Unknown Infection on win XP/IE8...unable to reinstall/run/update mbam

BrianLevy · April 2, 2013

Hi,

I was in a rush to try and view a media file for our GM here, and in my haste it looks like I infected myself pretty badly. I am unable to run or reinstall malware bytes. I consistantly get an error:

Run-time error '372';

Failed to load control 'webbrowser' from ieframe.dll. Your version of ieframe may be outdated. Make sure you are using the version of the control that was provided with your application.

I get this when trying to install malware bytes normally, or even when I try and update/install using chameleon.

Another symptom of my infection is the inability to open shortcuts by double clicking on them. I also was running IE8, but I have noticed that since I have been infected, I appear to not have 8 installed...

I have run the dds program. Here are the logs. Any assistance would be appreciated. We have exhausted our normal ideas....

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 7.0.6000.16945

Run by Brian at 10:27:15 on 2013-04-02

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.867 [GMT -4:00]

.

AV: AVG Anti-Virus Business Edition 2013 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Anti-Virus Business Edition 2013 *Enabled*

FW: AVG Firewall *Disabled*

.

============== Running Processes ================

.

C:\WINDOWS\system32\brss01a.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\smartagent\bin\sprtsvc.exe

C:\Program Files\smartagent\bin\tgsrvc.exe

C:\Program Files\TightVNC\WinVNC.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE

C:\PROGRA~1\MI1933~1\OFFICE11\OUTLOOK.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\ADP\ws2000\ws2000.exe

C:\Program Files\ADP\ADP CTI Desktop\Adp_Telephony.exe

C:\Program Files\ADP\websuite TE\BZVT.EXE

C:\Program Files\ADP\webSuite TE\BZVBA.EXE

C:\Program Files\ADP\webSuite View\Client 4.5.222.0\sw9c.exe

C:\Program Files\ADP\webSuite TE\BZVT.EXE

C:\Program Files\ADP\webSuite TE\BZVBA.EXE

C:\Program Files\ADP\webSuite View\Client 4.5.222.0\sw9c.exe

C:\Program Files\ADP\webSuite TE\BZVT.EXE

C:\Program Files\ADP\webSuite TE\BZVBA.EXE

C:\Documents and Settings\Brian\My Documents\Downloads\mbam-chameleon-1.62.1.1000(1)\mbam-chameleon.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k imgsvc

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uSearch Page = hxxp://www.live.com

uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - c:\program files\windows live\toolbar\wltcore.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [WinVNC] "c:\program files\tightvnc\WinVNC.exe" -servicehelper

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AVG_UI] "c:\program files\avg\avg2013\avgui.exe" /TRAYONLY

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

uPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

Trusted Zone: adp.com

Trusted Zone: adpremotesupport.com

Trusted Zone: jmagroup.com

Trusted Zone: jmfamily.com

DPF: CM_AdvancedCAB - hxxps://www.gs.reyrey.com/common/ClientCheck/CM_AdvancedCAB.CAB

DPF: Launcher - hxxp://dealer.jmagroup.com/jmfsdpweb/content/cabs/launcher.cab

DPF: ReyScanCab - hxxps://www.gs.reyrey.com/clientdll/ReyScan.cab

DPF: websignAx - hxxps://www.gmacdealer.com/gmacgdp/gmacscripts/accountaccess/websignax.cab

DPF: {00906302-0F14-442C-B39C-275F61BC25BC} - file://d:\autorun\atSdaCfg.CAB

DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} - hxxp://dsra1he.ds.adp.com/sdccommon/download/tgctlsi.cab

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://dsra1he.ds.adp.com/sdccommon/download/tgctlcm.cab

DPF: {01118F00-3E00-11D2-8470-0060089874ED} - hxxp://dsra1he.ds.adp.com/sdccommon/download/ssrc.cab

DPF: {01119400-3E00-11D2-8470-0060089874ED} - hxxp://dsra1he.ds.adp.com/sdccommon/download/sprtctlln.cab

DPF: {061C4171-40E1-11D2-9311-0060979CAE91} - hxxp://207.186.35.1/paris/winjaxs/winjax.cab

DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} - hxxp://multiautomall.adpcrm.net./reports/cr/activexviewer92.cab

DPF: {4E8AEBE0-31A6-43B0-A429-748DB14A70A0} - file://d:\autorun\PC-CONFIG-CHECK.CAB

