Malware.Packer.Gen & Trojan.Agent are not removed

rdy4trvl · April 10, 2012

After running Malwarebytes, removing the malicious software and restarting the problem item reappears. I'm not sure but it seems to add one set of Malware.Packer.Gen and Trojan.Agent each time the computer starts.

There are no apparent operating issues - computer seems (!!!) to be running fine (and probably sending all my data to some hacker in a foreign land....or to the neighbor next door).

Any Suggestions?

Malwarebytes returns these two lines after a full analysis:

Malware.Packer.Gen C:\........Temp\_MEI20163\IPHLPAPI.DLL

Trojan.Agent C:\........Temp\_MEI20163\kernel32.dll

DDS and Attach files are attached.

Thanks

dds.txt

attach.txt

Maniac · April 10, 2012

Hello rdy4trvl! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at support@malwarebytes.org or here (http://helpdesk.malwarebytes.org/home). If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

I want to see the log file, so proceed with the next step, but is very important those and every step after to be executed in Normal mode, not in Safe Mode.

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

Malwarebytes' Anti-Malware log
a new fresh DDS log file

rdy4trvl · April 10, 2012

The infection continues. DDS and Log are pasted below.

Thanks again for your assistance.

DDS:

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31

Run by Doug at 9:59:45 on 2012-04-10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.1645 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe

C:\Program Files\FolderSize\FolderSizeSvc.exe

C:\Program Files\EaseUS\Todo Backup\bin\GuardAgent.exe

C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Documents and Settings\All Users\Application Data\FLEXnet\Connect\11\isuspm.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\V0230Mon.exe

C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Documents and Settings\All Users\Application Data\Anti-phishing Domain Advisor\visicom_antiphishing.exe

C:\Program Files\DisplayFusion\DisplayFusion.exe

C:\Program Files\Stardock\CursorFX\CursorFX.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Eye-Fi\Helper\EyeFiHelper.exe

C:\Program Files\Schwab\StreetSmart Edge\QuickLaunch.exe

C:\Documents and Settings\Doug\Application Data\BTLive\BTLive.exe

C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe

C:\Program Files\Evernote\Evernote\EvernoteClipper.exe

C:\Documents and Settings\Doug\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Schwab\StreetSmart Edge\SSEdge.exe

C:\Program Files\Texter\texter.exe

C:\Documents and Settings\Doug\Application Data\BTLive\BTLive.exe

C:\Documents and Settings\Doug\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Documents and Settings\Doug\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Doug\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

C:\PROGRAM FILES\FOXIT SOFTWARE\FOXIT READER\FOXIT READER.EXE

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\system32\dllhost.exe

C:\Documents and Settings\Doug\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://blekko.com?source=c3348dd4&tbp=homepage&toolbarid=blekkotb&u=2012033132B64C498B125D11813D8C71

uSearch Page = hxxp://www.google.com

uWindow Title = Internet Explorer, optimized for Bing and MSN

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\program files\soluto\soluto.exe /userinit,

BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Updater For Spam Free Search Bar: {20a0be68-8fd9-4539-8712-ce3d1c1fdfc6} - c:\program files\blekkotb\auxi\blekkoAu.dll

BHO: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - c:\program files\blekkotb\blekkoDx.dll

BHO: bxNewFolder: {51c8bca8-2524-4523-bf09-738c4eebfc58} - c:\progra~1\bxnewf~1\BXNEWF~1.DLL

BHO: PlusIEEventHelper Class: {551a852f-39a6-44a7-9c13-afbec9185a9d} - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll

BHO: Do Not Track Plus: {6e45f3e8-2683-4824-a6be-08108022fb36} - c:\program files\donottrackplus\ScriptHost.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2291.0\npwinext.dll

BHO: WeCareReminder Class: {d824f0de-3d60-4f57-9eb1-66033ecd8abb} - c:\documents and settings\all users\application data\wecarereminder\IEHelperv2.5.0.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: @c:\program files\msn toolbar\platform\6.3.2291.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2291.0\npwinext.dll

TB: Spam Free Search Bar: {26c9e18c-3717-4be1-a225-04e4471f5b6e} - c:\program files\blekkotb\blekkoDx.dll

uRun: [Google Update] "c:\documents and settings\doug\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [DisplayFusion] "c:\program files\displayfusion\DisplayFusion.exe"

uRun: [DriverMax]

uRun: [DriverMax_RESTART]

uRun: [CursorFX] "c:\program files\stardock\cursorfx\CursorFX.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Eye-Fi] "c:\program files\eye-fi\helper\EyeFiHelper.exe"

uRun: [QuickLaunch] c:\program files\schwab\streetsmart edge\QuickLaunch.exe

uRun: [bTLive] c:\documents and settings\doug\application data\btlive\BTLive.exe

uRun: [Gadwin PrintScreen] c:\program files\gadwin systems\printscreen\PrintScreen.exe /nosplash

