Ran Combo-Fix but still unable to open antivirus program

akhanni · August 22, 2009

I read the posts of one of the member of forum here and download Combo-Fix and ran it. I think it removed quite a few foreign processes.

Than I was able to run MalwareBytes and antivirus program seems to be catching and removing viruses.

By the Malware Bytes caught quite a few viruses and removed them.

Problem : But I am still unable to open the Antivirus program to schedule some scans. Any help appreciated !

See below log file created by Combo-Fix

ComboFix 09-08-20.07 - azniazi 08/21/2009 20:34.1.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1301 [GMT -4:00]

Running from: c:\documents and settings\azniazi\Desktop\Combo-Fix.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Protection Agent 5.1 *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Internet Explorer.lnk

c:\program files\INSTALL.LOG

c:\windows\Installer\21ab39.msp

c:\windows\Installer\21ab3a.msp

c:\windows\Installer\21ab3b.msp

c:\windows\Installer\21ab3c.msp

c:\windows\Installer\21ab3d.msp

c:\windows\Installer\21ab3e.msp

c:\windows\Installer\21ab3f.msp

c:\windows\Installer\21ab40.msp

c:\windows\Installer\21ab41.msp

c:\windows\msa.exe

c:\windows\ppp3.dat

c:\windows\ppp4.dat

c:\windows\run.log

c:\windows\system32\.log

c:\windows\system32\bennuar.old

c:\windows\system32\bincd32.dat

c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Antivirus Pro

c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Antivirus Pro\Windows Antivirus Pro.lnk

c:\windows\system32\dddesot.dll

c:\windows\system32\desot.exe

c:\windows\system32\drivers\kbiwkmyrrrprps.sys

c:\windows\system32\drivers\UAChhvufcxtcd.sys

c:\windows\system32\kbiwkmdqekvjkf.dll

c:\windows\system32\kbiwkmlaegjsrq.dll

c:\windows\system32\kbiwkmovtkqbbs.dat

c:\windows\system32\kbiwkmytbsaplr.dat

c:\windows\system32\mdm.exe

c:\windows\system32\sonhelp.htm

c:\windows\system32\sysnet.dat

c:\windows\system32\UACbvhkctumwe.dll

c:\windows\system32\uacinit.dll

c:\windows\system32\UACltabuxnqvd.dll

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected

Restored copy from - c:\windows\system32\dllcache\eventlog.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_kbiwkmumsdotvq

-------\Legacy_kbiwkmumsdotvq

-------\Service_UACd.sys

-------\Legacy_UACd.sys

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

((((((((((((((((((((((((( Files Created from 2009-07-22 to 2009-08-22 )))))))))))))))))))))))))))))))

.

2009-08-21 06:48 . 2009-08-21 06:48 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-08-21 06:48 . 2009-08-21 06:48 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2009-08-21 04:38 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-21 04:38 . 2009-08-21 07:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-21 04:38 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-21 04:37 . 2009-08-21 04:37 -------- d--h--w- c:\windows\PIF

2009-08-21 02:29 . 2009-08-21 02:30 -------- d-----w- C:\bc657dec8cc4839b62c633a09a

2009-08-20 21:56 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll

2009-08-20 21:30 . 2009-08-21 23:55 74240 ----a-w- c:\windows\system32\uacbbr.dll

2009-08-20 17:30 . 2009-08-20 17:30 19968 ----a-w- c:\windows\system32\uacserf.dll

2009-08-20 17:30 . 2009-08-20 17:30 30208 ----a-w- c:\windows\system32\uacrem.dll

2009-08-20 17:30 . 2009-08-20 17:30 174 ----a-w- c:\windows\system32\UACsbqhossxgq.dat

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\program files\QuickTime

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple Computer

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\documents and settings\azniazi\Local Settings\Application Data\Apple

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\program files\Apple Software Update

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\documents and settings\azniazi\Local Settings\Application Data\Apple Computer

