwdxxgdy + 32 ECDF368D 5 Bytes [8B, FF, 55, 8B, EC] {MOV EDI, EDI; PUSH EBP; MOV EBP, ESP}

.text ipsec.sys!Ganwdxxgdy + 38 ECDF3693 156 Bytes [EC, 34, 53, 56, 8B, 35, B0, ...]

.text ipsec.sys!Ganwdxxgdy + D5 ECDF3730 35 Bytes [3B, C6, 75, F5, EB, D1, 5C, ...]

.text ipsec.sys!Ganwdxxgdy + F9 ECDF3754 57 Bytes [6E, 00, 65, 00, 5C, 00, 53, ...]

.text ipsec.sys!Ganwdxxgdy + 133 ECDF378E 133 Bytes [65, 00, 72, 00, 76, 00, 69, ...]

.text ...

? C:\WINDOWS\system32\DRIVERS\ipsec.sys suspicious PE modification

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0192000A

.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0193000A

.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0191000C

.text C:\Program Files\Mozilla Firefox\firefox.exe[2616] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0282000A

.text C:\Program Files\Mozilla Firefox\firefox.exe[2616] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0377000A

.text C:\Program Files\Mozilla Firefox\firefox.exe[2616] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0281000C

.text C:\WINDOWS\System32\ping.exe[4004] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00BA000A

.text C:\WINDOWS\System32\ping.exe[4004] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00BB000A

.text C:\WINDOWS\System32\ping.exe[4004] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A5000A

.text C:\WINDOWS\System32\ping.exe[4004] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00A6000A

.text C:\WINDOWS\System32\ping.exe[4004] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A4000C

.text C:\WINDOWS\System32\ping.exe[4004] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 00BE000A

.text C:\WINDOWS\System32\ping.exe[4004] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 00BF000A

.text C:\WINDOWS\System32\ping.exe[4004] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 00C0000A

.text C:\WINDOWS\System32\ping.exe[4004] ole32.dll!CoCreateInstance 774FF1BC 5 Bytes JMP 00BD000A

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat B6470D20

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

---- Modules - GMER 1.0.15 ----

Module (noname) (*** hidden *** ) F002F000-F0049000 (106496 bytes)

---- Processes - GMER 1.0.15 ----

Process C:\WINDOWS\System32\ping.exe (*** hidden *** ) 4004

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\$NtUninstallKB52979$\3433663781 0 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689 0 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\@ 2048 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\bckfg.tmp 854 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\cfg.ini 319 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\Desktop.ini 4608 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\keywords 160 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\kwrd.dll 223744 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\L 0 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\L\pdmzmplg 75264 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\lsflt7.ver 5176 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\oemid 22 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U 0 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\00000001.@ 2048 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\00000002.@ 224768 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\00000004.@ 1024 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\80000000.@ 11264 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\80000004.@ 12800 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\U\80000032.@ 73216 bytes

File C:\WINDOWS\$NtUninstallKB52979$\3585743689\version 854 bytes

---- EOF - GMER 1.0.15 ----

mmogan · January 29, 2012

PS: sorry for the delay in responding.

Larusso · January 29, 2012

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

Please post in your next reply

Combofix.txt

mmogan · January 31, 2012

I ran the Combofix and it said I was infected with Rootkit.ZeroAccess. It eventually ran through all the stages after restarting my computer and provided a log report, which is posted below. However, after the log file was created, I could not get online. The icon in the lower right said I was connected to my wireless connection, but the internet wouldn't work. I tried restarting, disconnecting the connection and reconnecting, but that didn't work. I think the Combofix messed with my connection settings or something. Any thoughts?

Also, one other thing I found odd that I thought I would mention. After I rebooting following the log report, the Malwarebytes icon in the bottom right said updates were available and I clicked on the icon and it downloaded the updates. Not sure why that was working and my internet wasn't.

Here is the log file report:

ComboFix 12-01-30.02 - Michael 01/30/2012 20:46:07.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.727 [GMT -5:00]

Running from: c:\documents and settings\Michael\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\Michael\WINDOWS

c:\program files\Search Toolbar

c:\program files\Search Toolbar\icon.ico

c:\program files\Search Toolbar\SearchToolbarUninstall.exe

c:\program files\Search Toolbar\SearchToolbarUpdater.exe

c:\windows\$NtUninstallKB52979$\3433663781

c:\windows\$NtUninstallKB52979$\3585743689\@

c:\windows\$NtUninstallKB52979$\3585743689\bckfg.tmp

c:\windows\$NtUninstallKB52979$\3585743689\cfg.ini

c:\windows\$NtUninstallKB52979$\3585743689\Desktop.ini

c:\windows\$NtUninstallKB52979$\3585743689\keywords

c:\windows\$NtUninstallKB52979$\3585743689\kwrd.dll

c:\windows\$NtUninstallKB52979$\3585743689\L\pdmzmplg

c:\windows\$NtUninstallKB52979$\3585743689\lsflt7.ver

c:\windows\$NtUninstallKB52979$\3585743689\oemid

c:\windows\$NtUninstallKB52979$\3585743689\U\00000001.@

c:\windows\$NtUninstallKB52979$\3585743689\U\00000002.@

c:\windows\$NtUninstallKB52979$\3585743689\U\00000004.@

c:\windows\$NtUninstallKB52979$\3585743689\U\80000000.@

c:\windows\$NtUninstallKB52979$\3585743689\U\80000004.@

c:\windows\$NtUninstallKB52979$\3585743689\U\80000032.@

c:\windows\$NtUninstallKB52979$\3585743689\version

c:\windows\kb913800.exe

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

c:\windows\$NtUninstallKB52979$ . . . . Failed to delete

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PODMENA

-------\Legacy_PODMENADRV

-------\Legacy_USNJSVC

-------\Service_usnjsvc

.