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1364862465375

DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} - hxxps://cp.ebizautos.com/scripts/aurigma/ImageUploader7.cab

DPF: {80017034-D4F8-410D-9B03-0E713C34CEAD} - hxxp://www.gmdealerpulse.com/ChartfxInt62/download/ChartFX.ComIEClient.Core.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CE840B8D-C389-4500-9ABB-24FBDB850F64} - hxxp://207.186.35.1/we/support/downloads/adpEIOSearcher.CAB

TCP: Interfaces\{ACB9D870-3C41-4DB4-A49F-5477E9F5CC28} : NameServer = 10.41.215.253,12.127.12.71

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\brian\application data\mozilla\firefox\profiles\ig9zvhbz.default\

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\microsoft silverlight\2.0.31005.0\npctrlui.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 55776]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2012-9-21 177376]

R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 94048]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 35552]

R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 179936]

R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 19936]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 159712]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 164832]

R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]

R2 avgfws;AVG Firewall;c:\program files\avg\avg2013\avgfws.exe [2012-12-10 1342024]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2012-11-16 5814904]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2012-10-22 196664]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2011-5-23 30944]

R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-4-2 35144]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-4-1 40776]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2011-5-23 30944]

.

=============== Created Last 30 ================

.

==================== Find3M ====================

.

2013-03-13 15:44:30 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-13 15:44:30 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-01-26 03:55:44 552448 ----a-w- c:\windows\system32\oleaut32.dll

2013-01-07 01:32:34 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-01-07 00:45:12 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-01-04 01:32:36 1876224 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 10:28:38.57 ===============

Attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 4/3/2009 12:32:29 PM

System Uptime: 4/2/2013 8:33:27 AM (2 hours ago)

.

Motherboard: Dell Inc. | | 0TP412

Processor: Intel® Core™2 Duo CPU E7300 @ 2.66GHz | CPU | 2659/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 74 GiB total, 46.599 GiB free.

D: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1222: 1/3/2013 11:55:23 AM - System Checkpoint

