Cannot delete registry and infected files

Geraldg · May 25, 2009

Attached to this post will be a zip that when opened you will have 2 files , avenger.exe and script.txt .
Run avenger (click OK) .
Open script , select edit , select all , edit , copy .
Click on avenger , right click within the white space and select paste .
Check the box for "Automatically disable any rootkits found" and then click execute .
You will be asked Are you sure you want to execute the current script ? Click Yes .
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now ? Click Yes .
Your system will reboot and then reboot a second time on its own , this is normal .
After the second reboot you should see a log , please post this .
Also run an additional MBAM scan now and post the results .

OK - running it now - will post after 2nd reboot.

Geraldg · May 25, 2009

Attached to this post will be a zip that when opened you will have 2 files , avenger.exe and script.txt .
Run avenger (click OK) .
Open script , select edit , select all , edit , copy .
Click on avenger , right click within the white space and select paste .
Check the box for "Automatically disable any rootkits found" and then click execute .
You will be asked Are you sure you want to execute the current script ? Click Yes .
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now ? Click Yes .
Your system will reboot and then reboot a second time on its own , this is normal .
After the second reboot you should see a log , please post this .
Also run an additional MBAM scan now and post the results .

Well - I did not get a log file after the second reboot from Avenger.

There was a quick windows error pop-up after the first reboot and just before

the 2nd, but it was only there a second and I could not read it.

I launched avenger, and looked under the File menu to Open log file - and

it said none was there.

These files are still here -

c:\WINDOWS\system32\gzctcln.dll

C:\WINDOWS\system32\zzyxuadt.dll

C:\WINDOWS\system32\snqsald.dll

C:\WINDOWS\system32\drivers\gbazremn.sys

C:\WINDOWS\system32\drivers\oextoccj.sys

These files are not found -

c:\windows\system32\drivers\sbqlc.sys

c:\windows\system32\drivers\shxpk.sys

As soon as I launch Windows explorer - IE also launches (just the process in Task Manager,

not the actual IE window). This is the same problem I've been seeing all along.

I don't think the Avenger tool did anything....

Here's the malwarebytes log I just ran -

Malwarebytes' Anti-Malware 1.36

Database version: 2176

Windows 5.1.2600 Service Pack 3

5/24/2009 10:45:15 PM

mbam-log-2009-05-24 (22-45-15).txt

Scan type: Quick Scan

Objects scanned: 94000

Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 8

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92981def-ab3f-4851-ad17-8c45ef7e59be} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\owvvixks (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{92981def-ab3f-4851-ad17-8c45ef7e59be} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rxdejhum (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\rxdejhum (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rxdejhum (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{92981def-ab3f-4851-ad17-8c45ef7e59be} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\gzctcln.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\snqsald.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\zzyxuadt.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\drivers\gbazremn.sys (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\drivers\oextoccj.sys (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

nosirrah · May 25, 2009

I am getting very short on time and have asked another expert to check over your logs .

Geraldg · May 25, 2009

I am getting very short on time and have asked another expert to check over your logs .

OK Bruce - I really appreciate all your efforts tonight!

It's getting late here too (11pm). I'll check back tomorrow for any updates.

I hope we can get this resolved.

Thanks!

Geraldg · May 25, 2009

Attached to this post will be a zip that when opened you will have 2 files , avenger.exe and script.txt .
Run avenger (click OK) .
Open script , select edit , select all , edit , copy .
Click on avenger , right click within the white space and select paste .
Check the box for "Automatically disable any rootkits found" and then click execute .
You will be asked Are you sure you want to execute the current script ? Click Yes .
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now ? Click Yes .
Your system will reboot and then reboot a second time on its own , this is normal .
After the second reboot you should see a log , please post this .
Also run an additional MBAM scan now and post the results .

So, after the first reboot, when Avenger is supposed to do it's work, this is the quick

dialog box I get -

"A problem is preventing windows from accurately checking the license for this computer. Error code:"

I couldn't see the error code - the display went away too fast to do the 2nd reboot.

Geraldg · May 25, 2009

I am getting very short on time and have asked another expert to check over your logs .

I should also point out that I used to be running Norton Internet Security 2009 on this

PC until this past Friday (when I encountered the problem). I removed NIS 2009

and installed the free AVG product (on advice from a PC expert). In either case,

NIS and AVG have been hit-or-miss in finding some of what malware is finding.

Geraldg · May 25, 2009

Well - now my computer does a spontaneous reboot on it's own...

sjpritch25 · May 25, 2009

Geraldg,

I'll step in for nossirah

Download Combofix from this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

Note:

Do not mouseclick combofix's window while it's running. That may cause it to stall

Geraldg · May 26, 2009

Geraldg,
I'll step in for nossirah
Download Combofix from this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
**Note: It is important that it is saved directly to your desktop**
--------------------------------------------------------------------
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
--------------------------------------------------------------------
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Thanks for the reply!

So - I launch ComboFix. It says that "antivirus: Norton Internet Security" is running.

But - I uninstalled this a couple days ago and only have AVG Free running.

How to I tell ComboFix that NIS is really not running (or installed for that matter)?

Geraldg · May 26, 2009

Geraldg,
I'll step in for nossirah
Download Combofix from this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
**Note: It is important that it is saved directly to your desktop**
--------------------------------------------------------------------
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
--------------------------------------------------------------------
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Also - I had to rename the ComboFix file name (on my desktop). Just like malwarebytes, this virus won't

let it run. After renaming it - it will run.

Geraldg · May 26, 2009

ComboFix says I have NIS installed - I don't!

Thanks for the reply!

So - I launch ComboFix. It says that "antivirus: Norton Internet Security" is running.

But - I uninstalled this a couple days ago and only have AVG Free running.

How to I tell ComboFix that NIS is really not running (or installed for that matter)?

Geraldg · May 26, 2009

OK - I decided to run Combofix anyway...

Despite that it complained about NIS running (which as I said I used the Symantec uninstaller

to uninstall NIS a couple days ago), and I saw a Symantec driver running (via the What'sRunning

program), but no NIS or Symantec processes running, I decided to proceed.

It's not running - I'll post results soon.

Geraldg · May 26, 2009

OK - I've included the ComboFix log file below.

I've also attached the results from the HiJackThis and Malwarebytes.

From what I see in Malwarebytes - things appear clean !!!

Is this correct???

If so - WOW !!!!!

ComboFix Log

----------------

ComboFix 09-05-25.05 - Gerald 05/25/2009 20:14.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.492 [GMT -5:00]

Running from: c:\documents and settings\Gerald\Desktop\jComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\Gerald\Application Data\dwcdwzxf

c:\documents and settings\Gerald\Application Data\dwcdwzxf\profiles.ini

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\cert8.db

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\compatibility.ini

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\compreg.dat

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\cookies.sqlite

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\formhistory.sqlite

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\key3.db

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\localstore.rdf

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\permissions.sqlite

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\places.sqlite-journal

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\places.sqlite

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\pluginreg.dat

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\prefs.js

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\secmod.db

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\webappsstore.sqlite

c:\documents and settings\Gerald\Application Data\dwcdwzxf\Profiles\4368xmdv.default\xpti.dat

c:\documents and settings\Gerald\Local Settings\Application Data\dwcdwzxf

c:\documents and settings\Gerald\Local Settings\Application Data\dwcdwzxf\Profiles\4368xmdv.default\urlclassifier3.sqlite

c:\documents and settings\Gerald\Local Settings\Application Data\dwcdwzxf\Profiles\4368xmdv.default\XPC.mfl

c:\documents and settings\NetworkService\Application Data\dwcdwzxf

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\profiles.ini

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\cert8.db

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\compatibility.ini

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\compreg.dat

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\cookies.sqlite

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\formhistory.sqlite

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\key3.db

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\localstore.rdf

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\permissions.sqlite

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\places.sqlite-journal

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\places.sqlite

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\pluginreg.dat

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\prefs.js

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\secmod.db

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\webappsstore.sqlite

c:\documents and settings\NetworkService\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\xpti.dat