2009-08-10 18:05 . 2008-01-24 10:34 32864 ----a-w- c:\windows\system32\dsgrab_01ca19e52df8d8ae.dll

2009-08-10 18:05 . 2008-01-24 10:34 10848 ----a-w- c:\windows\system32\drivers\dsload.sys

2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\azniazi\Local Settings\Application Data\Oracle

2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\program files\Common Files\Oracle

2009-08-08 17:37 . 2008-04-14 09:42 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-08-08 17:37 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-08-08 17:37 . 2008-04-14 04:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-08-08 17:37 . 2008-04-14 04:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-08-08 16:23 . 2009-08-08 16:23 -------- d-----w- c:\program files\honestech

2009-08-08 16:21 . 2006-11-15 21:31 18754 ----a-w- c:\windows\system32\drivers\StkASam.sys

2009-08-08 16:21 . 2006-06-10 02:30 61440 ----a-w- c:\windows\StkATVAp.exe

2009-08-08 16:21 . 2006-05-24 03:49 24576 ----a-w- c:\windows\system32\StkASv2K.exe

2009-08-08 16:21 . 2006-05-24 03:48 45056 ----a-w- c:\windows\system32\StkAVFW.dll

2009-08-08 16:21 . 2006-05-24 03:48 24576 ----a-w- c:\windows\system32\StkAUSD.dll

2009-08-08 16:21 . 2006-05-24 03:48 24576 ----a-w- c:\windows\system32\StkASSrv.dll

2009-08-08 16:20 . 2006-11-15 21:32 242139 ----a-w- c:\windows\system32\drivers\StkAMini.sys

2009-08-08 16:20 . 2006-11-15 21:32 243212 ----a-w- c:\windows\system32\drivers\StkACamd.sys

2009-08-08 16:20 . 2006-11-15 21:32 653988 ----a-w- c:\windows\system32\drivers\StkAPin.sys

2009-08-08 16:20 . 2006-06-27 22:27 4772 ----a-w- c:\windows\system32\drivers\StkScan.sys

2009-08-08 16:20 . 2006-05-24 03:47 106496 ----a-w- c:\windows\Stk1150.exe

2009-08-08 16:20 . 2006-02-09 22:07 10479603 ----a-w- c:\windows\system32\drivers\StkAPipe.sys

2009-08-08 16:20 . 2009-08-08 16:24 -------- d-----w- c:\program files\honestech VHS to DVD 3.0 Deluxe

2009-08-08 16:19 . 2009-08-08 16:19 -------- d-----w- c:\documents and settings\azniazi\Application Data\InstallShield

2009-08-08 15:40 . 2008-04-14 09:42 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll

2009-08-08 15:40 . 2008-04-14 09:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

2009-08-06 19:04 . 2009-08-06 19:04 34 ----a-w- c:\windows\system32\lockwait.dat

2009-08-06 18:57 . 2009-08-06 20:48 -------- d-----w- C:\oracle

2009-08-06 18:51 . 2009-08-07 17:03 -------- d-----w- c:\program files\Apache Group

2009-08-06 17:18 . 2009-08-06 17:18 -------- d-----w- c:\program files\Microsoft Visual Studio .NET

2009-08-06 17:18 . 2009-08-06 17:18 -------- d-----w- c:\documents and settings\azniazi\Local Settings\Application Data\Microsoft Help

2009-08-06 17:18 . 2009-08-06 17:18 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Microsoft Help

2009-08-06 17:17 . 2009-08-06 18:30 -------- d-----w- C:\oraclexe

2009-08-04 19:53 . 2009-08-04 19:53 1919 ----a-w- c:\documents and settings\azniazi\Application Data\.purple\certificates\x509\tls_peers\stbeehive.oracle.com

2009-07-31 20:50 . 2009-07-31 20:50 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\iPass

2009-07-31 20:50 . 2009-07-31 20:50 356352 ----a-w- c:\windows\system32\iPassI5Installer.exe

