MBAM freezing and update to 1.34 issues

Perth2008 · February 12, 2009

Hi Guys

I do not think there is a problem with my PC ... according to MBAM, Ad-Aware, Spybot, Windows Malicious Software Removal and Norton 360 2.0, however I have posted other information related to the MBAM freezing and updating to 1.34 and want to be sure its not my system that is at fault and/or to identify if there are incompatabilities with MBAM that may be causing freezing and updating issues.

My related post is here: http://www.malwarebytes.org/forums/index.php?showtopic=11218

and I have been in contact with TeMerc (Ticket 2575) on the freezing problem (actually a very slow MBAM scan in my opinion, as a non-IT person, with some issues in the c:\windows\installer directory).

Without further ado here are the recent relevant MBAM and HijackThis logs to get the ball rolling.

Malwarebytes' Anti-Malware 1.34

Database version: 1752

Windows 5.1.2600 Service Pack 3

12/02/2009 4:57:01 PM

mbam-log-2009-02-12 (16-57-01).txt

Scan type: Quick Scan

Objects scanned: 74157

Time elapsed: 19 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:44:40 PM, on 12/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3K2.EXE

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Westnet\iConnect\launcher.exe

C:\DOCUME~1\Frank\LOCALS~1\Temp\iCBB_04_19 R14-47 WESTNET B01 Monitor Temporary Items\monSvr.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\system32\taskmgr.exe

C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Frank\My Documents\Computer & ISP\PC Utils\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mywestnet.com.au/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mywestnet.com.au/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mywestnet.com.au/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [sMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [EPSON Stylus Photo RX510] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3K2.EXE /P24 "EPSON Stylus Photo RX510" /O6 "USB001" /M "Stylus Photo RX510"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [uniblue ProcessQuickLink 2] "C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" /autostart

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Service Centre.lnk = C:\Program Files\Westnet\iConnect\launcher.exe

O8 - Extra context menu item: Download with GetRight Pro - C:\Program Files\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Program Files\GetRight\GRbrowse.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.arrowcomputers.com.au

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.7.109.cab

O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1229485591656

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/flash...ent/swflash.cab

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

--

End of file - 9871 bytes

I look forward to your comments and hope it may assist in resolving the above problems for others, no just me.

Thanks

Perth2008

AdvancedSetup · February 12, 2009

Well I've never heard of this 'C:\DOCUME~1\Frank\LOCALS~1\Temp\iCBB_04_19 R14-47 WESTNET B01 Monitor Temporary Items\monSvr.exe"

But generally speaking NO service or executable file should be running from the %temp% folder.

Please download and run the following.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

Perth2008 · February 12, 2009

G'day Advanced Setup

Thanks for VERY prompt response.

Generally I would agree 100% with your comment about EXE (or DLL) files running from/in Local Services\Temp directory:

Well I've never heard of this 'C:\DOCUME~1\Frank\LOCALS~1\Temp\iCBB_04_19 R14-47 WESTNET B01 Monitor Temporary Items\monSvr.exe"

But generally speaking NO service or executable file should be running from the %temp% folder.

The WESTNET/iConnect monitor is a graphical interface provided by my ISP that allows moitoring of my internet connection and to readily access my service account.

I'll attach a couple of screen shots to show you what this program creates/does ... it installs/refreshes the interface at every re-boot and I don't BELIEVE it is a problem ... however I am happy to undertake your advice if you still think, after reading this, that it may be a problem.

Screenshots as follows:

Hmmm seems like I've used up my 500k upload allocation ... :-(

Well, attached is perhaps the most relevant image ... it shows the graphical interface

Am I correct in assuming from your comment that the C:\DOCUME~1\Frank\LOCALS~1\Temp\iCBB_04_19 R14-47 WESTNET B01 Monitor Temporary Items\monSvr.exe is the ONLY potential cause for concern in the HijackThis log?

Nevertheless can you please confirm whether the procedure (above) using the ComboFix.exe program is what I need to do should I notice unusual EXE (or DLL) files in the Local Services\Temp in the future.