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [iSUSPM] c:\documents and settings\all users\application data\flexnet\connect\11\\isuspm.exe -scheduler

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [V0230Mon.exe] c:\windows\V0230Mon.exe

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin

mRun: [PPort9reminder] "c:\program files\scansoft\paperport\webereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\9\config\ereg.ini"

mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Anti-phishing Domain Advisor] "c:\documents and settings\all users\application data\anti-phishing domain advisor\visicom_antiphishing.exe"

StartupFolder: c:\docume~1\doug\startm~1\programs\startup\everno~1.lnk - c:\program files\evernote\evernote\EvernoteClipper.exe

StartupFolder: c:\docume~1\doug\startm~1\programs\startup\google~1.lnk - c:\documents and settings\doug\local settings\application data\google\chrome\application\chrome.exe

StartupFolder: c:\docume~1\doug\startm~1\programs\startup\street~1.lnk - c:\program files\schwab\streetsmart edge\SSEdge.exe

StartupFolder: c:\docume~1\doug\startm~1\programs\startup\texter.lnk - c:\program files\texter\texter.exe

IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204

IE: Add to Evernote 4.0 - c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000

IE: Open with PDF Viewer 7 - c:\program files\nuance\pdf viewer plus\bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://c:\program files\evernote\evernote\EvernoteIE.dll/204

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {6E45F3E8-2683-4824-A6BE-08108022FB36} - {23249465-AA46-4DED-BD4B-8EFB20F968FE} - c:\program files\donottrackplus\ScriptHost.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL

DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{16150EFA-70A3-4B53-A838-A00B76325BEC} : DhcpNameServer = 75.75.75.75 75.75.76.76

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks 2009\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

AppInit_DLLs: c:\progra~1\google\google~1\GOEC62~1.DLL

STS: FencesShlExt Class: {1984dd45-52cf-49cd-ab77-18f378fea264} - c:\program files\stardock\fences\FencesMenu.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\doug\application data\mozilla\firefox\profiles\m6wpu69h.default\

FF - prefs.js: browser.search.selectedEngine - Blekko

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://startsear.ch/?aff=3&src=sp&cf=d155aae0-432c-11e1-87cf-00219b1372e1&q=

FF - plugin: c:\documents and settings\doug\application data\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\doug\application data\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\doug\local settings\application data\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\canon\mycamera download plugin\NPCIG.dll

FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\nuance\pdf viewer plus\bin\nppdf.dll

.

============= SERVICES / DRIVERS ===============

.

R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [2012-2-29 50312]

R0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys [2012-2-29 43784]

R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2011-10-22 14776]

R1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [2012-2-29 16008]

R1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys [2012-2-29 185864]

R2 BstHdDrv;BlueStacks Hypervisor;c:\program files\bluestacks\HD-Hypervisor-x86.sys [2012-3-28 66912]

R2 EaseUS Agent;EaseUS Agent;c:\program files\easeus\todo backup\bin\Agent.exe [2012-2-29 61064]

R2 Guard Agent;Guard Agent;c:\program files\easeus\todo backup\bin\GuardAgent.exe [2012-2-29 23176]

R2 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\wintv\tvserver\HAUPPA~1.EXE [2011-10-22 602624]

R3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys --> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]

R3 hcw72ADFilter;WinTV HVR-950 USB Audio Filter Driver;c:\windows\system32\drivers\hcw72ADFilter.sys [2011-10-22 28928]

R3 hcw72ATV;WinTV HVR-950 NTSC;c:\windows\system32\drivers\hcw72ATV.sys [2011-10-22 1217920]

R3 hcw72DTV;WinTV HVR-950 ATSC/QAM;c:\windows\system32\drivers\hcw72DTV.sys [2011-10-22 1220224]

R3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V0230Vfx.sys [2006-3-24 6272]

R3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [2006-9-29 500480]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S0 cerc6;cerc6; [x]

S0 Soluto;Soluto;c:\windows\system32\drivers\Soluto.sys [2012-3-23 51144]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-2-29 158856]

S2 SolutoService;Soluto PCGenome Core Service;c:\program files\soluto\SolutoService.exe [2012-3-20 571936]

S3 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\bluestacks\HD-Service.exe [2012-3-28 401760]

S3 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\bluestacks\HD-LogRotatorService.exe [2012-3-28 385376]

S3 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 cpuz134;cpuz134;c:\program files\cpuid\pc wizard 2010\pcwiz_x32.sys [2011-10-22 20328]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-10-22 13192]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-10-22 8456]

S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-10-22 30192]

.