2009-07-31 20:50 . 2009-07-31 20:50 21393 ----a-w- c:\windows\system32\drivers\iPassP.sys

2009-07-31 20:50 . 2009-07-31 20:50 -------- d-----w- c:\program files\iPass

2009-07-31 20:49 . 2009-07-31 20:49 -------- d-----w- c:\program files\iPassdoc3.x

2009-07-31 14:18 . 2009-07-31 14:18 -------- d---a-w- c:\documents and settings\azniazi\Application Data\.purple.bak.1

2009-07-28 20:54 . 2005-10-28 17:01 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys

2009-07-28 20:54 . 2005-11-16 05:30 765952 ----a-r- c:\windows\system32\hpptpml3.dll

2009-07-28 20:54 . 2005-06-21 02:48 266240 ----a-r- c:\windows\system32\hppasc01.dll

2009-07-28 20:54 . 2004-11-15 15:54 278528 ----a-r- c:\windows\system32\hpgwiamd.dll

2009-07-28 20:54 . 2005-10-04 17:17 102400 ----a-r- c:\windows\system32\hpfxbulk.dll

2009-07-28 20:52 . 2009-07-28 21:03 53631 ----a-w- c:\windows\hppins02.dat

2009-07-28 20:52 . 2006-01-25 08:03 2037 ------w- c:\windows\hppmdl02.dat

2009-07-28 20:13 . 2005-11-24 21:25 208896 ----a-w- c:\windows\system32\HPPAPR01.DLL

2009-07-28 20:13 . 2005-09-13 16:50 508 ----a-w- c:\windows\system32\hppapr01.dat

2009-07-28 20:04 . 2009-07-28 20:04 130 ----a-w- c:\documents and settings\azniazi\Local Settings\Application Data\fusioncache.dat

2009-07-28 20:03 . 2009-07-28 20:03 -------- d-----w- c:\documents and settings\azniazi\Application Data\HP

2009-07-28 20:03 . 2009-07-28 20:03 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Hewlett-Packard

2009-07-28 20:00 . 2009-08-22 00:39 1785 ----a-w- c:\windows\bthservsdp.dat

2009-07-28 19:59 . 2009-07-28 19:59 -------- d-----w- c:\program files\Hewlett-Packard

2009-07-28 19:58 . 2009-07-28 19:58 -------- d-----w- c:\program files\Common Files\Hewlett-Packard

2009-07-28 19:57 . 2005-10-23 00:47 69632 ----a-w- c:\windows\system32\HPZipm12.exe

2009-07-28 19:57 . 2005-10-23 00:46 65536 ----a-w- c:\windows\system32\HPZinw12.exe

2009-07-28 19:57 . 2005-10-21 17:13 204800 ----a-w- c:\windows\system32\HPZipr12.dll

2009-07-28 19:57 . 2005-10-21 17:03 278584 ----a-w- c:\windows\system32\HPZidr12.dll

2009-07-28 19:57 . 2005-10-21 16:50 57344 ----a-w- c:\windows\system32\HPZisn12.dll

2009-07-28 19:57 . 2005-10-21 16:49 94208 ----a-w- c:\windows\system32\HPZipt12.dll

2009-07-28 19:57 . 1998-10-29 20:45 306688 ----a-w- c:\windows\IsUninst.exe

2009-07-28 19:42 . 2009-07-28 20:58 -------- d-----w- c:\program files\HP

2009-07-28 19:37 . 2009-07-28 19:37 -------- d-----w- c:\program files\Common Files\SWF Studio

2009-07-27 23:37 . 2009-08-18 19:21 -------- d-----w- C:\azeem-temp

2009-07-27 20:40 . 2005-10-29 05:01 45056 ----a-w- c:\windows\system32\HPPAPTS0.DLL

2009-07-27 20:40 . 2005-10-29 05:01 36864 ----a-w- c:\windows\system32\HPPASNM0.DLL

