Infected with Searchou.. Please help!

Maineiac86 · April 10, 2013

My system is infected with Searchou.. I noticed the numerous posts on here regarding its removal but it seems as though each case is slightly different. I'm not sure where I should begin to try to remove this. Can someone help me through the removal process? Thank you!

gringo_pr · April 10, 2013

Hello Maineiac86

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I need to get some reports to get a base to start from so I need you to run these programs first.

-DeFogger-

Please download

DeFogger to your desktop.
Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-Download DDS-

Please download DDS from one of the links below and save it to your desktop:

Download DDS and save it to your desktop

Link1
Link2
Link3

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
[*]A window will open instructing you save & post the logs
[*]Save the logs to a convenient place such as your desktop
[*]Copy the contents of both logs & post in your next reply

information and logs

In your next post I need the following

both reports from DDS
report from security check
let me know of any problems you may have had

Gringo

Maineiac86 · April 10, 2013

No problems or changes so far.

Results of screen317's Security Check version 0.99.62

Windows XP Service Pack 3 x86

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

avast! Antivirus

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

SUPERAntiSpyware

JavaFX 2.1.1

Java 6 Update 24

Java 7 Update 9

Java version out of Date!

Adobe Flash Player 10 Flash Player out of Date!

Adobe Flash Player 11.6.602.180

Adobe Reader 9

Adobe Reader XI

Google Chrome 25.0.1364.172

Google Chrome 26.0.1410.43

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 7%

````````````````````End of Log``````````````````````

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 8/16/2009 2:02:18 PM

System Uptime: 4/10/2013 1:01:48 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0CT017

Processor: Intel® Core2 CPU 6700 @ 2.66GHz | Microprocessor | 2659/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 149 GiB total, 41.775 GiB free.

D: is CDROM ()

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}

Description: IDT High Definition Audio CODEC

Device ID: HDAUDIO\FUNC_01&VEN_8384&DEV_7618&SUBSYS_102801DB&REV_1002\4&329F3825&0&0201

Manufacturer: IDT

Name: IDT High Definition Audio CODEC

PNP Device ID: HDAUDIO\FUNC_01&VEN_8384&DEV_7618&SUBSYS_102801DB&REV_1002\4&329F3825&0&0201

Service: STHDA

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: 1394 Net Adapter

Device ID: V1394\NIC1394\5114033523C01

Manufacturer: Microsoft

Name: 1394 Net Adapter

PNP Device ID: V1394\NIC1394\5114033523C01

Service: NIC1394

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Hamachi Network Interface

Device ID: ROOT\NET\0000

Manufacturer: LogMeIn, Inc.

Name: Hamachi Network Interface

PNP Device ID: ROOT\NET\0000

Service: hamachi

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

µTorrent

Acrobat.com

Adobe AIR

Adobe Community Help

Adobe Download Assistant

Adobe Flash Player 10 ActiveX

Adobe Flash Player 11 Plugin

Adobe Photoshop CS5.1

Adobe Reader XI (11.0.02)

Aerosoft's - F-16 Fighting Falcon

Airbus Series 2 - Evolution Full (FSX)

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Artisteer 3

Avro Tudor for FSX

Beech B60 Duke Rip

Beechcraft Bonanza V35 For FS2004

Bonjour

Bullzip PDF Printer 9.5.0.1579

BVATC's AFCAD (Scenery) Enhancement

Carenado's Beechcraft Mentor T34B FSX

Carenado's C SKYLANE II RG R182

Carenado's SKYLANE C182Q FSX

Carenado C152II FSX

Carenado C185F SKYWAGON FSX

Carenado C206 Stationair FSX (Regular, Cargo & Float)

Carenado PA28-181 ARCHER II FSX

Carenado PA28RT 201 Arrow IV FSX

Carenado PA32 SARATOGA SP FSX

Carenado PA34 200T SENECA II FSX

Carenado Piper Cherokee FSX

Citation X for FSX

Company of Heroes

Company of Heroes - FAKEMSI

Compatibility Pack for the 2007 Office system

Conexant D850 56K V.9x DFVc Modem

Creative Audio Console

Creative Software AutoUpdate

CRJ Experience

CRJ New Generation

DAEMON Tools Toolbar

