Hidden virus?

KPP · November 17, 2009

Ron,

Here's my new post.

Kate

AdvancedSetup · November 17, 2009

Please disable your Anti-Virus and run the following and post back the log.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

If this doesn't work either, try the same method (above method), but name Combofix.exe to iexplore.exe instead, or winlogon.exe..

This because It also happens in some cases that malware blocks EVERY process except for what is in its own whitelist, so this whitelist also includes system important processes such as iexplore.exe, explorer.exe, winlogon.exe...

KPP · November 20, 2009

New topic opened per Advanced Setup.

KPP · November 20, 2009

Please disable your Anti-Virus and run the following and post back the log.
[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

Ron,

Here's the log file from Combo-Fix:

ComboFix 09-11-19.05 - Kate 11/20/2009 0:14.4.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.78 [GMT -6:00]

Running from: c:\documents and settings\Kate\Desktop\Combo-Fix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))

.

2009-11-20 03:44 . 2009-02-13 22:01 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updext.dll

2009-11-20 03:44 . 2009-07-21 20:40 404737 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.exe

2009-11-20 03:44 . 2009-04-09 16:20 79105 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\updaterc.dll

2009-11-20 03:44 . 2009-06-03 22:26 345345 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\update.dll

2009-11-20 03:44 . 2008-12-05 17:32 126721 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\UPDATE\TMP_UPDATE\scewxmlw.dll

2009-11-14 04:56 . 2009-03-30 16:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-11-14 04:56 . 2009-02-13 18:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-11-14 04:56 . 2009-02-13 18:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-11-14 04:56 . 2009-11-14 04:56 -------- d-----w- c:\program files\Avira

2009-11-14 04:56 . 2009-11-14 04:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-11-13 04:50 . 2009-11-13 04:50 -------- d-----w- c:\documents and settings\Kate\Application Data\ElevatedDiagnostics

2009-11-13 04:47 . 2009-11-13 04:47 -------- d-----w- c:\program files\Microsoft ATS

2009-11-04 01:20 . 2009-11-04 01:20 -------- d-----w- c:\program files\Microsoft IntelliType Pro

2009-11-03 15:18 . 2009-11-03 15:17 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-11-03 15:16 . 2009-11-03 15:16 152576 ----a-w- c:\documents and settings\Kate\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-17 17:33 . 2009-06-08 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-17 07:22 . 2008-09-26 05:29 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-11-15 07:50 . 2004-06-26 23:02 -------- d-----w- c:\program files\Common Files\InstallShield

2009-11-07 02:04 . 2004-06-27 03:00 87056 -c--a-w- c:\documents and settings\Kate\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-11-03 15:16 . 2005-06-22 03:00 -------- d-----w- c:\program files\Java

2009-10-12 06:29 . 2009-10-12 06:29 -------- d-----w- c:\program files\Trend Micro

2009-10-11 06:04 . 2007-10-19 04:43 -------- d-----w- c:\program files\DivX

2009-10-11 06:03 . 2009-03-15 08:56 -------- d-----w- c:\program files\Common Files\DivX Shared

2009-09-25 22:57 . 2007-05-23 05:44 -------- d-----w- c:\documents and settings\Kate\Application Data\Move Networks

2009-09-25 22:57 . 2009-07-30 06:34 126970 -c--a-w- c:\documents and settings\Kate\Application Data\Move Networks\uninstall.exe

2009-09-25 22:57 . 2009-08-03 21:48 4187512 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\plugins\npqmp071505000010.dll

2009-09-25 22:56 . 2009-09-25 22:56 1407680 ----a-w- c:\documents and settings\Kate\Application Data\Move Networks\MoveMediaPlayerWin_071505000010.exe

2009-09-11 14:18 . 2008-09-21 22:46 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-09-04 21:03 . 2001-08-23 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll

2009-08-29 07:36 . 2004-01-08 20:23 832512 ----a-w- c:\windows\system32\wininet.dll

2009-08-29 07:36 . 2004-08-04 07:56 78336 -c--a-w- c:\windows\system32\ieencode.dll

2009-08-29 07:36 . 2001-08-23 12:00 17408 -c--a-w- c:\windows\system32\corpol.dll

2009-08-26 08:00 . 2001-08-23 12:00 247326 -c--a-w- c:\windows\system32\strmdll.dll

2008-06-19 08:42 . 2006-04-27 04:24 122880 -c--a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-03 149280]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-03-26 1442888]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\uTorrent\\utorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/13/2009 10:56 PM 108289]

S3 AdWatchDrv;AW Realtime Driver;\??\c:\windows\system32\drivers\AWRTPD.sys --> c:\windows\system32\drivers\AWRTPD.sys [?]

.

Contents of the 'Scheduled Tasks' folder

2009-10-19 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-11-15 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 23:36]

2009-11-20 c:\windows\Tasks\User_Feed_Synchronization-{566C0DF4-C73B-4F7B-A67A-6B19000EC267}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 23:36]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://dallas.craigslist.org/wrg/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

Trusted Zone: abc.com

Trusted Zone: abc.com\ll.media

Trusted Zone: fox.com\gksrv

Trusted Zone: fox.com\www

Trusted Zone: go.com\abc

Trusted Zone: go.com\fep.abc

Trusted Zone: google.com\www

Trusted Zone: ncspearson.com

FF - ProfilePath - c:\documents and settings\Kate\Application Data\Mozilla\Firefox\Profiles\dav8808z.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://dallas.craigslist.org/dal/etc/

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-aawservice

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-20 00:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]

"abhmjphalfajeibgjfpgapeghgpbkecbcd"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,

6a,68,62,66,63,6d,6c,65,00,00

"iafmdbjjdpioemkknk"=hex:61,61,00,01

"hahmjphalfajeibg"=hex:61,61,00,01

"iajfdoahpdengkffgh"=hex:61,61,00,01

"bbfmdbjjdpioemkknkkddcelccconlkpjgli"=hex:6a,61,63,64,64,6c,63,65,64,67,67,6a,

6f,6a,62,69,6a,63,69,63,00,00

"abhmjphalfajeibgjfpgapeghgkblgoclc"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,

6a,68,62,66,63,6d,6c,65,00,00

"bbfmdbjjdpioemkknkkddcelcccoieejlbni"=hex:6a,61,63,64,6d,6a,6e,61,69,6b,6a,70,

6a,68,62,66,63,6d,6c,65,00,00

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1272)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2009-11-20 00:52

ComboFix-quarantined-files.txt 2009-11-20 06:52

Pre-Run: 9,118,425,088 bytes free

Post-Run: 9,799,245,824 bytes free

- - End Of File - - D2258117C7208933EFCAD169CEAF3EBC

HTJ Log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:07:06 AM, on 11/20/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16915)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\notepad.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dallas.craigslist.org/wrg/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O15 - Trusted Zone: ll.media.abc.com

O15 - Trusted Zone: http://*.abc.com

O15 - Trusted Zone: gksrv.fox.com

O15 - Trusted Zone: http://www.fox.com

O15 - Trusted Zone: http://abc.go.com

O15 - Trusted Zone: fep.abc.go.com

O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} (Diagnostics ActiveX WebControl) - http://support.microsoft.com/mats/DiagWebControl.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--

AdvancedSetup · November 20, 2009

STEP 00

You may have corrupted files on your disk. Please try running the following.

First close ALL Applications as this routine will automatically restart your computer.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /F | SHUTDOWN /R /T 30

STEP 01

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
Disconnect from the Internet.
Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

STEP 02

Please download the following scanning tool. GMER

Download the randomly named EXE and copy the file to your Desktop. Remember what its name is.
Double click on
random named exe file
and run it.
It may take a minute to load and become available.
Do not make any changes. Click on the
SCAN
button and DO NOT use the computer while it's scanning.
Once the scan is done click on the
SAVE
button and browse to your Desktop and save the file as
GMER.LOG
Zip up the
GMER.LOG
file and save it as
gmerlog.zip
and attach it to your reply post.
DO NOT
directly post this log into a reply. You
MUST
attach it as a .ZIP file.
Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP

Compress and uncompress files (zip files) in Vista

STEP 03

RootRepeal - Rootkit Detector

Close ALL applications and as many items in the task tray that will stop and exit.

Please download the following tool:
RootRepeal - Rootkit Detector
Direct download link is here:
RootRepeal.rar
If you don't already have a program to open a .RAR compressed file you can download a trial version from here:
WinRAR
Extract the program file to a new folder such as
C:\RootRepeal
Run the program
RootRepeal.exe
and go to the
REPORT
tab and click on the
Scan
button
Select
ALL
of the checkboxes and then click
OK
and it will start scanning your system.
If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
When done, click on
Save Report
Save it to the same location where you ran it from, such as
C:\RootRepeal
Save it as
your_name_rootrepeal.txt
- where your_name is your
forum name
This makes it more easy to track who the log belongs to.
Then open that log and select all and copy/paste it back on your next reply please.
Quit the RootRepeal program.

STEP 04

Please create a BOOTLOG

Delete the following file if it exists. C:\Windows\ntbtlog.txt
Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
Select "Enable Boot Logging" option and press enter.
Windows prompts you to select a Windows Installation (even if there is only one windows installation)
This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows

KPP · November 20, 2009

Ron,

I have a work project online starting tomorrow through next Wednesday. I'd rather wait till after that so as not to have any issues during the project.

Is there any chance you can help me get my new keyboard operational? It's a Dynex Wired Keyboard DX-WKBD, and I've tried all my USB ports. It does work on another computer.

The following is a list of USB controllers in Device Manager. All but one are "working properly." The first one, Intel®82801DB/DBM USB 2.0 Enhanced Host Controller - 24CD [X] states "No drivers are installed for this device."

Universal Serial Bus controllers

Intel®82801DB/DBM USB 2.0 Enhanced Host Controller - 24CD [X]

Intel®82801DB/DBM USB Universal Host Controller - 24C2

" " " " - 24C4

" " " " - 24C7

" " " "

USB Root Hub

" "

Thanks,

Kate

AdvancedSetup · November 20, 2009

Right click on it and remove. Then reboot. If it's real it will come back and want a driver. Check in your BIOS and make sure all the USB ports are enabled.

Well if you're not going to work on the Malware scans then I'll close your post and when you're ready you can send me a PM and we can start back up again.

AdvancedSetup · November 30, 2009

Reopened at user request.

KPP · December 2, 2009

Ron,

I have tried to follow all/most of your instructions, but I am now confused about what to post. what to zip/attach, and what's left to do.

Here's what I have so far:

Combo-fix log.txt

hijackthis.log

DDS.txt

Attach.txt

ark.txt

Also, should I delete the attachments I previously uploaded?

Thanks,

Kate

AdvancedSetup · December 2, 2009

Please post or attach either one is fine. I'll review all of them and let you know what if anything I find.

KPP · December 2, 2009

Please post or attach either one is fine. I'll review all of them and let you know what if anything I find.

Here goes!

AdvancedSetup · December 5, 2009

STEP 01

Please uninstall the following software until we've completed assisting you.

You can re-install it once we're done.

KPP · December 5, 2009

STEP 01

Please uninstall the following software until we've completed assisting you.
You can re-install it once we're done.

AdvancedSetup · December 6, 2009

Okay please try editing your CFSCRIPT.TXT file and use this entry instead. Save the file and drop it on Combofix again.

RegNull::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]

Then run the following.

Please download and run the following fix from Microsoft How do I restore security settings to the default settings?

When completed please reboot your computer.

Post back the Combofix log again.

KPP · December 6, 2009

STEP 03
Please download the following program to your desktop. Close all other open applications and then run the program.
It will restore file permissions to the system and automatically restart the computer when done.
restoredefaultperms.exe

Please download and run the following fix from Microsoft How do I restore security settings to the default settings?

Done

STEP 04
You may have corrupted files on your disk. Please try running the following.
First close ALL Applications as this routine will automatically restart your computer.
Click on START - RUN and copy / paste the following entry into the box and click OK.
Okay please try editing your CFSCRIPT.TXT file and use this entry instead. Save the file and drop it on Combofix again.

RegNull::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]
RegLock::
[HKEY_USERS\S-1-5-21-1715567821-1682526488-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6673C15A-B55F-C27D-13C0-E159CFCA1E2F}*]

Done

Post back the Combofix log again.

ComboFix 09-12-05.06 - Kate 12/06/2009 6:54.8.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.129 [GMT -6:00]

Running from: c:\documents and settings\Kate\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\Kate\Desktop\CFscript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

((((((((((((((((((((((((( Files Created from 2009-11-06 to 2009-12-06 )))))))))))))))))))))))))))))))

.

2009-11-29 09:41 . 2009-03-30 15:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2009-11-29 09:41 . 2009-02-13 17:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2009-11-29 09:41 . 2009-02-13 17:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\program files\Avira

2009-11-29 09:41 . 2009-11-29 09:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2009-11-13 04:50 . 2009-11-13 04:50 -------- d-----w- c:\documents and settings\Kate\Application Data\ElevatedDiagnostics

2009-11-13 04:47 . 2009-11-13 04:47 -------- d-----w- c:\program files\Microsoft ATS

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-06 11:06 . 2004-06-27 03:00 87056 -c--a-w- c:\documents and settings\Kate\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-06 00:29 . 2008-09-26 05:29 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-12-05 09:45 . 2009-07-11 04:41 -------- d-----w- c:\program files\Common Files\Apple

2009-12-01 04:31 . 2009-06-08 12:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-11-15 07:50 . 2004-06-26 23:02 -------- d-----w- c:\program files\Common Files\InstallShield

2009-11-04 01:20 . 2009-11-04 01:20 -------- d-----w- c:\program files\Microsoft IntelliType Pro

2009-11-03 15:17 . 2009-11-03 15:18 411368 ----a-w- c:\windows\system32\deploytk.dll