2009-07-27 20:40 . 2005-10-29 05:01 36864 ----a-w- c:\windows\system32\HPPAPML0.DLL

2009-07-27 20:40 . 2005-10-29 05:01 36864 ----a-w- c:\windows\system32\HPPADT40.DLL

2009-07-27 20:40 . 2005-10-29 05:01 32768 ----a-w- c:\windows\system32\HPPAMON0.DLL

2009-07-27 16:44 . 2001-08-17 17:47 8704 -c--a-w- c:\windows\system32\dllcache\dot4scan.sys

2009-07-27 16:44 . 2001-08-17 17:47 8704 ----a-w- c:\windows\system32\drivers\Dot4Scan.sys

2009-07-27 16:44 . 2008-04-14 04:09 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys

2009-07-27 16:44 . 2008-04-14 04:09 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys

2009-07-27 16:41 . 2005-10-21 23:58 49920 ----a-w- c:\windows\system32\drivers\HPZid412.sys

2009-07-27 16:38 . 2008-04-14 04:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys

2009-07-27 16:38 . 2008-04-14 04:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2009-07-27 16:37 . 2001-08-17 17:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys

2009-07-27 16:37 . 2001-08-17 17:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2009-07-27 16:37 . 2008-04-14 04:15 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys

2009-07-27 16:37 . 2008-04-14 04:15 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-22 00:43 . 2008-08-27 04:00 -------- d-----w- c:\program files\Symantec AntiVirus

2009-08-21 16:49 . 2009-08-21 16:49 43736 ------w- c:\documents and settings\azniazi\cnsload_1250873381421.tmp

2009-08-08 16:20 . 2008-08-26 20:14 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-08-06 20:32 . 2009-07-22 17:32 -------- d-----w- c:\documents and settings\azniazi\Application Data\.purple

2009-08-06 17:15 . 2009-07-22 20:24 -------- d-----w- c:\program files\Common Files\InstallShield

2009-08-05 16:50 . 2008-08-27 03:52 -------- d-----w- c:\program files\Common Files\Adobe

2009-08-05 09:01 . 2008-04-14 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-31 14:18 . 2008-08-27 17:15 -------- d-----w- c:\program files\Pidgin

2009-07-28 20:02 . 2008-08-26 14:30 62424 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-22 20:24 . 2008-08-27 04:07 -------- d-----w- c:\program files\MigrationAssistant

2009-07-22 20:24 . 2009-07-22 20:24 -------- d-----w- c:\program files\Apoint

2009-07-22 20:24 . 2009-07-22 20:24 -------- d-----w- c:\program files\Dell

2009-07-22 20:17 . 2009-07-22 20:17 512 ----a-w- C:\OracleOB.dat

2009-07-22 19:42 . 2009-07-22 19:42 -------- d-----w- c:\documents and settings\azniazi\Application Data\Malwarebytes

2009-07-22 19:42 . 2009-07-22 19:42 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes

2009-07-22 19:41 . 2009-07-22 19:41 -------- d-----w- c:\program files\MWSnap

2009-07-22 19:40 . 2009-07-22 19:40 -------- d-----w- c:\documents and settings\azniazi\Application Data\Helios

2009-07-22 19:40 . 2009-07-22 19:40 -------- d-----w- c:\program files\TextPad 5

2009-07-22 19:37 . 2009-07-22 19:37 0 ----a-w- c:\windows\nsreg.dat

2009-07-22 18:11 . 2009-07-22 18:11 -------- d-----w- c:\program files\Microsoft.NET

2009-07-22 17:28 . 2009-07-22 17:28 -------- d-----w- c:\documents and settings\Admin\Application Data\.purple

2009-07-22 17:27 . 2008-08-26 19:14 -------- d-----w- c:\program files\Desktop Tools

2009-07-22 17:05 . 2009-07-22 17:05 -------- d-----w- c:\program files\CONEXANT

2009-07-17 19:01 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 03:43 . 2008-04-14 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-06-26 16:50 . 2008-04-14 12:00 666624 ----a-w- c:\windows\system32\wininet.dll