Thanks & regards,

Perth2008

Perth2008 · February 13, 2009

Hi AdvancedSetup

I ran Conbofix as suggested ... I figured it cannot hurt given that it does a deeper scan. Ofcourse it's all "gobbledegook" to me and best left to experts, such as you, to interpret, although I did notice a "strange" SYS and EXE file in Local Settings\Temp showing in the logs ... however when I looked for the files using explore there was a new (replacement?) Local Settings\temp directory (note lower case "t" in temp now) with a "WPDNSE" subdirectory.

ComboFix 09-02-12.03 - Frank 2009-02-13 9:38:28.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2492 [GMT 9:00]

Running from: c:\documents and settings\Frank\Desktop\ComboFix.exe

AV: Norton 360 *On-access scanning disabled* (Updated)

FW: Norton 360 *disabled*

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-01-13 to 2009-02-13 )))))))))))))))))))))))))))))))

.

2009-02-04 11:49 . 2009-02-04 11:49 <DIR> d-------- c:\documents and settings\Frank\Application Data\ArcSoft

2009-02-04 11:31 . 2009-02-04 11:36 <DIR> d-------- c:\documents and settings\Frank\Application Data\EPSON

2009-02-04 11:29 . 2009-02-04 11:49 <DIR> d-------- c:\documents and settings\Frank\Application Data\Smart Panel

2009-02-01 11:18 . 2009-02-01 11:18 <DIR> d-------- c:\documents and settings\Frank\Application Data\Media Player Classic

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2017-10-17 00:30 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink

2017-10-17 00:29 --------- d-----w c:\program files\CyberLink

2017-10-17 00:21 --------- d-----w c:\program files\Nero

2017-10-16 23:59 --------- d-----w c:\program files\microsoft frontpage

2009-02-13 00:35 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-02-13 00:32 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

2009-02-13 00:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-12 23:48 --------- d-----w c:\documents and settings\All Users\Application Data\OPEN Networks

2009-02-12 07:25 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-12 06:00 --------- d-----w c:\program files\Uniblue

2009-02-12 03:00 --------- d-----w c:\documents and settings\Frank\Application Data\GetRight Pro

2009-02-12 02:12 --------- d-----w c:\program files\Westnet

2009-02-12 02:07 410,984 ----a-w c:\windows\system32\deploytk.dll

2009-02-12 01:21 --------- d-----w c:\program files\SpywareBlaster

2009-02-12 00:32 --------- d-----w c:\program files\Java

2009-02-11 01:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 01:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-11 00:04 --------- d--h--w c:\program files\InstallShield Installation Information

2009-02-11 00:04 --------- d-----w c:\program files\EPSON

2009-02-10 13:49 43,520 ----a-w c:\windows\system32\CmdLineExt03.dll

2009-02-10 13:38 --------- d-----w c:\program files\Sierra

2009-02-09 09:15 --------- d-----w c:\program files\Norton Security Scan

2009-02-04 02:35 --------- d-----w c:\program files\Smart Panel

2009-02-03 23:17 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-02-02 10:27 --------- d-----w c:\program files\Reference Assemblies

2009-02-02 10:27 --------- d-----w c:\program files\MSBuild

2009-02-01 09:19 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-02-01 09:18 --------- d-----w c:\program files\AGEIA Technologies

2009-02-01 02:16 --------- d-----w c:\program files\K-Lite Codec Pack

2009-02-01 01:00 --------- d-----w c:\documents and settings\Frank\Application Data\IGN_DLM

2009-01-31 13:03 15,688 ----a-w c:\windows\system32\lsdelete.exe

2009-01-28 06:00 --------- d-----w c:\program files\InterActual

2009-01-28 01:04 15,616 ----a-w c:\windows\system32\drivers\Dbgv.sys

2009-01-27 04:59 --------- d-----w c:\program files\Defraggler

2009-01-27 04:58 --------- d-----w c:\program files\Recuva

2009-01-26 03:13 --------- d-----w c:\program files\QuickTime

2009-01-26 03:13 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2009-01-23 05:06 --------- d-----w c:\program files\Ubisoft

