Antivirus2009, can't install MalwareBytes

CerezScypher · March 2, 2009

One of the computers in the house got the Antivirus 2009 always-on-top application. McAfee seems to have been able to stop some of the fake alerts from showing up, but the system's not clean, the virus scan keeps finding the same 3 trojans and quarantines them. We also installed AVG, but the problem remains. We downloaded MalwareBytes, but it won't install. I tried AdvancedSetup's fix for that from one of the posts here, but there is no TDSSserv.sys, or anything similarly named in the Hidden Devices in device manager, nor did I see anything named similarly in System32. Renaming mbam-setup.exe did not allow me to run the installer. I got HijackThis to install, though; here's the log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:04:48 PM, on 3/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Sony Handheld\HOTSYNC.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Linksys Wireless AG USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless AG USB Wireless Network Monitor\WUSB54AG.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: IE - {D83A7B12-A4D4-4984-8F72-D41C6B4C1E6E} - C:\Program Files\eSoftware\studio.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [system tool] C:\WINDOWS\sysguard.exe

O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Terry\Application Data\Macromedia\Common\3abfc0261.dll""

O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\3abfc0261.dll"" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\3abfc0261.dll"" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE

O8 - Extra context menu item: Convert for CLI

AdvancedSetup · March 2, 2009

Well the TDSSserv.sys change method is very old and Malware changes daily. Please try the following.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

CerezScypher · March 3, 2009

I put ComboFix.exe on the desktop, installed Recovery Console from a CD, disabled all antivirus software, antispyware software and firewalls, double-clicked ComboFix.exe and nothing happens. There's no "Open File - Security Warning" and no ComboFix.exe window ever appears.

AdvancedSetup · March 4, 2009

Try renaming the program a few times. If it still does not work then start in SAFE MODE and try again, also try renaming it a few times in Safe Mode and see if it will run.

CerezScypher · March 5, 2009

ComboFix Log:

ComboFix 09-03-02.01 - Terry 2009-03-05 9:27:18.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.613 [GMT -5:00]

Running from: c:\documents and settings\Terry\Desktop\Sorghum.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated)

FW: McAfee Personal Firewall *disabled*

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\eSoftware\studio.dll

c:\program files\WinBudget

c:\windows\system32\comrepl.exe

c:\windows\system32\drivers\UACxfaqbuhh.sys

c:\windows\system32\UACdypyxvrg.dll

c:\windows\system32\UACetsbmbio.log

c:\windows\system32\UACkertilpj.dat

c:\windows\system32\UACkipruawt.dll

c:\windows\system32\UAClwycilxr.log

c:\windows\system32\UAConqtewns.dll

c:\windows\system32\UACqjknmqpt.log

c:\windows\system32\UACxtuwyldh.dll

F:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))

.

2009-03-01 19:04 . 2009-03-01 19:04 <DIR> d-------- c:\program files\Trend Micro

2009-03-01 17:58 . 2009-03-01 17:49 2,876,720 --a------ C:\mbam-setup.exe

2009-03-01 15:50 . 2009-03-01 16:48 <DIR> d--h----- C:\$AVG8.VAULT$

2009-03-01 13:15 . 2004-06-10 07:59 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Sonic

2009-03-01 13:15 . 2004-06-10 07:57 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Jasc Software Inc

2009-03-01 13:15 . 2009-03-01 15:49 <DIR> d-------- c:\documents and settings\Administrator

2009-03-01 12:59 . 2009-03-01 12:59 <DIR> d-------- c:\program files\AVG

2009-03-01 12:59 . 2009-03-01 17:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8

2009-02-28 23:30 . 2009-02-28 23:30 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-02-28 19:42 . 2009-03-01 17:36 5,516 --a------ c:\windows\SYSTEM32\uacinit.dll

2009-02-28 11:10 . 2009-02-28 11:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2009-02-19 17:22 . 2009-02-19 17:22 <DIR> d-------- c:\program files\Bonjour

2009-02-17 09:42 . 2009-02-28 11:35 <DIR> d-------- c:\documents and settings\LocalService\Application Data\SACore

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-05 14:31 --------- d-----w c:\program files\eSoftware

2009-03-01 04:31 --------- d-----w c:\program files\Lavasoft

2009-03-01 04:29 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-02-28 16:28 --------- d-----w c:\program files\McAfee

2009-02-28 16:11 --------- d-----w c:\program files\iTunes

2009-02-28 16:10 --------- d-----w c:\program files\iPod

2009-02-28 16:10 --------- d-----w c:\program files\Common Files\Apple

2009-02-25 13:18 --------- d-----w c:\documents and settings\Terry\Application Data\Canon

2009-02-19 22:24 --------- d-----w c:\program files\Safari

2009-02-17 03:33 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor

2009-02-16 23:44 --------- d-----w c:\documents and settings\Terry\Application Data\Apple Computer

2009-02-16 22:28 --------- d-----w c:\program files\QuickTime

2009-02-01 16:55 --------- d-----w c:\program files\DesignPro

2009-02-01 13:36 --------- d-----w c:\program files\Sony Handheld

2009-02-01 13:35 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-17 02:35 3,594,752 ----a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll

2009-01-09 17:03 79,304 ----a-w c:\windows\system32\drivers\mfeavfk.sys

2009-01-09 17:03 40,552 ----a-w c:\windows\system32\drivers\mfesmfk.sys

2009-01-09 17:03 35,272 ----a-w c:\windows\system32\drivers\mfebopk.sys

2009-01-09 17:03 34,216 ----a-w c:\windows\system32\drivers\mferkdk.sys

2009-01-09 17:03 213,640 ----a-w c:\windows\system32\drivers\mfehidk.sys

2008-12-19 09:10 70,656 ------w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe

2008-12-19 09:10 13,824 ------w c:\windows\SYSTEM32\DLLCACHE\ieudinit.exe

2008-12-19 05:25 634,024 ------w c:\windows\SYSTEM32\DLLCACHE\iexplore.exe

2008-12-19 05:23 161,792 ------w c:\windows\SYSTEM32\DLLCACHE\ieakui.dll

2008-12-12 16:18 87,336 ----a-w c:\windows\SYSTEM32\dns-sd.exe

2008-12-12 16:11 61,440 ----a-w c:\windows\SYSTEM32\dnssd.dll

2008-12-11 10:57 333,952 ------w c:\windows\SYSTEM32\DLLCACHE\srv.sys

2007-07-04 14:18 560 ----a-w c:\documents and settings\Terry\Application Data\ViewerApp.dat

2008-11-15 16:30 32,768 --sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008111520081116\index.dat

.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

----a-r 2,321,600 2007-03-01 14:37:52 c:\program files\Common Files\Adobe\Updater5\bak\AdobeUpdater.exe

----a-w 180,269 2004-11-20 19:07:46 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

----a-w 68,856 2007-06-21 04:33:41 c:\program files\Google\GoogleToolbarNotifier\bak\GoogleToolbarNotifier.exe

----a-w 267,048 2008-01-15 08:22:56 c:\program files\iTunes\bak\iTunesHelper.exe

----a-w 290,088 2009-01-06 18:06:36 c:\program files\iTunes\iTunesHelper.exe

----a-w 24,576 2004-04-19 13:19:54 c:\program files\Linksys Wireless AG USB Wireless Network Monitor\bak\InvokeSvc3.exe

----a-w 582,992 2007-08-04 03:33:14 c:\program files\McAfee.com\Agent\bak\mcagent.exe

----a-w 645,328 2009-01-09 01:30:26 c:\program files\McAfee.com\Agent\mcagent.exe

----a-w 385,024 2008-01-10 20:27:36 c:\program files\QuickTime\bak\QTTask.exe

----a-w 413,696 2009-01-05 21:18:48 c:\program files\QuickTime\QTTask.exe

----a-w 866,584 2006-11-03 23:20:12 c:\program files\Windows Defender\bak\MSASCui.exe

----a-w 15,360 2004-08-04 07:56:48 c:\windows\SYSTEM32\bak\ctfmon.exe

----a-w 15,360 2008-04-14 00:12:16 c:\windows\SYSTEM32\ctfmon.exe

----a-w 77,824 2005-09-20 13:32:24 c:\windows\SYSTEM32\bak\hkcmd.exe

----a-w 114,688 2005-09-20 13:36:20 c:\windows\SYSTEM32\bak\igfxpers.exe

----a-w 122,933 2004-03-15 06:04:00 c:\windows\SYSTEM32\dla\bak\tfswctrl.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"system tool"="c:\windows\sysguard.exe" [N/A]

"rundll32.exe"="c:\documents and settings\Terry\Application Data\Macromedia\Common\3abfc0261.dll" [2009-02-28 64512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-08 645328]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

"rundll32.exe"="c:\windows\system32\config\systemprofile\Application Data\Macromedia\Common\3abfc0261.dll" [2009-02-28 64512]

c:\documents and settings\Terry\Start Menu\Programs\Startup\

HotSync Manager.lnk - c:\program files\Sony Handheld\HOTSYNC.EXE [2002-08-09 299008]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"wave1"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"midi1"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"aux2"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"mixer1"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"wave2"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"aux1"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"mixer2"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

"midi2"= c:\docume~1\Terry\APPLIC~1\MACROM~1\Common\3abfc0261.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk

backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Reminder.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk

backup=c:\windows\pss\Event Reminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk

backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk

backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rundll32.exe]

--a------ 2009-02-28 23:27 64512 c:\documents and settings\Terry\Application Data\Macromedia\Common\3abfc0261.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WANMiniportService"=2 (0x2)

"Viewpoint Manager Service"=2 (0x2)

"DSBrokerService"=3 (0x3)

"dlbt_device"=3 (0x3)

"AOL ACS"=2 (0x2)

"gusvc"=3 (0x3)

"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\SYSTEM32\\mmc.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-02-16 206096]

S3 pc22nd5;Toshiba PCX2200 USB Cable Modem networking driver (NDIS);c:\windows\SYSTEM32\DRIVERS\pc22nd5.sys [2004-06-16 17648]

S3 pc22unic;Toshiba PCX2200 USB Cable Modem WDM driver;c:\windows\SYSTEM32\DRIVERS\pc22unic.sys [2004-06-16 69744]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5

*Deregistered* - Themes

*Deregistered* - TrkWks

*Deregistered* - w32time

*Deregistered* - WebClient

*Deregistered* - WinDefend

*Deregistered* - winmgmt

*Deregistered* - wuauserv

*Deregistered* - WudfSvc

*Deregistered* - WUSB54AG

*Deregistered* - WZCSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{202d35ee-b2fc-11da-ba84-009083861a52}]

\Shell\AutoRun\command - G:\LaunchU3.exe

.

Contents of the 'Scheduled Tasks' folder

2009-02-26 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2004-06-18 c:\windows\Tasks\ISP signup reminder 1.job

- c:\windows\System32\OOBE\OOBEBALN.EXE [2008-04-13 19:12]

2009-02-15 c:\windows\Tasks\McDefragTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2009-01-09 10:53]

2009-03-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2009-01-09 10:53]

2009-03-05 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]

2009-03-01 c:\windows\Tasks\User_Feed_Synchronization-{0E70084E-DC74-47D6-A712-6503E5136A9C}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]

.

- - - - ORPHANS REMOVED - - - -

BHO-{549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

BHO-{D83A7B12-A4D4-4984-8F72-D41C6B4C1E6E} - c:\program files\eSoftware\studio.dll

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/ig?hl=en&source=iglk

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Convert for CLI

CerezScypher · March 5, 2009

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:38:41 AM, on 3/5/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Linksys Wireless AG USB Wireless Network Monitor\WLService.exe

C:\Program Files\Linksys Wireless AG USB Wireless Network Monitor\WUSB54AG.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINDOWS\explorer.exe