((((((((((((((((((((((((( Files Created from 2011-12-28 to 2012-01-31 )))))))))))))))))))))))))))))))

.

2012-01-20 08:01 . 2012-01-20 08:01 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth

2012-01-20 00:42 . 2012-01-20 00:42 -------- d-----w- c:\windows\system32\wbem\Repository

2012-01-18 12:42 . 2012-01-18 12:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2012-01-17 02:52 . 2012-01-17 02:52 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-10 20:24 . 2009-06-09 23:13 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-25 21:57 . 2005-08-16 08:18 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-11-23 13:25 . 2005-08-16 08:18 1859584 ----a-w- c:\windows\system32\win32k.sys

2011-11-18 12:35 . 2005-08-16 08:18 60416 ----a-w- c:\windows\system32\packager.exe

2011-11-04 19:20 . 2005-08-16 08:18 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-04 19:20 . 2005-08-16 08:18 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-04 19:20 . 2005-08-16 08:18 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-11-04 11:23 . 2005-08-16 08:18 385024 ----a-w- c:\windows\system32\html.iec

2011-11-03 15:28 . 2005-08-16 08:18 386048 ----a-w- c:\windows\system32\qdvd.dll

2011-11-03 15:28 . 2005-08-16 08:18 1292288 ----a-w- c:\windows\system32\quartz.dll

2011-12-21 07:24 . 2012-01-20 03:15 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 19:19 . CC1B819E974842F9E8AD2253C5CBFC84 . 75264 . . [------] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-10 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

[7] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 19:19 . CC1B819E974842F9E8AD2253C5CBFC84 . 75264 . . [------] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-10 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

2011-05-09 09:49 176936 ----a-w- c:\program files\Vuze_Remote\prxtbVuz2.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\prxtbVuz2.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2006-07-17 389120]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-02 68856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-16 7323648]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]

"ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 36040]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Belkin Wireless G Desktop Card Client Utility.lnk - c:\program files\Belkin\PCI F5D700F\Wireless Utility\Belkinwcui.exe [2007-1-15 1556480]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-04-01 10:51 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk

backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 17:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2005-09-08 09:20 122940 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]

2005-10-05 07:12 94208 ----a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]

2005-09-29 18:01 67584 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]

2008-08-26 16:19 29744 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 20:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2006-07-06 11:15 151552 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-27 20:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2006-07-24 14:20 282624 ----a-w- c:\windows\stsystra.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2007-08-02 01:27 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Red Chair Software\\Anapod Explorer\\anamgr.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Vuze\\Azureus.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [6/23/2009 10:01 AM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 10:01 AM 67656]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/9/2009 6:13 PM 652872]

R3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [8/12/2011 2:53 PM 1034240]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/9/2009 6:13 PM 20464]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2010 10:17 AM 135664]

S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\drivers\BLKWGDv7.SYS [1/15/2007 6:08 PM 303616]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [10/23/2006 3:32 PM 29744]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2010 10:17 AM 135664]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 7:49 AM 227232]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 10:01 AM 12872]

.

Contents of the 'Scheduled Tasks' folder

.

2012-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

2012-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:17]

.

2012-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-10 15:17]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

mWindow Title = Windows Internet Explorer provided by Comcast

mSearch Bar = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=w7HqBpCwd0ynN5caqkI2ee56NNg

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1

DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxps://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab

FF - ProfilePath - c:\documents and settings\Michael\Application Data\Mozilla\Firefox\Profiles\9w90tvvl.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-Cognac - c:\docume~1\Michael\LOCALS~1\Temp\b.exe

MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-01-30 21:09

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(560)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

- - - - - - - > 'explorer.exe'(532)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\nvsvc32.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\dllhost.exe

.

**************************************************************************

.

Completion time: 2012-01-30 21:14:06 - machine was rebooted

ComboFix-quarantined-files.txt 2012-01-31 02:14

.

Pre-Run: 36,483,899,392 bytes free

Post-Run: 37,570,174,976 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 59C8B152B81F52389D3B69F8AFA5F3B1

Larusso · January 31, 2012

Hy there,

It is not Combofix which kills your connection. It is a common problem with the kind of infection which was present on your system.

Please use an USB drive to transfer the script ( and tools we may later need ) to the infected one.

Open notepad and copy/paste the text in the Code-box below into it:


FCopy::
c:\windows\ServicePackFiles\i386\ipsec.sys | c:\windows\system32\drivers\ipsec.sys
Folder::
c:\windows\$NtUninstallKB52979$

Save this as CFScript.txt, in the same location as ComboFix.exe.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Refering to the picture above, drag CFScript into ComboFix.exe.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Please post in your next reply

Combofix.txt

Let me know if you are now able to connect

mmogan · February 2, 2012

Internet is working again after I ran combofix by dragging the .txt file over the combofix icon. I believe everything is working okay again. Here is the report from the log flie:

Does this mean my computer is clean again?

ComboFix 12-01-30.02 - Michael 02/01/2012 19:09:25.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.728 [GMT -5:00]

Running from: c:\documents and settings\Michael\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Michael\Desktop\CFScript.txt

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

--------------- FCopy ---------------

.

c:\windows\ServicePackFiles\i386\ipsec.sys --> c:\windows\system32\drivers\ipsec.sys

.

((((((((((((((((((((((((( Files Created from 2012-01-02 to 2012-02-02 )))))))))))))))))))))))))))))))

.

2012-01-31 02:31 . 2012-01-31 02:31 709968 ----a-w- c:\windows\is-CDA8D.exe