=============== Created Last 30 ================

.

2012-04-09 03:46:54 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll

2012-04-09 03:46:54 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll

2012-04-02 04:47:53 -------- d-----w- C:\4-1-2012

2012-03-31 00:17:17 -------- d-----w- C:\VMS

2012-03-31 00:06:32 -------- d-----w- c:\documents and settings\doug\local settings\application data\blekkotb

2012-03-31 00:06:32 -------- d-----w- c:\documents and settings\all users\application data\Anti-phishing Domain Advisor

2012-03-31 00:06:24 -------- d-----w- c:\documents and settings\doug\application data\blekkotb

2012-03-31 00:06:23 -------- d-----w- c:\program files\blekkotb

2012-03-30 03:56:29 -------- d-----w- c:\windows\pss

2012-03-30 02:40:25 -------- d-----w- c:\windows\system32\LogFiles

2012-03-30 02:35:42 -------- d-----w- c:\program files\BlueStacks

2012-03-30 02:35:42 -------- d-----w- c:\documents and settings\all users\application data\BlueStacks

2012-03-30 02:03:28 -------- d-----w- c:\documents and settings\doug\local settings\application data\BlueStacksSetup

2012-03-30 02:03:27 -------- d-----w- c:\documents and settings\doug\local settings\application data\BlueStacks

2012-03-29 17:58:27 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-03-29 17:58:27 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll

2012-03-26 21:11:39 -------- d--h--w- c:\windows\system32\GroupPolicy

2012-03-26 21:03:05 -------- d-----w- c:\documents and settings\doug\local settings\application data\APN

2012-03-26 21:02:45 -------- d-----w- c:\documents and settings\all users\application data\Avira

2012-03-23 14:16:59 51144 ----a-w- c:\windows\system32\drivers\Soluto.sys

2012-03-23 14:16:53 -------- d-----w- c:\program files\Soluto

2012-03-22 19:12:12 4435968 ----a-w- c:\windows\system32\GPhotos.scr

.

==================== Find3M ====================

.

2012-03-29 17:57:46 472808 ----a-w- c:\windows\system32\deployJava1.dll

2012-02-08 17:00:24 60304 ----a-w- c:\documents and settings\doug\g2mdlhlpx.exe

2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys

2012-01-31 12:44:05 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-01-23 15:19:39 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-11 19:06:47 3072 ------w- c:\windows\system32\iacenc.dll

.

============= FINISH: 10:00:12.59 ===============

Log

Malwarebytes Anti-Malware 1.60.1.1000

www.malwarebytes.org

Database version: v2012.04.08.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Doug :: DOUG-7C388E4B75 [administrator]

4/10/2012 8:44:47 AM

mbam-log-2012-04-10 (08-44-47).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 202676

Time elapsed: 10 minute(s), 16 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 4

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI21442\IPHLPAPI.DLL (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI21442\kernel32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI28682\IPHLPAPI.DLL (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI28682\kernel32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

(end)

Maniac · April 10, 2012

Please strictly follow my instructions. Your database is still out-of-date:

Database version: v2012.04.08.01

rdy4trvl · April 11, 2012

Sorry, second try with updated db version. LOG and DDS follows:

LOG

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.04.10.09

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Doug :: DOUG-7C388E4B75 [administrator]

4/10/2012 12:11:49 PM

mbam-log-2012-04-10 (12-11-49).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 203036

Time elapsed: 10 minute(s), 19 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 2

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI5922\IPHLPAPI.DLL (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\Doug\Local Settings\Temp\_MEI5922\kernel32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

(end)

DDS

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31

Run by Doug at 17:24:40 on 2012-04-10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.1934 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Soluto\soluto.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\EaseUS\Todo Backup\bin\Agent.exe

C:\Program Files\FolderSize\FolderSizeSvc.exe

C:\Program Files\EaseUS\Todo Backup\bin\GuardAgent.exe

C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE

C:\Program Files\Soluto\SolutoService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe