Removed Windows Protection Suite but computer slow and acannot access gmail

clipper1981 · August 29, 2009

I ran MalwareBytes and this removed the Windows Protection Suite. Since then however the computer is slow and I cannot access gmail in either IE or Mozilla. I have reset IE but this did not help. Please see logs below

Malwarebytes' Anti-Malware 1.40

Database version: 2706

Windows 5.1.2600 Service Pack 3

27/08/2009 19:32:52

mbam-log-2009-08-27 (19-32-51).txt

Scan type: Quick Scan

Objects scanned: 21885

Time elapsed: 5 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:00:38, on 29/08/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\S24EvMon.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

C:\WINDOWS\system32\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\ZCfgSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

C:\WINDOWS\system32\1XConfig.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Browser MOUSE\mouse32a.exe

C:\Program Files\HiYo\bin\HiYo.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\WINDOWS\vVX3000.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local

O1 - Hosts: 74.125.45.100 4-open-davinci.com

O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com

O1 - Hosts: 74.125.45.100 privatesecuredpayments.com

O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com

O1 - Hosts: 74.125.45.100 getantivirusplusnow.com

O1 - Hosts: 74.125.45.100 secure-plus-payments.com

O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com

O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com

O1 - Hosts: 74.125.45.100 www.getavplusnow.com

O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com

O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com

O1 - Hosts: 64.86.17.56 google.ae

O1 - Hosts: 64.86.17.56 google.as

O1 - Hosts: 64.86.17.56 google.at

O1 - Hosts: 64.86.17.56 google.az

O1 - Hosts: 64.86.17.56 google.ba

O1 - Hosts: 64.86.17.56 google.be

O1 - Hosts: 64.86.17.56 google.bg

O1 - Hosts: 64.86.17.56 google.bs

O1 - Hosts: 64.86.17.56 google.ca

O1 - Hosts: 64.86.17.56 google.cd

O1 - Hosts: 64.86.17.56 google.com.gh

O1 - Hosts: 64.86.17.56 google.com.hk

O1 - Hosts: 64.86.17.56 google.com.jm

O1 - Hosts: 64.86.17.56 google.com.mx

O1 - Hosts: 64.86.17.56 google.com.my

O1 - Hosts: 64.86.17.56 google.com.na

O1 - Hosts: 64.86.17.56 google.com.nf

O1 - Hosts: 64.86.17.56 google.com.ng

O1 - Hosts: 64.86.17.56 google.ch

O1 - Hosts: 64.86.17.56 google.com.np

O1 - Hosts: 64.86.17.56 google.com.pr

O1 - Hosts: 64.86.17.56 google.com.qa

O1 - Hosts: 64.86.17.56 google.com.sg

O1 - Hosts: 64.86.17.56 google.com.tj

O1 - Hosts: 64.86.17.56 google.com.tw

O1 - Hosts: 64.86.17.56 google.dj

O1 - Hosts: 64.86.17.56 google.de

O1 - Hosts: 64.86.17.56 google.dk

O1 - Hosts: 64.86.17.56 google.dm

O1 - Hosts: 64.86.17.56 google.ee

O1 - Hosts: 64.86.17.56 google.fi

O1 - Hosts: 64.86.17.56 google.fm

O1 - Hosts: 64.86.17.56 google.fr

O1 - Hosts: 64.86.17.56 google.ge

O1 - Hosts: 64.86.17.56 google.gg

O1 - Hosts: 64.86.17.56 google.gm

O1 - Hosts: 64.86.17.56 google.gr

O1 - Hosts: 64.86.17.56 google.ht

O1 - Hosts: 64.86.17.56 google.ie

O1 - Hosts: 64.86.17.56 google.im

O1 - Hosts: 64.86.17.56 google.in

O1 - Hosts: 64.86.17.56 google.it

O1 - Hosts: 64.86.17.56 google.ki

O1 - Hosts: 64.86.17.56 google.la

O1 - Hosts: 64.86.17.56 google.li

O1 - Hosts: 64.86.17.56 google.lv

O1 - Hosts: 64.86.17.56 google.ma

O1 - Hosts: 64.86.17.56 google.ms

O1 - Hosts: 64.86.17.56 google.mu

O1 - Hosts: 64.86.17.56 google.mw

O1 - Hosts: 64.86.17.56 google.nl

O1 - Hosts: 64.86.17.56 google.no

O1 - Hosts: 64.86.17.56 google.nr

O1 - Hosts: 64.86.17.56 google.nu

O1 - Hosts: 64.86.17.56 google.pl

O1 - Hosts: 64.86.17.56 google.pn

O1 - Hosts: 64.86.17.56 google.pt

O1 - Hosts: 64.86.17.56 google.ro

O1 - Hosts: 64.86.17.56 google.ru

O1 - Hosts: 64.86.17.56 google.rw

O1 - Hosts: 64.86.17.56 google.sc

O1 - Hosts: 64.86.17.56 google.se

O1 - Hosts: 64.86.17.56 google.sh

O1 - Hosts: 64.86.17.56 google.si

O1 - Hosts: 64.86.17.56 google.sm

O1 - Hosts: 64.86.17.56 google.sn

O1 - Hosts: 64.86.17.56 google.st

O1 - Hosts: 64.86.17.56 google.tl

O1 - Hosts: 64.86.17.56 google.tm

O1 - Hosts: 64.86.17.56 google.tt

O1 - Hosts: 64.86.17.56 google.us

O1 - Hosts: 64.86.17.56 google.vu

O1 - Hosts: 64.86.17.56 google.ws

O1 - Hosts: 64.86.17.56 google.co.ck

O1 - Hosts: 64.86.17.56 google.co.id

O1 - Hosts: 64.86.17.56 google.co.il

O1 - Hosts: 64.86.17.56 google.co.in

O1 - Hosts: 64.86.17.56 google.co.jp

O1 - Hosts: 64.86.17.56 google.co.kr

O1 - Hosts: 64.86.17.56 google.co.ls

O1 - Hosts: 64.86.17.56 google.co.ma

O1 - Hosts: 64.86.17.56 google.co.nz

O1 - Hosts: 64.86.17.56 google.co.tz

O1 - Hosts: 64.86.17.56 google.co.ug

O1 - Hosts: 64.86.17.56 google.co.uk

O1 - Hosts: 64.86.17.56 google.co.za

O1 - Hosts: 64.86.17.56 google.co.zm

O1 - Hosts: 64.86.17.56 google.com

O1 - Hosts: 64.86.17.56 google.com.af

O1 - Hosts: 64.86.17.56 google.com.ag

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: (no name) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: InstantDisplay Toolbar - {821b7a96-f0df-4803-808e-e841c9548aa6} - C:\Program Files\InstantDisplay\tbIns1.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

O2 - BHO: SparkleBox Toolbar - {ca4eedb3-5719-4e27-a478-8d13f761c28d} - C:\Program Files\SparkleBox\tbSpa1.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: InstantDisplay Toolbar - {821b7a96-f0df-4803-808e-e841c9548aa6} - C:\Program Files\InstantDisplay\tbIns1.dll

O3 - Toolbar: SparkleBox Toolbar - {ca4eedb3-5719-4e27-a478-8d13f761c28d} - C:\Program Files\SparkleBox\tbSpa1.dll

O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [storageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser MOUSE\mouse32a.exe

O4 - HKLM\..\Run: [Hiyo] C:\Program Files\HiYo\bin\HiYo.exe /RunFromStartup

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot

O4 - HKCU\..\Run: [ares ultra] "C:\Program Files\Ares Ultra\Ares Ultra.exe" -h

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB0_0_0 -reboot 1

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sarah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.eircom.net

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.5.0_07) -

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Plug-in 1.5.0_10) -

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

O23 - Service: Rapport Management Service (RapportMgmtService) - Unknown owner - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe

--

End of file - 13269 bytes

Katana · August 31, 2009

Please note that all instructions given are customised for this computer only,

the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.

Be assured, any links I give are safe

----------------------------------------------------------------------------------------

Download and Run ComboFix (by sUBs)

Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.

This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

For instructions on how to disable your security programs, please see this topic
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

clipper1981 · August 31, 2009

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those few things, everything should go smoothly
Some of the logs I request will be quite large, You may need to split them over a couple of replies.
Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------
Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:
Bleeping Computer ComboFix Tutorial
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Hi Katana,

Many thanks for your reply. I ran Combofix as advised. Please see log attached log.txt. Gmail is still not opening but I do now get a warning that I am about to enter a page using a secure connection. This was not appearing before.

Thank You.

log.txt

Katana · August 31, 2009

Please can you copy/paste the logs into your post rather than attaching them.

it makes it a lot easier for me.

----------------------------------------------------------------------------------------

Step 1

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
DirLook::
c:\documents and settings\All Users\Application Data\18b06c8
File::
c:\windows\system32\drivers\etc\hosts
ADS::
```
Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

----------------------------------------------------------------------------------------

Step 2

Kaspersky Online Scanner .

Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal

NOTE:- This scan is best done from IE (Internet Explorer)

NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin

Go Here http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html

Read the Requirements and limitations before you click Accept.

Once the database has downloaded, click My Computer in the left pane

Now go and put the kettle on !

When the scan has completed, click Save Report As...

Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)

Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

----------------------------------------------------------------------------------------

Logs/Information to Post in Reply

Please post the following logs/Information in your reply

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Comobofix Log
Kaspersky Log
How are things running now ?

clipper1981 · September 1, 2009

Please can you copy/paste the logs into your post rather than attaching them.
it makes it a lot easier for me.
----------------------------------------------------------------------------------------
Step 1
Custom CFScript
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
DirLook::
c:\documents and settings\All Users\Application Data\18b06c8
File::
c:\windows\system32\drivers\etc\hosts
ADS::
Save this as CFScript.txt and place it on your desktop.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
----------------------------------------------------------------------------------------
Step 2
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.
Comobofix Log
Kaspersky Log
How are things running now ?

ComboLog

ComboFix 09-08-31.03 - Sarah 31/08/2009 21:42.2.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.182 [GMT 1:00]

Running from: c:\documents and settings\Sarah\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Sarah\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::

"c:\windows\system32\drivers\etc\hosts"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\etc\hosts

.

((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 )))))))))))))))))))))))))))))))

.

2009-08-29 07:57 . 2009-08-29 07:57 -------- d-----w- c:\program files\Trend Micro

2009-08-28 18:54 . 2000-11-29 02:07 307200 ----a-w- c:\windows\system\msvcr70.dll

2009-08-28 14:56 . 2009-08-28 14:56 -------- d-----w- c:\windows\system32\wbem\Repository

2009-08-28 14:17 . 2009-08-28 14:37 -------- d-----w- c:\documents and settings\Administrator.DELL-95876CB488\Local Settings\Application Data\Microsoft

2009-08-28 14:17 . 2009-08-04 12:44 -------- d-sh--w- c:\documents and settings\Administrator.DELL-95876CB488\IETldCache

2009-08-28 14:17 . 2009-08-28 14:56 -------- d-----w- c:\documents and settings\Administrator.DELL-95876CB488

2009-08-28 10:56 . 2009-08-28 14:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\SparkleBox

2009-08-28 10:56 . 2009-08-28 14:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\InstantDisplay

2009-08-27 21:57 . 2009-08-28 14:55 -------- d-----w- c:\documents and settings\Sarah\.SunDownloadManager

2009-08-27 21:55 . 2009-08-27 21:55 -------- d-----w- c:\program files\Sun

2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\documents and settings\Sarah\Application Data\Malwarebytes

2009-08-27 17:15 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-27 17:15 . 2009-08-27 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-08-27 17:15 . 2009-08-28 14:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-27 17:15 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-27 16:10 . 2009-06-23 14:22 435704 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\sqlite3.dll

2009-08-27 16:10 . 2009-06-23 14:22 710136 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\mozcrt19.dll

2009-08-23 11:25 . 2009-08-23 11:25 278528 ----a-w- c:\windows\system32\livesnth.dll

2009-08-21 17:24 . 2009-08-21 17:26 -------- d-----w- c:\windows\A4W_DATA

2009-08-21 10:11 . 2009-08-21 10:11 -------- d-----w- c:\program files\Amazon

2009-08-15 13:36 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll

2009-08-14 16:04 . 2009-08-14 16:04 239088 ----a-w- c:\documents and settings\Sarah\Application Data\Mozilla\plugins\npgoogletalk.dll

2009-08-07 16:16 . 2009-08-07 16:16 -------- d-----w- c:\program files\Veetle

2009-08-06 15:20 . 2009-08-06 15:20 -------- d-----w- c:\windows\system32\XPSViewer

2009-08-06 15:20 . 2009-08-06 15:20 -------- d-----w- c:\program files\MSBuild

2009-08-06 15:20 . 2009-08-06 15:20 -------- d-----w- c:\program files\Reference Assemblies

2009-08-06 15:19 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-06 15:19 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-08-06 15:19 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-06 15:19 . 2009-08-06 15:20 -------- d-----w- C:\cece9827c7afca87775ad84889a62a

2009-08-06 15:19 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-06 15:19 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-08-06 15:19 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2009-08-06 15:19 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-08-05 16:05 . 2009-08-05 16:05 152576 ----a-w- c:\documents and settings\Sarah\Application Data\Sun\Java\jre1.6.0_15\lzma.dll

2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll

2009-08-04 12:44 . 2009-08-04 12:44 -------- d-sh--w- c:\documents and settings\Default User\IETldCache

2009-08-04 12:33 . 2009-08-04 12:33 -------- d-----w- c:\program files\Microsoft Works

2009-08-04 12:31 . 2009-08-04 12:31 -------- d-----w- c:\program files\Microsoft.NET

2009-08-04 12:26 . 2009-08-04 12:26 -------- d-----w- c:\documents and settings\Sarah\Local Settings\Application Data\Microsoft Help

2009-08-04 12:25 . 2009-08-04 16:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-08-04 12:23 . 2009-08-04 12:23 -------- d--h--r- C:\MSOCache

2009-08-04 12:07 . 2009-08-04 12:36 -------- d-----w- c:\documents and settings\Sarah\Application Data\GetRightToGo

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-28 15:22 . 2007-05-03 19:51 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip

2009-08-28 14:54 . 2009-08-28 14:54 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-08-28 14:54 . 2009-08-28 14:54 -------- d-sh--w- c:\documents and settings\All Users\Application Data\18b06c8

2009-08-28 14:18 . 2009-08-28 14:18 -------- d-----w- c:\documents and settings\Administrator.DELL-95876CB488\Application Data\Malwarebytes

2009-08-28 08:14 . 2009-02-17 18:53 604280 ----a-w- c:\documents and settings\Sarah\Application Data\HiYo\Data\hiyo_install.exe

2009-08-27 21:55 . 2009-01-01 17:16 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-08-27 21:51 . 2006-06-15 17:20 -------- d-----w- c:\program files\Java

2009-08-22 12:44 . 2006-06-06 08:52 -------- d-----w- c:\documents and settings\Sarah\Application Data\Canon

2009-08-06 18:08 . 2005-12-06 19:00 29640 ----a-w- c:\documents and settings\Sarah\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-05 09:01 . 2004-08-12 14:01 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-31 14:37 . 2009-07-31 09:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2009-07-31 14:37 . 2009-07-31 09:26 -------- d-----w- c:\program files\NOS

2009-07-31 14:37 . 2009-05-04 19:58 -------- d-----w- c:\program files\Microsoft Silverlight

2009-07-31 09:32 . 2005-12-21 19:43 -------- d-----w- c:\program files\Common Files\Adobe

2009-07-31 09:27 . 2009-07-31 09:27 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

2009-07-25 23:35 . 2009-07-25 23:35 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM

2009-07-25 18:00 . 2007-09-28 17:07 28392 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-25 17:59 . 2009-07-25 17:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Trusteer

2009-07-22 20:47 . 2009-04-12 21:50 -------- d-----w- c:\program files\ImageConverter Plus

2009-07-21 12:06 . 2009-07-21 12:06 -------- d-----w- c:\program files\Garmin GPS Plugin

2009-07-21 12:06 . 2006-06-01 21:38 -------- d-----w- c:\program files\DIFX

2009-07-21 12:06 . 2009-07-21 12:06 -------- d-----w- c:\program files\Garmin

2009-07-17 22:06 . 2009-06-04 17:46 -------- d-----w- c:\program files\SparkleBox

2009-07-17 19:01 . 2004-08-12 13:55 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-13 22:43 . 2004-08-12 14:10 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-03 17:09 . 2004-08-12 14:09 915456 ------w- c:\windows\system32\wininet.dll

2009-06-25 08:25 . 2004-08-12 14:08 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2004-08-12 14:04 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2004-08-12 14:04 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:25 . 2004-08-12 14:01 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-25 08:25 . 2004-08-12 13:59 730112 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2004-08-12 13:58 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-06-24 11:18 . 2004-08-12 13:58 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2009-06-16 14:36 . 2004-08-12 14:07 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-16 14:36 . 2004-08-12 13:57 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-12 12:31 . 2004-08-12 14:07 76288 ----a-w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 2004-08-12 13:55 84992 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 08:19 . 2005-12-06 11:53 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 2004-08-12 14:09 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-03 19:09 . 2004-08-12 14:03 1291264 ----a-w- c:\windows\system32\quartz.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\documents and settings\All Users\Application Data\18b06c8 ----

2009-08-27 16:10 . 2009-08-27 16:10 4286 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\WINPS.ico

2009-08-27 16:10 . 2009-08-27 16:10 346 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\78.mof

2009-08-27 16:10 . 2007-05-03 19:54 1660 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\BackUp\WinZip Quick Pick.lnk

2009-08-27 16:10 . 2005-12-06 18:53 1730 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\BackUp\Microsoft Office.lnk

2009-08-27 16:10 . 2009-08-27 16:10 11372 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\WINSPSys\vd952342.bd

2009-08-27 16:10 . 2009-06-23 14:22 710136 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\mozcrt19.dll

2009-08-27 16:10 . 2009-06-23 14:22 435704 ----a-w- c:\documents and settings\All Users\Application Data\18b06c8\sqlite3.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{821b7a96-f0df-4803-808e-e841c9548aa6}]

2009-08-15 13:31 2215960 ----a-w- c:\program files\InstantDisplay\tbIns1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ca4eedb3-5719-4e27-a478-8d13f761c28d}]

2009-07-17 22:06 2215960 ----a-w- c:\program files\SparkleBox\tbSpa1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{821b7a96-f0df-4803-808e-e841c9548aa6}"= "c:\program files\InstantDisplay\tbIns1.dll" [2009-08-15 2215960]

"{ca4eedb3-5719-4e27-a478-8d13f761c28d}"= "c:\program files\SparkleBox\tbSpa1.dll" [2009-07-17 2215960]

[HKEY_CLASSES_ROOT\clsid\{821b7a96-f0df-4803-808e-e841c9548aa6}]

[HKEY_CLASSES_ROOT\clsid\{ca4eedb3-5719-4e27-a478-8d13f761c28d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{821B7A96-F0DF-4803-808E-E841C9548AA6}"= "c:\program files\InstantDisplay\tbIns1.dll" [2009-08-15 2215960]

"{CA4EEDB3-5719-4E27-A478-8D13F761C28D}"= "c:\program files\SparkleBox\tbSpa1.dll" [2009-07-17 2215960]

[HKEY_CLASSES_ROOT\clsid\{821b7a96-f0df-4803-808e-e841c9548aa6}]

[HKEY_CLASSES_ROOT\clsid\{ca4eedb3-5719-4e27-a478-8d13f761c28d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]

"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

"Google Update"="c:\documents and settings\Sarah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 86016]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741]

"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]

"Dell AIO Printer A920"="c:\program files\Dell AIO Printer A920\dlbkbmgr.exe" [2003-05-12 270336]

"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]

"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2005-01-18 458752]

"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]

"FLMOFFICE4DMOUSE"="c:\program files\Browser MOUSE\mouse32a.exe" [2007-05-03 360448]

"Hiyo"="c:\program files\HiYo\bin\HiYo.exe" [2009-03-19 197936]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-02 1601304]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-27 149280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-9-15 83360]

WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-6-25 525640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]

2004-01-12 06:55 110592 ----a-w- c:\windows\system32\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-02-02 21:18 10520 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\WINDOWS\\system32\\LEXPPS.EXE"=

"c:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Documents and Settings\\Sarah\\Application Data\\SopCast\\adv\\SopAdver.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Documents and Settings\\Sarah\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\Sarah\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"61239:TCP"= 61239:TCP:U torrent

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [02/02/2009 22:18 325128]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [02/02/2009 22:18 107272]

R1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [27/04/2009 19:52 57320]

R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [27/04/2009 19:52 238952]

R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [02/02/2009 22:17 298264]

R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [05/06/2009 08:40 648424]

S3 NTPASp50;NTPASp50 NDIS Protocol Driver;c:\windows\system32\drivers\NtpaSp50.sys [11/04/2009 13:37 17536]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-08-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644491937-1343024091-1957994488-1004Core.job

- c:\documents and settings\Sarah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-15 13:06]

2009-08-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1644491937-1343024091-1957994488-1004UA.job

- c:\documents and settings\Sarah\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-11-15 13:06]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.ie/

uInternet Settings,ProxyOverride = localhost;*.local

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FF - ProfilePath - c:\documents and settings\Sarah\Application Data\Mozilla\Firefox\Profiles\jd5ho9kr.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - www.google.ie

FF - prefs.js: keyword.URL - hxxp://mystart.hiyo.com/?loc=ff_address&search=

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-31 21:53

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1644491937-1343024091-1957994488-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{CFA61814-4B78-7ED1-2F22-CCBF032EDCE3}*]

"bbbmdmckkfhhjemdmpeaaobfeehebmkphdca"=hex:61,61,00,00

"abbmdmckkfhhjemdmpfapmhmijbaehilhh"=hex:61,61,00,00

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(856)

c:\windows\system32\LgNotify.dll

c:\windows\system32\igfxsrvc.dll

c:\windows\system32\hccutils.DLL

.

Completion time: 2009-08-31 21:58

ComboFix-quarantined-files.txt 2009-08-31 20:57

ComboFix2.txt 2009-08-31 19:09

Pre-Run: 2,553,950,208 bytes free

Post-Run: 2,547,699,712 bytes free

237 --- E O F --- 2009-08-26 09:35

Kas Log

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Tuesday, September 1, 2009

Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Tuesday, September 01, 2009 09:49:21

Records in database: 2734627

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

D:\

Scan statistics:

Objects scanned: 73110

Threats found: 0

Infected objects found: 0

Suspicious objects found: 0

Scan duration: 03:02:49

No threats found. Scanned area is clean.

Selected area has been scanned.

All seems good now. I can access gmail and search with Google. Please let me know if I need to do anything else. Thanks for your help.

Katana · September 1, 2009

----------------------------------------------------------------------------------------

Step 1

Installed Programs

Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.

Click on save list button and specify where you would like to save this file.

When you press Save button a notepad will open with the contents of that file.

Simply copy and paste the contents of that notepad into your next post.

----------------------------------------------------------------------------------------

Step 2

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

FCopy::
c:\documents and settings\All Users\Application Data\18b06c8\BackUp\WinZip Quick Pick.lnk|c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
c:\documents and settings\All Users\Application Data\18b06c8\BackUp\Microsoft Office.lnk|c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
Folder::
c:\documents and settings\All Users\Application Data\18b06c8

ADS::

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

----------------------------------------------------------------------------------------

Logs/Information to Post in Reply

Please post the following logs/Information in your reply

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Installed Programs List
Combofix Log
A fresh HJT Log

clipper1981 · September 1, 2009

----------------------------------------------------------------------------------------
Step 1
Installed Programs
Please could you give me a list of the programs that are installed.
Start HijackThis
Click on the Misc Tools button
Click on the Open Uninstall Manager button.
You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.
----------------------------------------------------------------------------------------
Step 2
Custom CFScript
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
FCopy::
c:\documents and settings\All Users\Application Data\18b06c8\BackUp\WinZip Quick Pick.lnk|c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
c:\documents and settings\All Users\Application Data\18b06c8\BackUp\Microsoft Office.lnk|c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
Folder::
c:\documents and settings\All Users\Application Data\18b06c8

ADS::
Save this as CFScript.txt and place it on your desktop.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.
Installed Programs List
Combofix Log
A fresh HJT Log

Combo Log

ComboFix 09-08-31.03 - Sarah 01/09/2009 13:28.3.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.282 [GMT 1:00]

Running from: c:\documents and settings\Sarah\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Sarah\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\18b06c8

c:\documents and settings\All Users\Application Data\18b06c8\78.mof

c:\documents and settings\All Users\Application Data\18b06c8\BackUp\Microsoft Office.lnk

c:\documents and settings\All Users\Application Data\18b06c8\BackUp\WinZip Quick Pick.lnk

c:\documents and settings\All Users\Application Data\18b06c8\mozcrt19.dll

c:\documents and settings\All Users\Application Data\18b06c8\sqlite3.dll

c:\documents and settings\All Users\Application Data\18b06c8\WINPS.ico

c:\documents and settings\All Users\Application Data\18b06c8\WINSPSys\vd952342.bd

.

--------------- FCopy ---------------

c:\documents and settings\All Users\Application Data\18b06c8\BackUp\WinZip Quick Pick.lnk --> c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

c:\documents and settings\All Users\Application Data\18b06c8\BackUp\Microsoft Office.lnk --> c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

.

((((((((((((((((((((((((( Files Created from 2009-08-01 to 2009-09-01 )))))))))))))))))))))))))))))))