Dodosim 206 for FSX

E-jets Virtual : Embraer 170 FSX

E-jets Virtual : Embraer 175 FSX

E-jets Virtual : Embraer 190 FSX

E-jets Virtual : Embraer 195 FSX

Eaglesoft Development Group Citation CII 1.5

EPSON Printer Software

FeelThere ERJ v.2 SP2

Flight 1 Software Cessna 441fsx - Conquest II 2.3

Flight One Software Pilatus PC-12 fsx

Flight Replicas Super Cub - Complete for FSX

Flight Simulator X

Flight Simulator X Service Pack 1

Flight Test 4.0

Flight1 Citation Mustang

FlightDesk12

Google Chrome

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Inkscape 0.48.4

Intel® PRO Network Connections Drivers

iTunes

Java 7 Update 9

Java Auto Updater

Java 6 Update 24

JavaFX 2.1.1

KBOS v1.1.2 for FSX

Live ATIS

LogMeIn Hamachi

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Flight Simulator X

Microsoft Flight Simulator X Service Pack 1

Microsoft Flight Simulator X: Acceleration

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft Office File Validation Add-In

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft_VC80_ATL_x86

Microsoft_VC80_CRT_x86

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFCLOC_x86

Microsoft_VC90_ATL_x86

Microsoft_VC90_CRT_x86

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFCLOC_x86

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

Nemeth Designs Bell UH-1 Huey for Microsoft Flight Simulator X

NVIDIA Drivers

NVIDIA Performance

NVIDIA System Monitor

NVIDIA System Update

P-51D Mustang v1.2

PDF Settings CS5

Plugin 7

PMDG 747-400/400F for FSX

QuickTime

Replay Media Catcher 3.02

SBD Dauntless FSX

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2792100)

Security Update for Windows Internet Explorer 8 (KB2797052)

Security Update for Windows Internet Explorer 8 (KB2809289)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2753842)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2778344)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2799494)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371-v2)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972260)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

Spelling Dictionaries Support For Adobe Reader 9

SUPERAntiSpyware

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Update for Windows XP (KB943729)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VLC media player 1.1.5

WebFldrs XP

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Live ID Sign-in Assistant

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

Wings of POWER II: P51 Mustang

WinRAR archiver

WSSimulation-Piper PA-44 Seminole

Yahoo! Detect

.

==== Event Viewer Messages From Past Week ========

.

4/4/2013 10:57:54 AM, error: Dhcp [1002] - The IP address lease 192.168.2.106 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.1.251 (The DHCP Server sent a DHCPNACK message).

4/4/2013 10:53:11 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0019D193F37C. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

4/4/2013 10:51:39 AM, error: Dhcp [1002] - The IP address lease 192.168.2.104 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.1.251 (The DHCP Server sent a DHCPNACK message).

4/4/2013 10:51:30 AM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.2.104 with the system having network hardware address 64:E6:82:E0:CA:FC. Network operations on this system may be disrupted as a result.

4/4/2013 10:49:19 AM, error: Service Control Manager [7024] - The Messenger service terminated with service-specific error 2270 (0x8DE).

4/4/2013 10:46:13 AM, error: Dhcp [1002] - The IP address lease 192.168.2.100 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.1.251 (The DHCP Server sent a DHCPNACK message).

4/3/2013 3:20:57 PM, error: Dhcp [1002] - The IP address lease 192.168.2.101 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.1.251 (The DHCP Server sent a DHCPNACK message).

4/3/2013 10:03:07 AM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/3/2013 10:02:26 AM, error: Dhcp [1002] - The IP address lease 192.168.2.102 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.1.251 (The DHCP Server sent a DHCPNACK message).

4/10/2013 9:51:04 AM, error: UPS [2481] - The UPS service is not configured correctly.

4/10/2013 9:51:04 AM, error: Service Control Manager [7023] - The Windows Driver Foundation - User-mode Driver Framework service terminated with the following error: A device attached to the system is not functioning.

4/10/2013 9:51:04 AM, error: Service Control Manager [7023] - The Uninterruptible Power Supply service terminated with the following error: %%2481

4/10/2013 9:51:03 AM, error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.

4/10/2013 9:51:01 AM, error: Dhcp [1002] - The IP address lease 192.168.2.102 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/10/2013 9:50:51 AM, error: Dhcp [1002] - The IP address lease 192.168.2.101 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/10/2013 9:36:12 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).

4/10/2013 10:24:03 AM, error: Dhcp [1002] - The IP address lease 192.168.2.106 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/10/2013 10:23:53 AM, error: Dhcp [1002] - The IP address lease 192.168.2.105 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/10/2013 1:02:31 PM, error: Dhcp [1002] - The IP address lease 192.168.2.108 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

4/10/2013 1:02:21 PM, error: Dhcp [1002] - The IP address lease 192.168.2.107 for the Network Card with network address 0019D193F37C has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2

Run by Dave at 13:07:39 on 2013-04-10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2814.2143 [GMT -4:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ================

.

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Creative\Shared Files\CTAudSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\netdde.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\dlcccoms.exe

C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

C:\Program Files\Java\jre7\bin\jqs.exe

c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe

C:\WINDOWS\system32\locator.exe

C:\WINDOWS\System32\vssvc.exe

C:\WINDOWS\System32\dmadmin.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Dave\Desktop\SecurityCheck.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k eapsvcs

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://searchou.com/?id=ec55c92c0000000000000019d193f37c

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k

mRun: [iDTSysTrayApp] sttray.exe

mRun: [CTHelper] CTHELPER.EXE

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [AdobeCS5.5ServiceManager] "c:\program files\common files\adobe\cs5.5servicemanager\CS5.5ServiceManager.exe" -launchedbylogin

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,_RunDLLEntry@16

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1306617074416

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1352322896375

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.2.1

TCP: Interfaces\{20C5B121-6406-4A23-BF37-A9B421F784FF} : DHCPNameServer = 192.168.2.1

AppInit_DLLs=

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.43\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-11 116608]

R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352]

R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032]

R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296]

R3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\drivers\nvoclock.sys [2009-9-15 38248]

S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-6-23 99352]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\common files\creative labs shared\service\CTAELicensing.exe [2009-8-16 79360]

S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-6-23 555032]

S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888]

S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-6-23 100888]

S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-6-23 566296]

S3 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2012-8-29 1385896]

S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [2012-7-28 97552]

S3 mv2;mv2;c:\windows\system32\drivers\mv2.sys [2011-12-18 11496]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

.

=============== Created Last 30 ================

.

2013-04-09 18:26:50 -------- d-----w- c:\program files\uTorrent

2013-04-09 18:19:30 -------- d-----w- c:\documents and settings\all users\application data\CLSoft LTD

2013-04-09 18:19:24 -------- d-----w- c:\documents and settings\all users\application data\MyaagniPPicc

2013-04-09 18:19:19 -------- d-----w- c:\documents and settings\all users\application data\InstallMate

2013-03-14 13:42:50 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys

2013-03-14 13:42:50 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys

.

==================== Find3M ====================

.

2013-04-01 20:18:47 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll

2013-04-01 20:18:47 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe

2013-04-01 20:18:45 323584 ----a-w- c:\windows\system32\AUDIOGENIE2.DLL

2013-03-14 14:20:41 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-03-14 14:20:41 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-02-20 08:12:50 200192 ----a-w- c:\windows\system32\bzpdf.dll

2013-02-20 08:12:50 139264 ----a-w- c:\windows\system32\bzpdfc.dll

2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-02-12 00:32:23 12928 ------w- c:\windows\system32\drivers\usb8023x.sys

2013-02-05 20:05:47 916480 ----a-w- c:\windows\system32\wininet.dll

2013-02-05 20:05:46 43520 ----a-w- c:\windows\system32\licmgr10.dll

2013-02-05 20:05:46 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2013-02-05 05:53:57 385024 ----a-w- c:\windows\system32\html.iec

2013-01-26 03:55:44 552448 ----a-w- c:\windows\system32\oleaut32.dll

.

============= FINISH: 13:08:46.59 ===============

gringo_pr · April 10, 2013

Hello Maineiac86

These are the programs I would like you to run next, if you have any problems with these just skip it and move on to the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

Maineiac86 · April 10, 2013

# AdwCleaner v2.200 - Logfile created 04/10/2013 at 13:32:09

# Updated 02/04/2013 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : Dave - SUNNYVAL-069CDB

# Boot Mode : Normal

# Running from : C:\Documents and Settings\Dave\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\clsoft ltd

Folder Deleted : C:\Documents and Settings\All Users\Application Data\InstallMate

Folder Deleted : C:\Program Files\DAEMON Tools Toolbar

Folder Deleted : C:\Program Files\Smartdl

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\SProtector

Key Deleted : HKCU\Software\StartSearch

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\Software\SP Global

Key Deleted : HKLM\Software\SProtector

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

-\\ Google Chrome v26.0.1410.43

File : C:\Documents and Settings\Dave\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [1363 octets] - [10/04/2013 13:32:09]

########## EOF - C:\AdwCleaner[s1].txt - [1423 octets] ##########

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Dave [Admin rights]

Mode : Scan -- Date : 04/10/2013 13:39:03

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ] HKLM\[...]\SystemRestore : DisableSR (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost

127.0.0.1 activate.adobe.com

127.0.0.1 3dns-3.adobe.com

127.0.0.1 adobe-dns-2.adobe.com

127.0.0.1 adobe-dns-3.adobe.com

127.0.0.1 ereg.wip3.adobe.com

127.0.0.1 activate-sea.adobe.com

127.0.0.1 wip3.adobe.com

127.0.0.1 wwis-dubc1-vip60.adobe.com

127.0.0.1 activate-sjc0.adobe.com

127.0.0.1 practivate.adobe.com

127.0.0.1 ereg.adobe.com

127.0.0.1 activate.wip3.adobe.com

127.0.0.1 3dns-2.adobe.com

127.0.0.1 adobe-dns.adobe.com

::1 localhost

127.0.0.1 serials.wilcopub.com

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD161HJ +++++

--- User ---

[MBR] e495ce44b48cb2bd251f9774df0b86de

[bSP] 87e75d55d10be7ca14d3baedb3fb2574 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 152578 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_04102013_02d1339.txt >>

RKreport[1]_S_04102013_02d1339.txt

gringo_pr · April 10, 2013

Hello Maineiac86

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

Maineiac86 · April 11, 2013

ComboFix 13-04-10.02 - Dave 04/10/2013 23:19:08.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2814.2140 [GMT -4:00]

Running from: c:\documents and settings\Dave\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\SPL632.tmp

c:\documents and settings\Dave\Application Data\Roaming

c:\documents and settings\Dave\Application Data\Roaming\Quest3D\ShipSimExtreme\channels.lst

c:\documents and settings\Dave\g2mdlhlpx.exe

C:\install.exe

c:\windows\EventSystem.log

c:\windows\Help\nvcpru.hlp-nv31340

c:\windows\Help\nvcpsk.hlp-nv31340

c:\windows\Help\nvcpsl.hlp-nv31340

c:\windows\Help\nvcpsv.hlp-nv31340

c:\windows\Help\nvcpth.hlp-nv31340

c:\windows\Help\nvcptr.hlp-nv31340

c:\windows\Help\nvcpzhc.hlp-nv31340

c:\windows\Help\nvcpzht.hlp-nv31340

c:\windows\iun6002.exe

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\fusion.dll

c:\windows\system32\URTTemp\mscoree.dll

c:\windows\system32\URTTemp\mscoree.dll.local

c:\windows\system32\URTTemp\mscorsn.dll

c:\windows\system32\URTTemp\mscorwks.dll

c:\windows\system32\URTTemp\msvcr71.dll

c:\windows\system32\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2013-03-11 to 2013-04-11 )))))))))))))))))))))))))))))))

.

2013-04-11 03:12 . 2013-03-06 22:33 29816 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2013-04-11 03:12 . 2013-03-06 22:33 368176 ----a-w- c:\windows\system32\drivers\aswSP.sys

2013-04-11 03:12 . 2013-03-06 22:33 62376 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2013-04-11 03:12 . 2013-03-06 22:33 49760 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2013-04-11 03:12 . 2013-03-06 22:33 765736 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2013-04-11 03:12 . 2013-03-06 22:33 49248 ----a-w- c:\windows\system32\drivers\aswRvrt.sys

2013-04-11 03:12 . 2013-03-06 22:33 164736 ----a-w- c:\windows\system32\drivers\aswVmm.sys

2013-04-11 03:12 . 2013-03-06 22:33 66336 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

2013-04-11 03:12 . 2013-03-06 22:32 228600 ----a-w- c:\windows\system32\aswBoot.exe

2013-04-11 03:11 . 2013-03-06 22:32 41664 ----a-w- c:\windows\avastSS.scr

2013-04-11 03:11 . 2013-04-11 03:11 -------- d-----w- c:\program files\AVAST Software

2013-04-10 13:33 . 2013-04-10 13:33 -------- d-----w- c:\documents and settings\Dave\Application Data\dvdcss

2013-04-09 18:26 . 2013-04-09 18:26 -------- d-----w- c:\program files\uTorrent

2013-04-09 18:19 . 2013-04-09 18:20 -------- d-----w- c:\documents and settings\All Users\Application Data\MyaagniPPicc

2013-03-14 13:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023x.sys

2013-03-14 13:42 . 2013-02-12 00:32 12928 -c----w- c:\windows\system32\dllcache\usb8023.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-01 20:18 . 2009-09-13 02:53 237568 ----a-w- c:\windows\system32\rmc_rtspdl.dll

2013-04-01 20:18 . 2009-09-13 02:53 156672 ----a-w- c:\windows\system32\rmc_fixasf.exe

2013-04-01 20:18 . 2009-09-13 02:51 323584 ----a-w- c:\windows\system32\AUDIOGENIE2.DLL

2013-03-14 14:20 . 2012-07-16 19:22 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-03-14 14:20 . 2011-08-28 19:53 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-02-20 08:12 . 2012-03-28 04:04 139264 ----a-w- c:\windows\system32\bzpdfc.dll

2013-02-20 08:12 . 2012-03-28 04:04 200192 ----a-w- c:\windows\system32\bzpdf.dll

2013-02-12 00:32 . 2008-04-13 18:56 12928 ------w- c:\windows\system32\drivers\usb8023x.sys

2013-02-12 00:32 . 2004-08-04 12:00 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-02-05 20:05 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2013-02-05 20:05 . 2004-08-04 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2013-02-05 20:05 . 2004-08-04 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2013-02-05 05:53 . 2004-08-04 12:00 385024 ----a-w- c:\windows\system32\html.iec

2013-01-26 03:55 . 2004-08-04 12:00 552448 ----a-w- c:\windows\system32\oleaut32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2013-03-06 22:32 121968 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"nwiz"="nwiz.exe" [2009-01-15 1657376]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"IDTSysTrayApp"="sttray.exe" [2007-09-06 405504]

"CTHelper"="CTHELPER.EXE" [2007-04-09 19456]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"AdobeCS5.5ServiceManager"="c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]

"DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2006-02-24 73728]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-06-07 23:33 421776 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]

2012-08-29 16:03 1996200 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"iPod Service"=3 (0x3)

"SwitchBoard"=3 (0x3)

"STacSV"=2 (0x2)

"ose"=3 (0x3)

"Apple Mobile Device"=3 (0x3)

"AdobeFlashPlayerUpdateSvc"=3 (0x3)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\WINDOWS\\system32\\dlcccoms.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Documents and Settings\\Dave\\Desktop\\Company of Heros\\RelicCOH.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe\\uTorrent.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5900:TCP"= 5900:TCP:vnc5900

"5800:TCP"= 5800:TCP:vnc5800

.

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/10/2013 11:12 PM 368176]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [7/11/2012 2:54 PM 116608]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/10/2013 11:12 PM 29816]

R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [4/10/2013 11:12 PM 66336]

R3 aswVmm;aswVmm;c:\windows\system32\drivers\aswVmm.sys [4/10/2013 11:12 PM 164736]

R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [6/23/2009 1:34 PM 99352]

R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [6/23/2009 1:34 PM 555032]

R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [6/23/2009 1:34 PM 566296]

R3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\drivers\nvoclock.sys [9/15/2009 2:59 PM 38248]

S0 aswRvrt;aswRvrt;c:\windows\system32\drivers\aswRvrt.sys [4/10/2013 11:12 PM 49248]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [4/10/2013 11:12 PM 765736]

S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [6/23/2009 1:34 PM 99352]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [8/16/2009 2:18 PM 79360]

S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [6/23/2009 1:34 PM 555032]

S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [6/23/2009 1:35 PM 100888]

S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [6/23/2009 1:35 PM 100888]

S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [6/23/2009 1:34 PM 566296]

S3 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [8/29/2012 12:03 PM 1385896]

S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [7/28/2012 8:56 AM 97552]

S3 mv2;mv2;c:\windows\system32\drivers\mv2.sys [12/18/2011 2:06 PM 11496]

S3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2/19/2010 1:37 PM 517096]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [9/1/2009 10:04 PM 721904]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - ASWMONFLT

*NewlyCreated* - ASWVMM

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-01 20:31 1642448 ----a-w- c:\program files\Google\Chrome\Application\26.0.1410.43\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-04-11 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-16 14:20]

.

2013-04-10 c:\windows\Tasks\AdobeAAMUpdater-1.0-SUNNYVAL-069CDB-Dave.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2012-09-20 11:27]

.

2013-04-06 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]

.

2013-04-11 c:\windows\Tasks\avast! Emergency Update.job

- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-04-11 22:32]

.

2013-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-16 20:19]

.

2013-04-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2013-02-16 20:19]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://searchou.com/?id=ec55c92c0000000000000019d193f37c

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-Desktop Software - c:\program files\Common Files\SupportSoft\bin\bcont.exe

MSConfigStartUp-Steam - c:\program files\Steam\steam.exe

AddRemove-441_conquestfsx - c:\windows\iun6002.exe

AddRemove-Company of Heroes - c:\program files\THQ\Company of Heroes\\Uninstall_English.exe

AddRemove-CRJ Experience - c:\program files\CRJ Experience\Uninstal.exe

AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe

AddRemove-pc12_FSX - c:\windows\iun6002.exe

AddRemove-{A2CC5727-7390-43A3-8F80-5F4D64BDB772}_is1 - c:\flight test\unins000.exe

AddRemove-{F16247B8-CD07-40C4-8C96-FC2568G29E8F}}_is1 - c:\program files\Plugin\unins000.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-04-10 23:23

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

DLCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1482476501-706699826-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:a2,63,ce,d2,fe,a9,50,5d,8a,6c,d1,ec,bc,91,e7,48,d8,20,3d,b8,13,47,fe,

6d,bc,51,26,b7,9f,4c,c4,4a,6f,bb,c7,81,48,42,53,9c,06,c9,c7,4a,e9,bd,1c,94,\

"??"=hex:e0,73,96,42,f4,f2,2b,92,17,8f,7d,60,a1,56,39,35

.

[HKEY_USERS\S-1-5-21-1482476501-706699826-725345543-1003\Software\SecuROM\License information*]

"datasecu"=hex:a6,80,11,d9,07,af,54,5e,35,b9,be,bc,20,b3,9c,9e,ab,50,f9,9e,b7,

77,2e,d8,78,5e,ca,c3,cc,fd,23,92,82,bc,80,89,8e,e7,79,bb,33,56,c4,4c,21,7b,\

"rkeysecu"=hex:8d,cc,ac,e5,a2,61,b3,be,86,a5,55,ce,b8,2c,a8,5e

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG14.00.00.01PROFESSIONAL"="010329292F370EB7809A642B61ED884C1E1549069DA4BFC2516FC7B96736F081161C3A1D1511E7538FB8528D3596F2042B8715777C3BEC4BDD47F128CB84D38D6FCDD7F241CE6E62567C67265AE87EF71B00B1CF27779138DDDE894F0D314C4D57D85AC097E856E3761F1EA75D6254540D4CD97BF17AE482873629FAE524C1A53A155FCC5CACDC4B38EAB6F42DD41D383F4A0C9E153D2318B464312A7919A0F1AB6B4714BCB93BFD853E30AA9DE687B995EF0C8FAC898C585F9246904C9E5B01E05A38C74584B658ED8D53146591C65E18446058B97EE2192AFC511648996413B3F39BCCE75792A9245F29B3A1A391A3F2E5D4B7A18EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E6678EDD5E5BE2F6E6679DB7CE019D40AA5CE24633DA3BF1F436935A6656DD5938C8DC21918A7E103B62CF881B369C7E1F17CC97ED1111885EFBFC8AA85011934251DBBBD577B8DB5D7D49E8B276AD9729CD3037901AC8E8A1984091BAD0D7A9F69F33D8F1356DF7D447A15D77F2BB1FB0A46A2A2776834D3054AA26A0E91691159CC179858CE0B74771E95440CB8B6965B0DD6DDEB7292260C50EEE81C572F43B88EA93505A1AA1BDFD37AD0531A6F6D65AEE708C076188705C4208AA1F58B36D77180FB511E672A647A142646A5A827CDD0993261E9CD6FDD9A2820AC675DE95CC3249C0B45599D176C5DBA1D0B678B2CD19B046CC8C968C540C61B520BE3F00C5AB931E5F3BB9760D4536A15492F7358C1011AC76A68504B4629CE3A5EACC5C7175329DBDAF2BAB5E4485ECF505D728D3E4F43B12A515AFB80BA170E173B7BEB08ADE35128F79F012EA6EB34D6D1F9031100E792C866A3E72724DDC751BE1A03BE3C5FC307BE326A4658C4603EA0A5A048F0412E10DDE444885F74C94E0E15D1C81893282D5DD12E365EC9B56E38A5203E4F1D3E73E003873386606888E03B6B2E83EB586C810DD7620114D1881C2AC3596E63206E490760201D5762BAEC2CFB01FEB8CCCBE5316514EEE9831308EFEF72D66C3968E843D54D9762D709154B09C3212607B693AAB41A972DF1A2277437CB6E5C3080E06312242EBDED8C71DC7D12F9FFBC9BB06F5E676F729614BBF5846C55290DE79F2D775BBCD62FEA93963FEAC7AD2076E30AD3677529E29E5DA8030EE89ADB2AA5C1FA84EA8340F5377B9A740FAF614FC626FF4F5470DA8EDF2E1E44CDEC02E4008D3F183FD75C72357E02206EEA4E5A8FD3E403E9068A8A56207E67A1A96111B6F2CD46A3F677F3C92D7189D973586F594FC0820DB448911BBDE891DF49B2EE2403DAA96D5739C8513FD8AAB28AC912BEE7610724C5C3BFAC13CF6579E65EB015B82229C1D269CAAF517C9D6CBAE39D509586F8BF6"

.

Completion time: 2013-04-10 23:24:47

ComboFix-quarantined-files.txt 2013-04-11 03:24

.

Pre-Run: 43,890,077,696 bytes free

Post-Run: 47,995,031,552 bytes free

.

- - End Of File - - 53FE2853DF9BB652886F80E392A841EA

Received an error report while Combofix was running that PEV encountered a fatal error.

Otherwise, computer seems to be running alright..

gringo_pr · April 11, 2013

Hello Maineiac86

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Folder::
c:\documents and settings\All Users\Application Data\MyaagniPPicc

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

Maineiac86 · April 11, 2013

ComboFix 13-04-10.02 - Dave 04/11/2013 9:53.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2814.2204 [GMT -4:00]

Running from: c:\documents and settings\Dave\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\MyaagniPPicc

c:\documents and settings\All Users\Application Data\MyaagniPPicc\5164644526231.dll

c:\documents and settings\All Users\Application Data\MyaagniPPicc\5164644526231.tlb

c:\documents and settings\All Users\Application Data\MyaagniPPicc\settings.ini