RP1223: 1/4/2013 11:57:46 AM - System Checkpoint

RP1224: 1/4/2013 8:46:15 PM - Software Distribution Service 3.0

RP1225: 1/7/2013 9:56:11 AM - System Checkpoint

RP1226: 1/8/2013 12:09:14 PM - System Checkpoint

RP1227: 1/9/2013 4:11:46 PM - System Checkpoint

RP1228: 1/9/2013 8:54:01 PM - Software Distribution Service 3.0

RP1229: 1/11/2013 12:02:13 PM - System Checkpoint

RP1230: 1/14/2013 1:30:39 PM - System Checkpoint

RP1231: 1/15/2013 2:50:16 PM - System Checkpoint

RP1232: 1/15/2013 7:50:46 PM - Software Distribution Service 3.0

RP1233: 1/17/2013 11:47:28 AM - System Checkpoint

RP1234: 1/18/2013 1:20:12 PM - System Checkpoint

RP1235: 1/21/2013 12:15:45 PM - System Checkpoint

RP1236: 1/22/2013 12:20:02 PM - System Checkpoint

RP1237: 1/23/2013 1:32:08 PM - System Checkpoint

RP1238: 1/24/2013 3:50:12 PM - System Checkpoint

RP1239: 1/25/2013 5:06:56 PM - System Checkpoint

RP1240: 1/28/2013 5:59:24 PM - System Checkpoint

RP1241: 1/30/2013 1:10:48 PM - System Checkpoint

RP1242: 1/31/2013 5:21:45 PM - System Checkpoint

RP1243: 2/1/2013 5:49:30 PM - System Checkpoint

RP1244: 2/4/2013 9:47:27 AM - System Checkpoint

RP1245: 2/5/2013 1:24:16 PM - System Checkpoint

RP1246: 2/6/2013 3:03:42 PM - System Checkpoint

RP1247: 2/7/2013 3:35:36 PM - System Checkpoint

RP1248: 2/8/2013 5:07:31 PM - System Checkpoint

RP1249: 2/11/2013 10:59:02 AM - System Checkpoint

RP1250: 2/12/2013 3:16:52 PM - System Checkpoint

RP1251: 2/13/2013 10:45:46 AM - Software Distribution Service 3.0

RP1252: 2/14/2013 2:51:25 PM - System Checkpoint

RP1253: 2/15/2013 4:57:38 PM - System Checkpoint

RP1254: 2/18/2013 2:45:04 PM - System Checkpoint

RP1255: 2/20/2013 8:27:45 AM - System Checkpoint

RP1256: 2/21/2013 10:17:51 AM - System Checkpoint

RP1257: 2/22/2013 12:38:03 PM - System Checkpoint

RP1258: 2/23/2013 12:41:48 PM - Installed AVG 2013

RP1259: 2/23/2013 12:41:59 PM - Removed AVG 2012

RP1260: 2/23/2013 12:42:31 PM - Installed AVG 2013

RP1261: 2/23/2013 12:45:02 PM - Removed AVG 2012

RP1262: 2/25/2013 12:03:31 PM - System Checkpoint

RP1263: 2/26/2013 3:06:46 PM - System Checkpoint

RP1264: 2/27/2013 4:50:58 PM - System Checkpoint

RP1265: 3/1/2013 11:16:00 AM - System Checkpoint

RP1266: 3/4/2013 10:28:23 AM - System Checkpoint

RP1267: 3/5/2013 11:41:12 AM - System Checkpoint

RP1268: 3/6/2013 12:38:21 PM - System Checkpoint

RP1269: 3/7/2013 12:42:29 PM - System Checkpoint

RP1270: 3/8/2013 12:47:38 PM - System Checkpoint

RP1271: 3/11/2013 2:52:46 PM - System Checkpoint

RP1272: 3/12/2013 3:48:23 PM - System Checkpoint

RP1273: 3/13/2013 4:55:03 PM - System Checkpoint

RP1274: 3/13/2013 7:35:38 PM - Software Distribution Service 3.0

RP1275: 3/14/2013 7:44:02 PM - System Checkpoint

RP1276: 3/18/2013 12:40:37 PM - System Checkpoint

RP1277: 3/19/2013 2:06:12 PM - System Checkpoint

RP1278: 3/20/2013 2:52:35 PM - System Checkpoint

RP1279: 3/21/2013 3:12:41 PM - System Checkpoint

RP1280: 3/21/2013 7:35:15 PM - Software Distribution Service 3.0

RP1281: 3/25/2013 1:02:07 PM - System Checkpoint

RP1282: 3/26/2013 3:47:27 PM - System Checkpoint

RP1283: 3/27/2013 7:50:38 PM - System Checkpoint

RP1284: 3/29/2013 8:48:37 AM - System Checkpoint

RP1285: 4/1/2013 10:47:00 AM - System Checkpoint

RP1286: 4/1/2013 6:22:52 PM - Removed ApproveIt Web Server - Client Software

RP1287: 4/1/2013 6:23:13 PM - Removed Atalasoft Components

RP1288: 4/1/2013 6:26:11 PM - Removed Bonjour

RP1289: 4/1/2013 6:28:10 PM - Removed NetAssistant

RP1290: 4/1/2013 7:09:59 PM - Restore Operation

RP1291: 4/1/2013 7:12:12 PM - Restore Operation

RP1292: 4/1/2013 8:38:20 PM - Installed Windows Internet Explorer 8.

.

==== Installed Programs ======================

.

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader 9.5.4

ADP CTI Desktop

ADP Service Connect Web Chat

ADP Software Install Agent

ADPSecProfile

Apple Mobile Device Support

Apple Software Update

AVG 2013

Broadcom ASF Management Applications

Broadcom Management Programs

Choice Guard

Compatibility Pack for the 2007 Office system

CRUFL wsFunctions

Crystal_11r2sp1

Dell ETS Factory Installation

FC_PR_Acct_Update_45

FC_PR_Service_Update_452

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB953955)

Hotfix for Windows XP (KB954434)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB954708)

Hotfix for Windows XP (KB958347)

Hotfix for Windows XP (KB959252)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB970653-v3)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

IBM iSeries Access for Windows

Intel® Matrix Storage Manager

Interlink Electronics ePad 7.54

iTunes

Java™ 6 Update 11

Junk Mail filter update

Lexmark Printer Software Uninstall

Lexmark Universal v2 Uninstaller

Malwarebytes Anti-Malware version 1.70.0.1100

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Application Error Reporting

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office Live Meeting 2007

Microsoft Office Professional Edition 2003

Microsoft Office Word Viewer 2003

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft WSE 2.0 SP3 Runtime

Mozilla Firefox 19.0.2 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser (KB927977)

NVIDIA Drivers

Octoshape add-in for Adobe Flash Player

PowerDVD

PR Accounting Update 45

PR CarInk Update 45

PR Parts Update 45

PR Sales Update 45

PR Service Update 45

psqlODBC

QuickTime

Reynolds ERALink

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB956390)

Security Update for Windows Internet Explorer 7 (KB961260)

Security Update for Windows Internet Explorer 7 (KB963027)

Security Update for Windows Internet Explorer 7 (KB969897)

Security Update for Windows Internet Explorer 7 (KB972260)

Security Update for Windows Internet Explorer 7 (KB974455)

Security Update for Windows Internet Explorer 7 (KB976325)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2491683)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2753842)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2778344)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2799494)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951698)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954211)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956391)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956841)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957095)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958215)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958690)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960714)

Security Update for Windows XP (KB960715)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961373)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969898)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Segoe UI

ShowCase Suite 8.0

ShowCase Suite Client Update

TightVNC 1.2.9

Uninstall Helper

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 7 (KB976749)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Update for Windows XP (KB898461)

Update for Windows XP (KB951618-v2)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

UUDeview for Windows

w.e.b.Suite 4.5 Managed Assemblies

w.e.b.Suite Launch Application

w.e.b.Suite Terminal Emulator 4.1.3.967

w.e.b.Suite Terminal Emulator VBA 4.1.3.952

w.e.b.Suite Terminal Emulator VBA Support

w.e.b.Suite View Client 4.5.193.0

w.e.b.Suite View Client 4.5.222.0

w.e.b.Suite2007 Preview

WebFldrs XP

webSuite PC CONFIG CONTROL

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 7

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Toolbar

Windows Live Upload Tool

Windows Live Writer

Windows Presentation Foundation

Windows Search 4.0

XML Paper Specification Shared Components Pack 1.0

.

==== Event Viewer Messages From Past Week ========

.

4/2/2013 10:27:19 AM, error: Service Control Manager [7016] - The BrSplService service has reported an invalid current state 0.

4/1/2013 7:17:41 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

4/1/2013 7:13:46 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AVGIDSDriver AVGIDSShim Avgldx86 Fips intelppm MRxSmb Rdbss

4/1/2013 7:13:46 PM, error: Service Control Manager [7023] - The Workstation service terminated with the following error: The system cannot find the file specified.

4/1/2013 7:13:46 PM, error: Service Control Manager [7023] - The Server service terminated with the following error: The system cannot find the file specified.

4/1/2013 7:13:46 PM, error: Service Control Manager [7001] - The Computer Browser service depends on the Workstation service which failed to start because of the following error: The system cannot find the file specified.

4/1/2013 7:13:46 PM, error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: A device attached to the system is not functioning.

4/1/2013 7:13:02 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

4/1/2013 7:05:23 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

4/1/2013 7:05:21 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

3/30/2013 2:47:29 PM, error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the Interface with IP address 10.41.215.50. The machine with the IP address 10.41.215.167 did not allow the name to be claimed by this machine.

3/30/2013 12:48:44 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

3/29/2013 10:15:56 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer DBTOAXYZ that believes that it is the master browser for the domain on transport NetBT_Tcpip_{ACB9D870-3C41-4DB4-. The master browser is stopping or an election is being forced.

.

==== End Of File ===========================

TheDarkKnight · April 2, 2013

:welcome: I am TheDarkKnight and will be assisting you. Please ask questions if anything is unclear.

Please follow these instructions to run ComboFix.exe. Please visit this webpage for download links and instructions for running this tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix (CF).

Please go here to see a list of programs that need to be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall.**

**Note 2: If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.**

Please include the C:\ComboFix.txt in your next reply for further review.

BrianLevy · April 2, 2013

Hi, and thanks for the help!!

I followed all instructions, but the first time I tried to run combofix, during the actually execution of the program (during the 'stages'), I got a BSOD (plug and play deteceted an error....etc...I do have the stop error copied down if needed). I restarted, and tried again, and it seemed to run.

I did try to open my IE window (forgot to mention in my original post the IE was also hosed...had to install mozilla to get this far), but it would not load any pages. I got an error saying that the page was unavailable.