2009-06-26 16:50 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll

2009-06-25 08:25 . 2008-04-14 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2008-04-14 12:00 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2008-04-14 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2008-04-14 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-06-25 08:25 . 2008-04-14 12:00 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:25 . 2008-04-14 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-24 11:18 . 2008-04-14 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2009-06-16 14:36 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:36 . 2008-04-14 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-12 12:31 . 2008-04-14 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe

2009-06-12 12:31 . 2008-04-14 12:00 76288 ----a-w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 2008-04-14 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 13:19 . 2008-08-26 12:40 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 2008-04-14 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-03 19:09 . 2008-04-14 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll

2009-07-24 04:05 . 2008-08-26 22:58 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2009-07-24 04:05 . 2008-08-26 22:58 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2009-07-24 04:05 . 2008-08-26 22:58 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll

2009-07-24 04:05 . 2008-08-26 22:58 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll

2009-07-24 04:05 . 2008-08-26 22:58 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-06-06 125632]

"TweakAutomaticUpdates"="c:\windows\orclobi\gdswsuspatch_soon.exe" [2005-12-22 126887]

"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-03-31 138008]

"ntpgds"="c:\windows\orclobi\synctime.exe" [2003-04-07 110993]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-31 138008]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-31 162584]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]

"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 52840]

"AutoProfileRepair"="c:\program files\Oracle\Outlook Connector\profilerepair.exe" [2007-09-21 73728]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]

"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-02-02 45056]

"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2005-09-07 36864]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]

"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FirefoxConfig"="c:\windows\orclobi\config\openofficeconfig.exe" [2008-04-09 1114425]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\

Monitor Apache Servers.lnk - c:\program files\Apache Group\Apache2\bin\ApacheMonitor.exe [2008-1-17 41042]

Oracle Drive.lnk - c:\program files\Oracle\ODrive\odrive.exe [2006-9-22 73728]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck msln\0autocheck autochk *

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

R1 TDFSD;TDFSD;c:\windows\system32\drivers\tdfsd.sys [9/22/2006 1:41 PM 938592]

R2 IdcAdminService idcr_admin;IDC Content Admin Service idcr_admin;c:\oracle\ecm\urm\admin\bin\IdcAdminNT.exe [8/6/2009 5:10 PM 110592]

R2 IdcAdminService ucm_admin;IDC Content Admin Service ucm_admin;c:\oracle\ecm\ucm\admin\bin\IdcAdminNT.exe [8/6/2009 4:49 PM 110592]

R2 MyDesktopWindows;MyDesktopService;c:\windows\ORCLOBI\MyDesktop\MyDesktopService.exe [6/26/2009 2:11 AM 998400]

R2 ocautoupds;Oracle Connector Automatic Updates Service;c:\program files\Oracle\Outlook Connector\ocautoupds.exe [9/21/2007 12:00 PM 69632]

R2 OdService;ODrive Service;c:\program files\Oracle\ODrive\XfsSvcCon.exe svcmanager --> c:\program files\Oracle\ODrive\XfsSvcCon.exe svcmanager [?]

R2 OracleServiceXE;OracleServiceXE;c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE --> c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE XE [?]

R2 OracleXETNSListener;OracleXETNSListener;c:\oraclexe\app\oracle\product\10.2.0\server\BIN\TNSLSNR.EXE [2/2/2006 12:49 AM 204800]

R2 PMEMNT;PMEMNT;c:\windows\pmemnt.sys [7/22/2009 1:28 PM 7012]

R2 QOSMyDesktop;QOS MyDesktop;c:\windows\ORCLOBI\MyDesktop\MyDesktopQOS.exe [12/4/2008 3:07 AM 470016]

R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [6/6/2007 4:24 PM 116928]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/22/2009 1:51 PM 101936]

S2 AntipPro2009_100;AntipyProex;c:\windows\svchast.exe --> c:\windows\svchast.exe [?]