c:\documents and settings\NetworkService\Local Settings\Application Data\dwcdwzxf

c:\documents and settings\NetworkService\Local Settings\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\urlclassifier3.sqlite

c:\documents and settings\NetworkService\Local Settings\Application Data\dwcdwzxf\Profiles\cp9z0zn4.default\XPC.mfl

c:\program files\QUAD Utilities

c:\program files\QUAD Utilities\QUAD Registry Cleaner\Vista Scheduler.dll

c:\windows\system32\drivers\gbazremn.sys

c:\windows\system32\drivers\oextoccj.sys

c:\windows\system32\drivers\UACwhycbvjjyxeynya.sys

c:\windows\system32\gzctcln.dll

c:\windows\system32\snqsald.dll

c:\windows\system32\UACasesscdboymhgqg.log

c:\windows\system32\UACckaesxnmcbjjjod.dll

c:\windows\system32\UACcvkcuibptsoidvq.dll

c:\windows\system32\UACddqxyomdttfomto.log

c:\windows\system32\UACdmrolhjwopivxyl.log

c:\windows\system32\UACffnyvcpklkiqkeu.dat

c:\windows\system32\UACibcimukcgaosvmg.log

c:\windows\system32\UACiesrewhpcbtynfd.log

c:\windows\system32\uacinit.dll

c:\windows\system32\UACkhmjdsvmnoqkcyp.log

c:\windows\system32\UACltvstirvnwqffkm.log

c:\windows\system32\UACmjhovixyyxhllij.log

c:\windows\system32\UACproc.log

c:\windows\system32\UACqfmeyvxibgbftvp.dll

c:\windows\system32\UACqherpfhmnmasccp.log

c:\windows\system32\UACrbpdmvrbcydyjer.dll

c:\windows\system32\UACsbjjpyregeposxv.dat

c:\windows\system32\UACtmbqspeeepefosq.dll

c:\windows\system32\UACuoussfsfhmgivht.log

c:\windows\system32\UACylixrwbvmvkkfto.log

c:\windows\system32\UACytcyqghnkxlbnmr.log

c:\windows\system32\zzyxuadt.dll

c:\windows\Tasks\At1.job

c:\windows\Tasks\At2.job

----- BITS: Possible infected sites -----

hxxp://downloadsoftwareserver.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

-------\Legacy_GBAZREMN

-------\Legacy_RXDEJHUM

-------\Service_gbazremn

-------\Service_rxdejhum

((((((((((((((((((((((((( Files Created from 2009-04-26 to 2009-05-26 )))))))))))))))))))))))))))))))

.

2009-05-25 20:02 . 2009-05-25 20:02 65536 ----a-w c:\windows\system32\drivers\towptqsbcimqibyt.sys

2009-05-25 03:24 . 2009-05-25 13:18 12030 ----a-w C:\backup.reg

2009-05-25 03:22 . 2008-05-31 04:09 731136 ----a-w c:\temp\avenger.exe

2009-05-25 00:43 . 2009-05-25 00:43 -------- d-----w c:\program files\Trend Micro

2009-05-24 22:35 . 2009-05-24 23:13 -------- d-----w C:\VundoFix Backups

2009-05-24 20:02 . 2009-05-24 20:02 -------- d-----w c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP

2009-05-24 20:00 . 2009-05-25 00:38 117760 ----a-w c:\documents and settings\Gerald\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-05-24 19:59 . 2009-05-24 19:59 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-05-24 19:58 . 2009-05-24 20:54 -------- d-----w c:\program files\SUPERAntiSpyware

2009-05-24 19:58 . 2009-05-24 19:58 -------- d-----w c:\documents and settings\Gerald\Application Data\SUPERAntiSpyware.com

2009-05-24 19:05 . 2009-05-24 19:05 -------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-05-24 18:22 . 2009-05-24 18:22 -------- d-----w c:\documents and settings\Gerald\Application Data\Malwarebytes

2009-05-24 18:19 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-05-24 18:19 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-24 18:19 . 2009-05-24 18:22 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-05-24 18:19 . 2009-05-24 18:19 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

2009-05-23 21:09 . 2009-05-23 21:09 -------- d--h--r c:\documents and settings\Gerald\Application Data\SecuROM

2009-05-23 13:09 . 2009-05-23 13:13 -------- d-----w c:\program files\WhatsRunning

2009-05-23 11:48 . 2009-05-25 13:26 -------- d--h--w C:\$AVG8.VAULT$

2009-05-23 11:39 . 2009-05-23 11:39 11952 ----a-w c:\windows\system32\avgrsstx.dll

2009-05-23 11:39 . 2009-05-23 11:39 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-05-23 11:39 . 2009-05-23 11:39 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-05-23 11:39 . 2009-05-23 11:39 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys

2009-05-23 11:38 . 2009-05-25 19:33 -------- d-----w c:\documents and settings\Gerald\Application Data\AVGTOOLBAR

2009-05-23 11:38 . 2009-05-25 14:40 -------- d-----w c:\windows\system32\drivers\Avg

2009-05-23 11:38 . 2009-05-25 14:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-05-23 11:26 . 2009-05-23 11:38 -------- d-----w c:\program files\AVG

2009-05-22 22:08 . 2009-05-24 20:02 -------- d-----w c:\program files\Symantec

2009-05-22 02:11 . 2009-05-22 02:11 152576 ----a-w c:\documents and settings\Gerald\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-05-22 02:04 . 2009-05-22 02:04 -------- d-sh--w c:\documents and settings\Gerald\PrivacIE

2009-05-22 02:02 . 2009-05-22 02:02 -------- d-sh--w c:\windows\system32\config\systemprofile\IETldCache

2009-05-22 02:02 . 2009-05-22 02:02 -------- d-sh--w c:\documents and settings\Gerald\IETldCache

2009-05-22 01:54 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\ieencode.dll

2009-05-22 01:54 . 2009-02-20 18:09 78336 ----a-w c:\windows\system32\dllcache\ieencode.dll

2009-05-22 01:51 . 2009-04-25 05:30 102400 -c----w c:\windows\system32\dllcache\iecompat.dll

2009-05-22 01:38 . 2009-05-22 01:38 -------- d-----w c:\documents and settings\Gerald\Local Settings\Application Data\Mozilla

2009-05-22 00:16 . 2009-05-22 00:16 -------- d-----w c:\documents and settings\Gerald\Local Settings\Application Data\Symantec

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-24 20:05 . 2004-12-11 18:17 -------- d-----w c:\program files\Common Files\Symantec Shared

2009-05-24 20:02 . 2004-12-11 18:18 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2009-05-23 02:06 . 2005-05-03 19:37 7101 -c--a-w c:\documents and settings\All Users\Application Data\AOL\AOLszs.drv

2009-05-22 22:03 . 2009-03-21 17:31 -------- d-----w c:\documents and settings\All Users\Application Data\Norton

2009-05-22 02:15 . 2004-12-11 19:58 -------- d-----w c:\program files\Java

2009-05-22 02:05 . 2005-05-22 19:42 -------- d-----w c:\program files\Google

2009-05-15 23:24 . 2004-12-11 19:14 -------- d-----w c:\program files\Paint Shop Pro 6

2009-04-22 23:11 . 2006-12-28 19:30 107888 ----a-w c:\windows\system32\CmdLineExt.dll

2009-04-16 11:51 . 2004-12-11 19:29 -------- d-----w c:\program files\Common Files\AOL

2009-04-13 20:03 . 2004-12-11 18:43 -------- d-----w c:\program files\Common Files\KODAK

2009-04-01 00:07 . 2005-09-16 16:19 -------- d-----w c:\program files\Trillian

2009-04-01 00:03 . 2004-12-11 19:30 -------- d-----w c:\documents and settings\All Users\Application Data\AOL

2009-04-01 00:03 . 2004-12-11 19:30 -------- d-----w c:\program files\Common Files\aolshare

2009-04-01 00:02 . 2004-12-11 16:30 -------- d--h--w c:\program files\InstallShield Installation Information

2009-04-01 00:02 . 2004-12-11 19:18 -------- d-----w c:\program files\Macromedia

2009-04-01 00:01 . 2004-12-11 19:18 -------- d-----w c:\program files\Common Files\Macromedia

2009-03-31 23:54 . 2004-12-29 16:50 -------- d-----w c:\program files\EA GAMES

2009-03-31 23:51 . 2004-12-18 13:44 -------- d-----w c:\program files\Disney Interactive

2009-03-31 23:50 . 2004-12-12 15:10 -------- d-----w c:\documents and settings\Gerald\Application Data\Lavasoft

2009-03-21 18:55 . 2009-03-21 18:55 152576 -c--a-w c:\documents and settings\Gerald\Application Data\Sun\Java\jre1.6.0_11\lzma.dll

2009-03-09 10:19 . 2009-03-21 19:21 410984 ----a-w c:\windows\system32\deploytk.dll

2009-03-06 14:22 . 2001-10-23 01:14 284160 ----a-w c:\windows\system32\pdh.dll

2009-03-03 00:18 . 2001-10-23 01:15 826368 ----a-w c:\windows\system32\wininet.dll

2009-02-27 22:11 . 2004-12-11 21:46 75536 ----a-w c:\documents and settings\Gerald\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2000-12-05 22:39 . 2004-12-11 17:54 453120 -c--a-w c:\program files\FileBreaker.exe

1999-08-19 20:28 . 2004-12-11 17:54 545792 -c--a-w c:\program files\Treesize.exe

2004-12-14 22:35 . 2004-12-14 22:35 61 -csh--w c:\windows\cnerolf.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-05 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]

"EM_EXEC"="c:\progra~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE" [2001-10-04 35328]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-12-12 192512]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-23 1947928]

"NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2006-10-22 86016]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 17:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-05-23 11:39 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\dpnsvr.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1187842196\\ee\\aolsoftware.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\AOL 9.1\\waol.exe"=

"c:\\Program Files\\THQ\\Company of Heroes\\RelicDownloader\\RelicDownloader.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/23/2009 6:39 AM 325896]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/23/2009 6:39 AM 108552]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/14/2009 2:22 PM 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/14/2009 2:22 PM 72944]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/23/2009 6:38 AM 298776]

R2 IOPort;IOPort;c:\windows\system32\drivers\IOPORT.SYS [11/27/1998 10:57 PM 6144]

S3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\drivers\LCcfltr.sys [12/11/2004 11:30 AM 14095]

S3 lredbooo;lredbooo;\??\c:\docume~1\Gerald\LOCALS~1\Temp\lredbooo.sys --> c:\docume~1\Gerald\LOCALS~1\Temp\lredbooo.sys [?]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/14/2009 2:22 PM 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GBAZREMN

*Deregistered* - gbazremn

.

Contents of the 'Scheduled Tasks' folder

2009-05-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 18:42]

2009-05-26 c:\windows\Tasks\User_Feed_Synchronization-{D3E0270E-A32C-4BBF-A999-E0EB9C350B2D}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 17:58]

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = 0.0.0.0:80

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

Trusted Zone: musicmatch.com\online

DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - hxxp://software-dl.real.com/11f239b5ee46e54a1f17/netzip/RdxIE601.cab

FF - ProfilePath - c:\documents and settings\Gerald\Application Data\Mozilla\Firefox\Profiles\n0qzbxub.default\

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-25 20:24

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]

"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]

"ImagePath"="-"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(624)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(3200)

c:\program files\Logitech\iTouch\iTchHk.dll

c:\progra~1\Logitech\MOUSEW~1\SYSTEM\LgMousHk.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\windows\system32\drivers\dcfssvc.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\pctspk.exe

c:\windows\wanmpsvc.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

.

**************************************************************************

.

Completion time: 2009-05-26 20:36 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-26 01:36

Pre-Run: 13,586,108,416 bytes free

Post-Run: 14,419,222,528 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

301 --- E O F --- 2009-05-22 02:46

||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

||||||||||||||||||||||||||

HijackThis Log

----------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:37:53 PM, on 5/25/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Unable to get Internet Explorer version!

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\drivers\dcfssvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Logitech\iTouch\iTouch.exe

C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 0.0.0.0:80

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb01.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testAc...OnlineGames.cab

O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/11f239b5ee46e5...ip/RdxIE601.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} (HPObjectInstaller Class) - http://h30155.www3.hp.com/ediags/gs/instal...edsolutions.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab

O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

O24 - Desktop Component 0: (no name) - http://www.shipofdreams.btinternet.co.uk/j...s6_1024x768.jpg

O24 - Desktop Component 1: (no name) - http://www.shipofdreams.btinternet.co.uk/j...as1_800x600.jpg

--

End of file - 9222 bytes

||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

||||||||||||||||||||||||||

Malwarebytes Log

---------------------

Malwarebytes' Anti-Malware 1.36

Database version: 2176

Windows 5.1.2600 Service Pack 3

5/25/2009 8:46:23 PM

mbam-log-2009-05-25 (20-46-23).txt

Scan type: Quick Scan

Objects scanned: 85960

Time elapsed: 6 minute(s), 51 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

sjpritch25 · May 26, 2009

not quite i'm a afraid

Go to Start ----> Run----> Type cmd windows command prompt will appear

type the following command in the dos prompt

reg query "HKLM\System\CurrentControlSet\Services\gbazremn" > fakeservice.txt && notepad fakeservice.txt

please copy and paste the results of fakeserive.txt in your next reply. Thanks

Geraldg · May 26, 2009

I did this - here's what I get -

Microsoft Windows XP [Version 5.1.2600]

C:\Documents and Settings\Gerald>

C:\Documents and Settings\Gerald>reg query "HKLM\System\CurrentControlSet\

es\gbazremn" > fakeservice.txt && notepad fakeservice.txt

Error: The system was unable to find the specified registry key or value

-----

Also, I don't seem to be seeing those "invisible" iexplorer processes popping up in

the Task Manager...

I should note that I just re-ran Malwarebytes and this is what was found (nothing):

Malwarebytes' Anti-Malware 1.36

Database version: 2179

Windows 5.1.2600 Service Pack 3

5/25/2009 9:03:52 PM

mbam-log-2009-05-25 (21-03-52).txt

Scan type: Quick Scan

Objects scanned: 60735

Time elapsed: 9 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

sjpritch25 · May 26, 2009

How is everything running???

Geraldg · May 26, 2009

Well - things look Good!

As I said, Malwarebytes found no threats, I don't see the invisible iexplorer window processes appearing

as they used to, so I think with the help of you, "nosirrah", and ComboFix, you got the Vundo virus

removed.

Thank you VERY VERY much for you support and expert assistance!

I will definitely recommend this Malwarebytes software to family, colleagues and friends as well

as the experts on this forum!

sjpritch25 · May 26, 2009

One more thing to do before i can let you go.

Download the attached file CFScript.txt to your Desktop

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt". In your next reply, please include the ComboFix log and a fresh HIjackthis log.

Note:

Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note:Please do not use this script on another computer, you may damage the system. The script is made especially for this user's computer only!!!!

CFScript.txt

Geraldg · May 26, 2009

Sorry for the delay - and THANK YOU again for all your hard work!

I renamed the "jComboFix" back to "ComboFix". Remember, with the virus active,

it must have known about ComboFix and refused to let me run it. Now, without

the virus, ComboFix can have it's original name.

Anyway - here are the ComboFix and HiJackThis logs you requested -

ComboFix Log

----------------

ComboFix 09-05-25.08 - Gerald 05/26/2009 7:17.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.481 [GMT -5:00]

Running from: c:\documents and settings\Gerald\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Gerald\Desktop\CFScript.txt