2009-01-21 09:33 64,160 ----a-w c:\windows\system32\drivers\Lbd.sys

2009-01-21 09:27 --------- dc-h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-01-21 09:27 --------- d-----w c:\program files\Lavasoft

2009-01-19 01:08 --------- d-----w c:\program files\MSECache

2009-01-16 09:24 70,936 ----a-w c:\windows\system32\PhysXLoader.dll

2009-01-08 05:32 107,888 ----a-w c:\windows\system32\CmdLineExt.dll

2009-01-06 02:16 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF

2009-01-06 02:16 60,808 ----a-w c:\windows\system32\S32EVNT1.DLL

2009-01-06 02:16 124,464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS

2009-01-06 02:16 10,635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT

2009-01-06 02:16 --------- d-----w c:\program files\Symantec

2009-01-04 08:54 18,048 ----a-w c:\windows\system32\drivers\lirsgt.sys

2009-01-04 08:54 165,376 ----a-w c:\windows\system32\drivers\atksgt.sys

2009-01-03 02:56 --------- d-----w c:\program files\SCi Games

2009-01-02 05:36 --------- d-----w c:\documents and settings\Frank\Application Data\Ahead

2009-01-02 00:23 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2008-12-31 08:04 691,560 ----a-w c:\windows\system32\OGACheckControl.dll

2008-12-31 08:04 528,744 ----a-w c:\windows\system32\OGAVerify.exe

2008-12-31 08:04 502,120 ----a-w c:\windows\system32\OGAAddin.dll

2008-12-31 06:00 --------- d-----w c:\program files\2015

2008-12-30 02:18 --------- d-----w c:\program files\Download Manager

2008-12-28 14:34 --------- d-----w c:\documents and settings\Frank\Application Data\WebRenderer

2008-12-28 08:47 --------- d-----w c:\program files\CCleaner

2008-12-25 15:08 453,152 ----a-w c:\windows\system32\nvudisp.exe

2008-12-23 12:58 453,152 ----a-w c:\windows\system32\NVUNINST.EXE

2008-12-21 12:57 --------- d-----w c:\program files\GetRight

2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll

2008-12-19 06:57 98,304 ----a-w c:\windows\system32CmdLineExt.dll

2008-12-19 06:29 --------- d-----w c:\documents and settings\Eva\Application Data\Symantec

2008-12-19 04:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller

2008-12-19 04:05 --------- d-----w c:\program files\Windows Live

2008-12-19 03:58 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller

2008-12-19 01:13 --------- d-----w c:\program files\EA GAMES

2008-12-19 00:43 --------- d-----w c:\program files\Air Conflicts

2008-12-19 00:10 --------- d--h--r c:\documents and settings\Frank\Application Data\SecuROM

2008-12-18 23:12 --------- d-----w c:\program files\THQ

2008-12-18 22:34 --------- d-----w c:\program files\GameSpy Arcade

2008-12-18 21:21 --------- d-----w c:\documents and settings\Frank\Application Data\InstallShield

2008-12-18 20:34 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2008-12-18 20:27 --------- d-----w c:\program files\activePDF

2008-12-18 19:24 --------- d-----w c:\program files\Canon

2008-12-18 19:00 --------- d-----w c:\program files\Apple Software Update

2008-12-18 18:59 --------- d-----w c:\documents and settings\All Users\Application Data\Apple

2008-12-18 18:58 --------- d-----w c:\documents and settings\Frank\Application Data\Apple Computer

2008-12-18 18:29 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2008-12-18 17:51 --------- d-----w c:\documents and settings\All Users\Application Data\UDL

2008-12-18 17:50 --------- d-----w c:\program files\ABBYY FineReader 5.0 Sprint

2008-12-18 17:49 --------- d-----w c:\program files\ArcSoft

2008-12-18 02:57 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead

2008-12-18 02:56 --------- d-----w c:\program files\Common Files\Ahead

2008-12-18 02:55 --------- d-----w c:\documents and settings\All Users\Application Data\Nero