Here is my combofix log:

ComboFix 13-04-02.01 - Brian 04/02/2013 17:06:12.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1569 [GMT -4:00]

Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe

AV: AVG Anti-Virus Business Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Anti-Virus Business Edition 2013 *Disabled* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Documents\CURRENT MONTH RECAP SUMMARY.xls~RF2405bab.TMP

c:\documents and settings\All Users\Documents\CURRENT MONTH RECAP SUMMARY.xls~RF24a2b24.TMP

c:\documents and settings\Brian\Local Settings\Application Data\assembly\tmp

c:\windows\system32\404Fix.exe

c:\windows\system32\Agent.OMZ.Fix.exe

c:\windows\system32\dumphive.exe

c:\windows\system32\IEDFix.C.exe

c:\windows\system32\IEDFix.exe

c:\windows\system32\o4Patch.exe

c:\windows\system32\Process.exe

c:\windows\system32\SrchSTS.exe

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\fusion.dll

c:\windows\system32\URTTemp\mscoree.dll

c:\windows\system32\URTTemp\mscoree.dll.local

c:\windows\system32\URTTemp\mscorsn.dll

c:\windows\system32\URTTemp\mscorwks.dll

c:\windows\system32\URTTemp\msvcr71.dll

c:\windows\system32\URTTemp\regtlib.exe

c:\windows\system32\VACFix.exe

c:\windows\system32\VCCLSID.exe

c:\windows\system32\WS2Fix.exe

.

c:\windows\system32\drivers\i8042prt.sys . . . is missing!!

.

((((((((((((((((((((((((( Files Created from 2013-03-02 to 2013-04-02 )))))))))))))))))))))))))))))))

.

2013-04-02 14:40 . 2013-04-02 14:40 -------- d-----w- C:\ae5f3ce45a70cf008edc40bd3a1a64

2013-04-02 14:19 . 2013-04-02 14:19 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-04-02 14:08 . 2013-04-02 14:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-04-02 14:08 . 2012-12-14 20:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-04-02 01:03 . 2013-04-02 01:03 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Mozilla

2013-04-02 01:01 . 2013-04-02 12:33 -------- d-----w- c:\program files\Mozilla Maintenance Service

2013-04-02 00:47 . 2013-04-02 00:54 -------- d-----w- C:\0f5ebfa42f3c2e16d2ae48b60e6651cf

2013-04-02 00:38 . 2009-10-29 07:46 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-04-02 00:38 . 2009-10-29 07:46 78336 ----a-w- c:\windows\system32\dllcache\ieencode.dll

2013-04-02 00:21 . 2013-04-02 00:21 -------- d-----w- c:\documents and settings\Backup

2013-04-01 23:18 . 2013-04-01 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\ClubSanDisk

2013-04-01 23:08 . 2013-04-01 23:08 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2013-04-01 23:08 . 2013-04-01 23:08 -------- d-----w- c:\documents and settings\Brian\Application Data\Yahoo!

2013-04-01 23:08 . 2013-04-01 23:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!

2013-04-01 22:31 . 2013-04-01 23:06 -------- d-----w- c:\documents and settings\Admin

2013-04-01 22:31 . 2013-04-02 21:04 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-04-01 22:21 . 2013-04-01 22:21 -------- d-----w- c:\program files\W3i

2013-04-01 22:21 . 2013-04-01 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\W3i

2013-04-01 22:21 . 2013-04-01 23:08 -------- d-----w- c:\program files\Yahoo!

2013-04-01 22:19 . 2013-04-01 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\APN

2013-03-21 19:06 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys

2013-03-21 19:06 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys

2013-03-14 21:49 . 2013-03-14 21:51 -------- d-----w- c:\windows\system32\NtmsData

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-13 15:44 . 2012-04-03 12:52 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-13 15:44 . 2011-05-20 11:59 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-02-12 00:32 . 2008-04-25 16:16 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-01-26 03:55 . 2008-04-25 16:16 552448 ----a-w- c:\windows\system32\oleaut32.dll

2013-01-07 01:32 . 2008-04-25 16:16 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-01-07 00:45 . 2008-04-14 00:01 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-01-04 01:32 . 2008-04-25 16:16 1876224 ----a-w- c:\windows\system32\win32k.sys

2013-03-07 14:31 . 2013-04-02 01:03 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WinVNC"="c:\program files\TightVNC\WinVNC.exe" [2003-08-01 474624]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-28 13578240]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-12-19 14:39 41208 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Check Version]

2005-06-08 09:30 45106 ----a-w- c:\program files\IBM\Client Access\cwbckver.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Express Welcome]

2005-06-08 09:30 20480 ----a-w- c:\program files\IBM\Client Access\cwbwlwiz.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Help Update]

2005-06-08 09:30 24626 ----a-w- c:\program files\IBM\Client Access\cwbinhlp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access PC5250 Sound]

2005-06-08 09:30 40960 ----a-w- c:\program files\IBM\Client Access\Emulator\pcssnd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Client Access Service]

2005-06-08 09:30 20530 ----a-w- c:\program files\IBM\Client Access\cwbsvstr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2007-10-03 20:44 178712 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-03-13 00:56 342312 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 17:42 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2008-12-03 03:41 3882312 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2008-10-28 02:07 13578240 ----a-w- c:\windows\system32\nvcpl.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]

2008-05-23 19:06 128296 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-01-05 20:18 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

2007-09-12 01:58 1015808 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-03-31 01:33 136600 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\ADP\\webSuite View\\Client 4.5.193.0\\SW9C.EXE"=

"c:\\Program Files\\Reynolds\\ERALink\\wIntegSM.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Common Files\\supportsoft\\bin\\sprtlisten.exe"=

"c:\\Program Files\\Common Files\\supportsoft\\bin\\ssrc.exe"=

"c:\\Program Files\\smartagent\\agent\\bin\\bcont.exe"=

"c:\\Program Files\\smartagent\\agent\\bin\\bcont_nm.exe"=

"c:\\Program Files\\smartagent\\bin\\sprtcmd.exe"=

"c:\\Program Files\\smartagent\\bin\\sprtsvc.exe"=

"c:\\Program Files\\smartagent\\bin\\tgshell.exe"=

"c:\\Program Files\\smartagent\\bin\\tgsrvc.exe"=

"c:\\Program Files\\ADP\\webSuite View\\Client 4.5.222.0\\SW9C.EXE"=

"c:\\Program Files\\Microsoft Office\\OFFICE11\\EXCEL.EXE"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG2013\\avgwdsvc.exe"=

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [4/19/2012 4:50 AM 55776]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 4:46 AM 177376]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/13/2011 6:30 AM 35552]

R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [12/23/2011 1:32 PM 179936]

R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [12/23/2011 1:32 PM 19936]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/7/2011 6:23 AM 159712]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [7/11/2011 1:14 AM 164832]

R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [6/20/2007 3:30 PM 79168]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 2:05 PM 196664]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [5/23/2011 1:03 AM 30944]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [4/1/2013 6:31 PM 40776]

S?2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/16/2012 12:34 AM 5814904]

S2 avgfws;AVG Firewall;c:\program files\AVG\AVG2013\avgfws.exe [12/10/2012 12:11 PM 1342024]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [4/2/2013 10:08 AM 398184]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [4/2/2013 10:08 AM 682344]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [5/23/2011 1:03 AM 30944]

S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [4/2/2013 10:19 AM 35144]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [4/2/2013 10:08 AM 21104]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMPROTECTOR

*NewlyCreated* - MBAMSCHEDULER

*NewlyCreated* - MBAMSERVICE

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2013-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-03 15:44]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

Trusted Zone: adp.com

Trusted Zone: adp.com\*.ds

Trusted Zone: adp.com\dsra1he.ds

Trusted Zone: adp.com\dsrac1he.ds

Trusted Zone: adp.com\dssda1he.ds

Trusted Zone: adp.com\dssda2he.ds

Trusted Zone: adpcrm.net.\multiautomall

Trusted Zone: adpremotesupport.com

Trusted Zone: adpremotesupport.com\www

Trusted Zone: autopartners.net\www

Trusted Zone: dmotorworks.com\www

Trusted Zone: ebizautos.com\cp

Trusted Zone: jmagroup.com

Trusted Zone: jmfamily.com

Trusted Zone: reyrey.com\www.gs

Trusted Zone: yahoo.com\www

TCP: Interfaces\{ACB9D870-3C41-4DB4-A49F-5477E9F5CC28}: NameServer = 10.41.215.253,12.127.12.71