S2 IdcContentService idcr;IDC Content Service idcr;c:\oracle\ecm\urm\bin\IdcServerNT.exe [8/6/2009 5:10 PM 110592]

S2 IdcContentService ucm;IDC Content Service ucm;c:\oracle\ecm\ucm\bin\IdcServerNT.exe [8/6/2009 4:49 PM 110592]

S4 OracleJobSchedulerXE;OracleJobSchedulerXE;c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE --> c:\oraclexe\app\oracle\product\10.2.0\server\Bin\extjob.exe XE [?]

S4 SysGuard;SysGuard;c:\windows\system32\drivers\Sysguard.sys [8/27/2008 12:12 AM 44544]

UnknownUnknown dsload;dsload; [x]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-CalProfile - c:\windows\orclobi\config\cc1012cfg.exe

HKU-Default-RunOnce-ThunderbirdConfig - c:\windows\orclobi\config\tbirdconfig.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://my.oracle.com/

uInternet Settings,ProxyOverride = *.oracle.com;*.oracleads.com;*.us.oracle.com;*.uk.oracle.com;*.ca.oracle.com;*.o

raclecorp.com;*.oracleportal.com;<local>

Trusted Zone: oraclecorp.com\global-service

DPF: {00191E4B-49C2-48E2-A548-8F702D75622A} - hxxps://strtc.oracle.com/imtapp/res/jar/cnsload.cab

FF - ProfilePath - c:\docume~1\azniazi\APPLIC~1\Mozilla\Firefox\Profiles\d2epvq8g.default\

FF - prefs.js: browser.startup.homepage - hxxp://my.oracle.com

FF - prefs.js: network.proxy.type - 2

FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-21 20:42

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]

"ImagePath"=""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]

@Denied: (A 2) (Everyone)

@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4196)

c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

c:\windows\system32\WPDShServiceObj.dll

c:\windows\SYSTEM32\TDShell.DLL

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Symantec\SPA\Smc.exe

c:\program files\Symantec\SPA\SNAC.EXE

c:\program files\Common Files\Symantec Shared\ccSetMgr.exe

c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

c:\windows\system32\scardsvr.exe

c:\program files\Apache Group\Apache2\bin\Apache.exe

c:\program files\Cisco Systems\VPN Client\cvpnd.exe

c:\program files\Symantec AntiVirus\DefWatch.exe

c:\program files\Apache Group\Apache2\bin\Apache.exe

c:\oracle\ecm\urm\shared\os\win32\jdk1.5.0_11\bin\java.exe

c:\oracle\ecm\ucm\shared\os\win32\jdk1.5.0_11\bin\java.exe

c:\program files\iPass\iPassConnect\iPassPeriodicUpdateService.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\program files\Oracle\ODrive\XfsSvcCon.exe

c:\oraclexe\app\oracle\product\10.2.0\server\BIN\oracle.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\StkASv2K.exe

c:\program files\Symantec AntiVirus\Rtvscan.exe

c:\windows\system32\igfxsrvc.exe

c:\windows\system32\rundll32.exe

c:\program files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe

c:\program files\Apoint\hidfind.exe

c:\program files\Apoint\ApntEx.exe

c:\program files\Symantec\SPA\SmcGui.exe

c:\program files\Oracle\ODrive\ODFWAgent.exe

c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-08-22 20:47 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-22 00:46

Pre-Run: 54,105,317,376 bytes free

Post-Run: 54,153,854,976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

372 --- E O F --- 2009-08-06 15:57

screen317 · August 24, 2009

Hi akhanni and welcome to Malwarebytes.

Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.

Next, please open Notepad - don't use any other text editor than notepad or the script will fail.