2008-12-18 00:24 --------- d-----w c:\program files\Common Files\Adobe

2008-12-17 23:57 --------- d-----w c:\program files\filehippo.com

2008-12-17 23:20 --------- d-----w c:\program files\Google

2008-12-17 23:09 --------- d-----w c:\program files\Britannica 2006

2008-12-17 23:07 --------- d--h--w c:\program files\Zero G Registry

2008-12-17 22:11 --------- d-----w c:\program files\Microsoft Encarta

2008-12-17 19:39 --------- d-----w c:\documents and settings\Frank\Application Data\OfficeUpdate12

2008-12-17 18:17 --------- d-----w c:\documents and settings\Frank\Application Data\Symantec

2008-12-17 18:13 --------- d-----w c:\program files\Norton 360

2008-12-17 17:51 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-12-17 17:30 --------- d-----w c:\program files\Windows Sidebar

2008-06-05 20:18 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]

@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"

[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]

2008-11-01 05:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]

@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"

[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]

2008-11-01 05:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]

@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"

[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]

2008-11-01 05:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Uniblue ProcessQuickLink 2"="c:\program files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" [2008-04-03 655640]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-11-08 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-11-08 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-11-08 137752]

"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-30 638976]

"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-02-26 29757440]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-18 51048]

"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2008-05-29 570664]

"EPSON Stylus Photo RX510"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I3K2.EXE" [2003-09-12 99840]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-30 509784]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-12 148888]

"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 c:\windows\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2007-10-11 c:\windows\SkyTel.exe]

"nwiz"="nwiz.exe" [2009-01-15 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Service Centre.lnk - c:\program files\Westnet\iConnect\launcher.exe [2009-02-12 791976]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2008-01-23 04:13 152872 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2008-05-29 01:27 570664 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

--a------ 2004-11-03 12:24 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2009-02-12 11:07 148888 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2009-01-15 08:19 1657376 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\Msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-21 64160]

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-19 149352]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-18 99376]

R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [2008-12-14 38400]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2008-12-14 222976]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-19 950096]

S3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l251x86.sys [2008-06-04 30720]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-13 23888]

S3 gkmixern;gkmixern;\??\c:\docume~1\Frank\LOCALS~1\Temp\gkmixern.sys --> c:\docume~1\Frank\LOCALS~1\Temp\gkmixern.sys [?]

S4 ZDSVNXJP;ZDSVNXJP;c:\docume~1\Frank\LOCALS~1\Temp\ZDSVNXJP.exe --> c:\docume~1\Frank\LOCALS~1\Temp\ZDSVNXJP.exe [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

*Deregistered* - uphcleanhlp

.

Contents of the 'Scheduled Tasks' folder

2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-31 22:03]

2009-02-03 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-31 05:34]

2009-02-09 c:\windows\Tasks\Norton Security Scan for Frank.job

- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 21:18]

2009-02-12 c:\windows\Tasks\OGADaily.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 17:04]

2009-02-12 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAVerify.exe [2008-12-31 17:04]

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-NWEReboot - (no file)

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com.au/

mStart Page = hxxp://www.mywestnet.com.au/

uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe"

uInternet Settings,ProxyOverride = <local>

IE: Download with GetRight Pro - c:\program files\GetRight\GRdownload.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Open with GetRight Pro Browser - c:\program files\GetRight\GRbrowse.htm

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-13 09:39:23

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1644491937-1614895754-682003330-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:b2,05,e2,fb,dc,71,5e,2d,6b,90,0e,37,3f,b0,73,95,37,62,c6,4e,d0,b9,80,

1b,90,05,1d,c2,c4,d1,ae,1e,e3,a0,db,6f,21,56,08,cc,3e,29,22,fd,a4,fa,5f,a4,\

"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d

.

Completion time: 2009-02-13 9:40:33

ComboFix-quarantined-files.txt 2009-02-13 00:40:30

Pre-Run: 309,046,935,552 bytes free

Post-Run: 309,112,201,216 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

262 --- E O F --- 2009-02-02 09:01:56

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:01:53 AM, on 13/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\IoctlSvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\UPHClean\uphclean.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3K2.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Frank\My Documents\Computer & ISP\PC Utils\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157