Copy/paste the text in the quotebox below into Notepad:

File::
c:\windows\system32\drivers\Sysguard.sys
c:\windows\system32\uacbbr.dll
c:\windows\system32\uacserf.dll
c:\windows\system32\uacrem.dll
c:\windows\system32\UACsbqhossxgq.dat
Driver::
SysGuard
KILLALL::
RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]

Save this as CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Do you pay for Symantec? I can recommend great free antivirus programs for you if you'd like.

-screen317

akhanni · August 26, 2009

Hi akhanni and welcome to Malwarebytes.
Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.
Next, please open Notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the quotebox below into Notepad:
Save this as CFScript
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Do you pay for Symantec? I can recommend great free antivirus programs for you if you'd like.
-screen317

Hello, Thanks bunch for your reply. I was actually able to fix the issue by changing the security permission on Antivirus program from "Everyone" to "Administrator".

screen317 · August 27, 2009

Please follow the instructions I posted anyway. Many infected files are still present, even if you don't feel immediate symptoms.

akhanni · August 27, 2009

Please follow the instructions I posted anyway. Many infected files are still present, even if you don't feel immediate symptoms.

Okay. Let me know what you think.

COMBO FIX LOG:

ComboFix 09-08-26.07 - azniazi 08/27/2009 11:52.2.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.899 [GMT -4:00]

Running from: c:\documents and settings\azniazi\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\azniazi\Desktop\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Symantec Protection Agent 5.1 *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

FILE ::

"c:\windows\system32\drivers\Sysguard.sys"

"c:\windows\system32\uacbbr.dll"

"c:\windows\system32\uacrem.dll"

"c:\windows\system32\UACsbqhossxgq.dat"

"c:\windows\system32\uacserf.dll"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\Downloaded Program Files.\cnsload-3.0.3.406.dll

c:\windows\Downloaded Program Files.\cnsload.inf

c:\windows\system32\drivers\Sysguard.sys

c:\windows\system32\uacserf.dll

c:\windows\Downloaded Program Files.\cnsload-3.0.3.406.dll . . . . failed to delete

c:\windows\Downloaded Program Files.\cnsload.inf . . . . failed to delete

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SYSGUARD

-------\Service_SysGuard

((((((((((((((((((((((((( Files Created from 2009-07-27 to 2009-08-27 )))))))))))))))))))))))))))))))

.

2009-08-24 19:10 . 2009-08-24 19:10 1713 ----a-w- c:\documents and settings\azniazi\Application Data\.purple\certificates\x509\tls_peers\stbeehive.oracle.com

2009-08-22 01:47 . 2009-08-22 01:47 1174 ----a-w- c:\windows\mozver.dat

2009-08-21 06:48 . 2009-08-22 01:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-08-21 04:38 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-21 04:38 . 2009-08-21 07:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-21 04:38 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-21 04:37 . 2009-08-21 04:37 -------- d--h--w- c:\windows\PIF

2009-08-21 02:29 . 2009-08-21 02:30 -------- d-----w- C:\bc657dec8cc4839b62c633a09a

2009-08-20 21:56 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll

2009-08-20 14:55 . 2009-08-20 14:55 875728 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\NAVEX15.SYS

2009-08-20 14:55 . 2009-08-20 14:55 1181040 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\NAVEX32A.DLL

2009-08-20 14:55 . 2009-08-20 14:55 87888 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\NAVENG.SYS

2009-08-20 14:55 . 2009-08-20 14:55 371248 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\EECTRL.SYS

2009-08-20 14:55 . 2009-08-20 14:55 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\ECMSVR32.DLL

2009-08-20 14:55 . 2009-08-20 14:55 2414128 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\CCERASER.DLL

2009-08-20 14:55 . 2009-08-20 14:55 177520 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\NAVENG32.DLL

2009-08-20 14:55 . 2009-08-20 14:55 101936 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2e2622.vdb\ERASER.SYS

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\program files\QuickTime

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\documents and settings\azniazi\Local Settings\Application Data\Apple

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\program files\Apple Software Update

2009-08-18 17:17 . 2009-08-18 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple