Jump to content

Can't Remove Redirect Virus - Help!

JarAce

By JarAce
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

We can't do anything without logs. Please post the log from malwarebytes.

Also, Please download DDS and save it to your desktop.

  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.

---------------------------------------------------

Copy and paste the contents of DDS.txt in your next reply. Do not copy and paste the contents of Attach.txt, but attach it to your reply instead.

Link to post
Share on other sites
JarAce

JarAce

Posted
  • Author
Posted

Sorry,

I have been out of town. Thanks for your response. I reran the Malwarebytes complete scan. The log file is posted below. I have also posted the DDS log.

==========================

mbam-log-2010-01-11(15-17-16).txt

Malwarebytes' Anti-Malware 1.44

Database version: 3542

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

1/11/2010 3:17:16 PM

mbam-log-2010-01-11 (15-17-16).txt

Scan type: Full Scan (C:\|)

Objects scanned: 232515

Time elapsed: 28 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

END OF FILE===========================

DDS.txt

----------

DDS (Ver_09-12-01.01) - NTFSx86

Run by jar1153 at 15:31:55.55 on Mon 01/11/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3292.2185 [GMT -6:00]

AV: eTrust ITM *On-access scanning enabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe

C:\Program Files\CA\eTrustITM\InoRpc.exe

C:\Program Files\CA\eTrustITM\InoRT.exe

C:\Program Files\CA\eTrustITM\InoTask.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Novell\ZENworks\Asset Management\bin\CClientSvc.exe

C:\Program Files\Webroot\Client\commagent.exe

C:\Program Files\Novell\ZENworks\Asset Management\bin\CClient.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Webroot\Client\spysweeper.exe

C:\WINDOWS\inf\explorer.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\CA\eTrustITM\realmon.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Webroot\Client\SpySweeperUI.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Novell\Messenger\NMCL32.exe

C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Novell\GroupWise\grpwise.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Novell\GroupWise\Notify.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Novell\GroupWise\addrbook.exe

C:\Program Files\Microsoft Office\Office12\MSACCESS.EXE

C:\Program Files\Microsoft Office\Office12\GRAPH.EXE

C:\Program Files\Microsoft Office\Office12\GRAPH.EXE

C:\Program Files\Microsoft Office\Office12\GRAPH.EXE

C:\WINDOWS\system32\mstsc.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Notepad++\notepad++.exe

C:\Documents and Settings\jar1153\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dcccd.edu/

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

mWinlogon: Shell=inf/explorer.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program

files\real\realplayer\rpbrowserrecordplugin.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Google Update] "c:\documents and settings\jar1153\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [Novell Messenger] "c:\novell\messenger\NMCL32.exe"

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"

mRun: [NWTRAY] "NWTRAY.EXE"

mRun: [Realtime Monitor] "c:\program files\ca\etrustitm\realmon.exe" -s

mRun: [igfxTray] "c:\windows\system32\igfxtray.exe"

mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"

mRun: [Persistence] "c:\windows\system32\igfxpers.exe"

mRun: [soundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe"

mRun: [WebrootClientUI] "c:\program files\webroot\client\SpySweeperUI.EXE" /StartInTray

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRunOnce: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /install /silent

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\jar1153\startm~1\programs\startup\grpwis~1.lnk - c:\novell\groupwise\grpwise.exe

StartupFolder: c:\docume~1\jar1153\startm~1\programs\startup\taskmg~1.lnk - c:\windows\system32\taskmgr.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

uPolicies-explorer: NoSMHelp = 01000000

mPolicies-system: CompatibleRUPSecurity = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - c:\novell\messen~1\NMCL32.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259015365959

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8B0F07E1-00F9-4B1B-9A2F-456DC0F54EBF} - hxxp://khse.vlab.elementk.com/vlab/ax/PortTester.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E99D3E39-5D92-4360-BA86-2C563B3CFFEB} - hxxp://cmstraining.dcccd.edu/DCCCD/CMS/WebAuthor/Client/PlaceholderControlSupport/nrdhtml.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: nim - {3D206AE2-3039-413B-B748-3ACC562EC22A} - c:\novell\messenger\nmcg32.dll

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

LSA: Authentication Packages = msv1_0 nwv1_0

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jar1153\applic~1\mozilla\firefox\profiles\cm7wckyb.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.dcccd.edu/

FF - component: c:\documents and settings\jar1153\application

data\mozilla\firefox\profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\jar1153\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows

presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 atiide;ATI SATA Controller IDE mode;c:\windows\system32\drivers\atiide.sys [2009-9-28 3456]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-9-28 24064]

R0 ssfs0bbc;Spy Sweeper File System Filter Driver: 0BBC;c:\windows\system32\drivers\ssfs0bbc.sys [2009-8-25 30136]

R2 TSCensus Collection Client;ZENworks Asset Management - Collection Client;c:\program files\novell\zenworks\asset management\bin\CClientSvc.exe [2009-10-30

49152]

R2 WebrootCommAgentService;Webroot CommAgent Service;c:\program files\webroot\client\CommAgent.exe [2009-8-25 715176]

R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [2009-10-30 9176]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2009-9-28 144992]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-1-5 38224]

R3 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\client\SPYSWEEPER.EXE [2009-8-25 4110352]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]

S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688]

=============== Created Last 30 ================

2010-01-11 16:55:09 0 d-----w- c:\documents and settings\jar1153\Job Aids

2010-01-07 16:47:05 0 d-----w- c:\program files\trend micro

2010-01-06 23:12:45 0 d-----w- c:\program files\Microsoft ActiveSync

2010-01-05 16:26:12 0 d-----w- c:\documents and settings\jar1153\Projects

2010-01-05 16:23:40 0 d-----w- c:\documents and settings\jar1153\Forms

2010-01-05 16:05:35 0 d-----w- c:\docume~1\jar1153\applic~1\Malwarebytes

2010-01-05 16:05:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-05 16:05:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-05 16:05:30 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-05 16:05:30 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-04 20:28:17 0 d-----w- c:\docume~1\jar1153\applic~1\Windows Search

2010-01-04 15:56:37 0 d-----w- c:\docume~1\jar1153\applic~1\Windows Desktop Search

2010-01-04 15:56:07 0 d-----w- c:\program files\Windows Desktop Search

2010-01-04 15:55:31 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll

2010-01-04 15:55:31 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll

2010-01-04 15:55:31 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll

2009-12-21 18:23:56 0 d-----w- C:\JwSoftworks

2009-12-18 20:07:44 3249 ----a-w- c:\windows\system32\wbem\Outlook_01ca801dc2b51f83.mof

2009-12-17 14:43:19 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-12-17 14:43:19 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-12-17 14:43:18 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-12-17 14:43:18 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-12-17 11:29:34 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2009-12-16 23:20:42 0 d-----w- c:\documents and settings\jar1153\code_js

2009-12-14 20:07:00 0 d-----w- c:\documents and settings\jar1153\mcsmtest

2009-12-14 15:08:58 11 ----a-w- c:\windows\NetWare.INI

==================== Find3M ====================

2010-01-08 06:09:53 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-01-07 19:04:23 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2009-11-28 20:37:06 6144 ----a-w- c:\windows\system32\BioPdf.PdfWriter.Lib.dll

2009-10-29 07:45:38 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-09-28 15:27:00 73728 ----a-w- c:\windows\inf\uiu\t2\rtnicprop32.dll

2009-09-28 15:27:00 67584 ----a-w- c:\windows\inf\uiu\t2\rtnicprop64.dll

2009-09-28 15:27:00 63872 ----a-w- c:\windows\inf\uiu\t1\sisraid4.sys

2009-09-28 15:27:00 159744 ----a-w- c:\windows\inf\uiu\t1\property.dll

2009-09-28 15:27:00 156672 ----a-w- c:\windows\inf\uiu\t2\rtenic64.sys

2009-09-28 15:27:00 130688 ----a-w- c:\windows\inf\uiu\t2\rtenicxp.sys

2009-09-28 15:27:00 129024 ----a-w- c:\windows\inf\uiu\t2\rtenic.sys

2009-09-28 15:25:55 80128 ----a-w- c:\windows\inf\uiu\x86\oxpar.sys

2009-09-28 15:24:55 372736 ----a-w- c:\windows\inf\uiu\b_61170\atidemgx.dll

2009-09-28 15:23:59 266240 ----a-w- c:\windows\inf\uiu\t5\rtcomdll.dll

2009-09-28 15:22:59 659456 ----a-w- c:\windows\inf\uiu\netw5c32.dll

2009-09-28 15:21:51 75264 ----a-w- c:\windows\inf\uiu\snxppalx.sys

2009-09-28 15:20:41 92768 ----a-w- c:\windows\inf\uiu\t3\e1qmsg.dll

2009-09-28 15:19:56 344064 ----a-w- c:\windows\inf\uiu\b_50254\atidemgx.dll

2009-09-28 15:18:53 307200 ----a-w- c:\windows\inf\uiu\b_44319\atiiiexx.dll

2009-09-28 15:17:56 75520 ----a-w- c:\windows\inf\uiu\51\agr1310_51.sys

2009-09-28 15:16:47 307200 ----a-w- c:\windows\inf\uiu\b_23862\atiiiexx.dll

2009-09-28 15:15:57 307200 ----a-w- c:\windows\inf\uiu\b_24491\atiiiexx.dll

2009-09-28 15:14:59 229376 ----a-w- c:\windows\inf\uiu\b_10679\atiiiexx.dll

2009-09-28 15:13:59 682624 ----a-w- c:\windows\inf\uiu\t6\hsf_cnxt.sys

2008-04-14 10:42:20 1033216 ----a-w- c:\windows\inf\explorer.exe

============= FINISH: 15:33:00.94 ===============

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Link to post
Share on other sites
JarAce

JarAce

Posted
  • Author
Posted

Here is the ComboFix log:

ComboFix 10-01-11.01 - jar1153 01/11/2010 17:25:08.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3292.2729 [GMT -6:00]

Running from: c:\documents and settings\jar1153\Desktop\ComboFix.exe

AV: eTrust ITM *On-access scanning disabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\jar1153\LOCALS~1\Temp\install_flash_player.exe

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\All Users\Start Menu\Internet Explorer.lnk

c:\recycler\S-1-5-21-57989841-261903793-839522115-500

----- BITS: Possible infected sites -----

hxxp://dscsus1.dcccd.edu

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected

Restored copy from - Kitty ate it ;)

.

((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))

.

2010-01-11 20:47 . 2010-01-11 20:47 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-11 20:15 . 2010-01-11 20:16 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe

2010-01-11 16:55 . 2010-01-11 16:56 -------- d-----w- c:\documents and settings\jar1153\Job Aids

2010-01-07 16:47 . 2010-01-07 16:47 -------- d-----w- c:\program files\trend micro

2010-01-07 16:47 . 2010-01-07 16:47 -------- d-----w- C:\rsit

2010-01-06 23:12 . 2010-01-06 23:12 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-01-05 16:26 . 2010-01-05 16:26 -------- d-----w- c:\documents and settings\jar1153\Projects

2010-01-05 16:23 . 2010-01-05 16:25 -------- d-----w- c:\documents and settings\jar1153\Forms

2010-01-05 16:05 . 2010-01-05 16:05 -------- d-----w- c:\documents and settings\jar1153\Application Data\Malwarebytes

2010-01-05 16:05 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-05 16:05 . 2010-01-05 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-05 16:05 . 2010-01-11 20:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-05 16:05 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-04 20:33 . 2010-01-04 20:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2010-01-04 20:28 . 2010-01-04 20:28 -------- d-----w- c:\documents and settings\jar1153\Application Data\Windows Search

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\jar1153\Local Settings\Application Data\Identities

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\jar1153\Application Data\Windows Desktop Search

2010-01-04 15:56 . 2010-01-05 15:54 -------- d-----w- c:\program files\Windows Desktop Search

2010-01-04 15:55 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll

2010-01-04 15:55 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll

2010-01-04 15:55 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll

2010-01-04 14:55 . 2010-01-04 14:55 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-12-24 14:49 . 2009-12-24 14:49 -------- d-----w- c:\windows\Sun

2009-12-23 21:28 . 2007-12-30 11:01 307200 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe

2009-12-23 21:28 . 2007-12-30 11:01 172032 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe

2009-12-23 21:28 . 2007-12-30 11:01 90112 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll

2009-12-21 18:23 . 2010-01-04 20:27 -------- d-----w- C:\JwSoftworks

2009-12-21 17:38 . 2009-12-21 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2009-12-17 14:43 . 2008-04-14 11:42 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-12-17 14:43 . 2001-08-18 04:36 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-12-17 14:43 . 2008-04-14 06:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-12-17 14:43 . 2008-04-14 06:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-12-17 11:29 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2009-12-16 23:20 . 2009-12-21 17:42 -------- d-----w- c:\documents and settings\jar1153\code_js

2009-12-14 20:07 . 2009-12-14 20:07 -------- d-----w- c:\documents and settings\jar1153\mcsmtest

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-11 17:29 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-01-08 06:09 . 2009-08-31 17:27 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-01-07 19:04 . 2004-08-04 03:59 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2009-12-23 16:34 . 2009-08-31 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic

2009-12-22 21:33 . 2009-08-27 14:42 70000 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-16 18:25 . 2009-11-19 16:49 -------- d-----w- c:\program files\Notepad++

2009-12-11 17:11 . 2009-09-14 21:27 -------- d-----w- c:\program files\MSECache

2009-12-11 14:56 . 2009-12-11 14:47 -------- d-----w- c:\documents and settings\jar1153\Application Data\GetRightToGo

2009-12-09 21:11 . 2009-12-09 21:11 -------- d-----w- c:\documents and settings\jar1153\Application Data\PDF Writer

2009-12-09 21:11 . 2009-12-09 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PDF Writer

2009-12-09 21:09 . 2009-12-09 21:09 -------- d-----w- c:\program files\Common Files\Bullzip

2009-12-09 21:09 . 2009-12-09 21:09 -------- d-----w- c:\program files\Bullzip

2009-12-03 15:12 . 2009-12-03 15:12 -------- d-----w- c:\program files\DebugMode

2009-11-30 17:17 . 2009-11-30 17:17 -------- d-----w- c:\program files\Microsoft Works

2009-11-30 17:17 . 2009-09-14 23:02 -------- d-----w- c:\program files\MSBuild

2009-11-30 17:15 . 2009-11-30 17:15 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2009-11-28 20:37 . 2009-12-09 21:09 6144 ----a-w- c:\windows\system32\BioPdf.PdfWriter.Lib.dll

2009-11-25 18:48 . 2009-11-25 18:48 -------- d-----w- c:\documents and settings\jar1153\Application Data\Yahoo!

2009-11-25 18:47 . 2009-11-25 18:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!

2009-11-25 18:47 . 2009-11-25 18:45 -------- d-----w- c:\program files\Yahoo!

2009-11-24 18:14 . 2009-08-31 17:27 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-11-23 22:37 . 2009-11-23 22:37 193824 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VBExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:37 . 2009-11-23 22:14 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll

2009-11-23 22:36 . 2009-11-23 22:13 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0

2009-11-23 22:33 . 2009-11-23 22:33 488576 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VWDExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:32 . 2009-11-23 22:32 -------- d-----w- c:\program files\Microsoft Web Designer Tools

2009-11-23 22:23 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft SQL Server

2009-11-23 22:23 . 2009-11-23 22:23 -------- d-----w- c:\program files\MSXML 6.0

2009-11-23 22:23 . 2009-11-23 22:13 -------- d-----w- c:\program files\Microsoft.NET

2009-11-23 22:15 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft Synchronization Services

2009-11-23 22:15 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2009-11-23 22:14 . 2009-11-23 22:14 187328 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:12 . 2009-11-23 22:12 -------- d-----w- c:\program files\Microsoft SDKs

2009-11-21 15:51 . 2004-08-04 05:56 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2009-11-20 00:25 . 2009-11-20 00:19 -------- d-----w- c:\program files\Microsoft Office2007

2009-11-19 16:49 . 2009-11-19 16:49 -------- d-----w- c:\documents and settings\jar1153\Application Data\Notepad++

2009-11-10 20:39 . 2009-11-25 18:47 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

2009-10-30 23:59 . 2009-10-30 23:59 9176 ----a-w- c:\windows\system32\drivers\WNTHW.SYS

2009-10-29 07:45 . 2004-08-04 05:56 916480 ----a-w- c:\windows\system32\wininet.dll

2009-10-21 05:38 . 2004-08-04 05:56 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38 . 2004-08-04 05:56 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 04:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\documents and settings\jar1153\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-11-19 135664]

"Novell Messenger"="c:\novell\Messenger\NMCL32.exe" [2006-02-08 1400903]

"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2009-11-10 5244216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NWTRAY"="NWTRAY.EXE" [2002-03-12 28672]

"Realtime Monitor"="c:\program files\CA\eTrustITM\realmon.exe" [2007-01-17 407632]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-28 143360]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-28 172032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-28 143360]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-09-28 1044480]

"WebrootClientUI"="c:\program files\Webroot\Client\SpySweeperUI.EXE" [2009-08-25 435624]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\jar1153\Start Menu\Programs\Startup\

grpwise.exe.lnk - c:\novell\GroupWise\grpwise.exe [2008-3-10 5850448]

taskmgr.exe.lnk - c:\windows\system32\taskmgr.exe [2004-8-3 135680]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 01000000

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-11787\Scripts\Logon\0\0]

"Script"=DS-UserLogonScript.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-11787\Scripts\Logon\1\0]

"Script"=pushprinterconnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-21030\Scripts\Logon\0\0]

"Script"=DS-UserLogonScript.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-21030\Scripts\Logon\1\0]

"Script"=pushprinterconnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-26461\Scripts\Logon\0\0]

"Script"=DS-UserLogonScript.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-26461\Scripts\Logon\1\0]

"Script"=pushprinterconnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-38181\Scripts\Logon\0\0]

"Script"=DS-UserLogonScript.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-1715567821-839522115-38181\Scripts\Logon\1\0]

"Script"=pushprinterconnections.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Novell\\GroupWise\\grpwise.exe"=

"c:\\Novell\\GroupWise\\notify.exe"=

"c:\\DATATEL\\UI\\wIntegSM.exe"=

"c:\\Program Files\\CA\\eTrustITM\\InoRpc.exe"=

"c:\\Program Files\\CA\\eTrustITM\\Realmon.exe"=

"c:\\Program Files\\CA\\eTrustITM\\Shellscn.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R0 atiide;ATI SATA Controller IDE mode;c:\windows\system32\drivers\atiide.sys [9/28/2009 9:16 AM 3456]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [9/28/2009 9:24 AM 24064]

R0 ssfs0bbc;Spy Sweeper File System Filter Driver: 0BBC;c:\windows\system32\drivers\ssfs0bbc.sys [8/25/2009 8:50 AM 30136]

R2 TSCensus Collection Client;ZENworks Asset Management - Collection Client;c:\program files\Novell\ZENworks\Asset Management\Bin\CClientSvc.exe [10/30/2009 5:59 PM 49152]

R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [10/30/2009 5:59 PM 9176]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [9/28/2009 9:22 AM 144992]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/10/2008 6:28 PM 47128]

S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [7/10/2008 2:49 AM 242712]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [7/10/2008 6:28 PM 369688]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#LOGIN]

\SHeLl\AutOPlaY\coMmand - lbuo.exe

\SHeLl\AutoRun\command - lbuo.exe

\SHeLl\exploRe\COmmAnD - lbuo.exe

\SHeLl\opEN\cOMMand - lbuo.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#PUBLIC]

\shELl\autOpLay\ComManD - gsbhf.pif

\shELl\AutoRun\command - gsbhf.pif

\shELl\EXPLORe\cOMMaNd - gsbhf.pif

\shELl\OPEN\coMMand - gsbhf.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#PUBLIC#DCCCD]

\shell\AUToPlAY\COMmaNd - wcseeb.exe

\shell\AutoRun\command - wcseeb.exe

\shell\eXPLore\coMMAnd - wcseeb.exe

\shell\Open\commaNd - wcseeb.exe

.

Contents of the 'Scheduled Tasks' folder

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-1715567821-839522115-38181Core.job

- c:\documents and settings\jar1153\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-19 17:12]

2010-01-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-1715567821-839522115-38181UA.job

- c:\documents and settings\jar1153\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-11-19 17:12]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.dcccd.edu/

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

DPF: {8B0F07E1-00F9-4B1B-9A2F-456DC0F54EBF} - hxxp://khse.vlab.elementk.com/vlab/ax/PortTester.cab

DPF: {E99D3E39-5D92-4360-BA86-2C563B3CFFEB} - hxxp://cmstraining.dcccd.edu/DCCCD/CMS/WebAuthor/Client/PlaceholderControlSupport/nrdhtml.cab

FF - ProfilePath - c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.dcccd.edu/

FF - component: c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\jar1153\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

AddRemove-HDMI - c:\windows\system32\igxpun.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-11 17:31

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(708)

c:\windows\system32\NETWIN32.DLL

c:\windows\system32\NLS\ENGLISH\MAPBASER.DLL

c:\windows\system32\NLS\ENGLISH\NWSHLXNR.DLL

c:\windows\system32\NLS\ENGLISH\NOVNPNTR.DLL

- - - - - - - > 'Explorer.exe'(2796)

c:\windows\system32\WININET.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\novell\Messenger\NMCH32.DLL

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\CA\SharedComponents\iTechnology\igateway.exe

c:\program files\CA\eTrustITM\InoRpc.exe

c:\program files\CA\eTrustITM\InoRT.exe

c:\program files\CA\eTrustITM\InoTask.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\Webroot\Client\commagent.exe

c:\program files\Novell\ZENworks\Asset Management\bin\CClient.exe

c:\windows\system32\SearchIndexer.exe

c:\program files\Webroot\Client\spysweeper.exe

c:\windows\system32\NWTRAY.EXE

c:\windows\system32\igfxsrvc.exe

c:\program files\Microsoft ActiveSync\wcescomm.exe

c:\progra~1\MI3AA1~1\rapimgr.exe

.

**************************************************************************

.

Completion time: 2010-01-11 17:34:53 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-11 23:34

Pre-Run: 219,496,226,816 bytes free

Post-Run: 219,605,008,384 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - CDD00DDA26478246F6B77E0F7509BEC6

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

Filelook::

c:\windows\inf\explorer.exe

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#PUBLIC#DCCCD]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#PUBLIC]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##DSC1#SYS#LOGIN]

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Link to post
Share on other sites
JarAce

JarAce

Posted
  • Author
Posted

Here's the results:

ComboFix 10-01-11.04 - jar1153 01/12/2010 11:21:47.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3292.2398 [GMT -6:00]

Running from: c:\documents and settings\jar1153\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\jar1153\Desktop\CFScript.txt

AV: eTrust ITM *On-access scanning disabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

.

((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))

.

2010-01-11 20:47 . 2010-01-11 20:47 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-11 16:55 . 2010-01-11 16:56 -------- d-----w- c:\documents and settings\jar1153\Job Aids

2010-01-07 16:47 . 2010-01-07 16:47 -------- d-----w- c:\program files\trend micro

2010-01-07 16:47 . 2010-01-07 16:47 -------- d-----w- C:\rsit

2010-01-06 23:12 . 2010-01-06 23:12 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-01-05 16:26 . 2010-01-05 16:26 -------- d-----w- c:\documents and settings\jar1153\Projects

2010-01-05 16:23 . 2010-01-12 15:35 -------- d-----w- c:\documents and settings\jar1153\Forms

2010-01-05 16:05 . 2010-01-05 16:05 -------- d-----w- c:\documents and settings\jar1153\Application Data\Malwarebytes

2010-01-05 16:05 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-05 16:05 . 2010-01-05 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-05 16:05 . 2010-01-11 20:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-05 16:05 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-04 20:33 . 2010-01-04 20:33 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2010-01-04 20:28 . 2010-01-04 20:28 -------- d-----w- c:\documents and settings\jar1153\Application Data\Windows Search

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\jar1153\Local Settings\Application Data\Identities

2010-01-04 15:56 . 2010-01-04 15:56 -------- d-----w- c:\documents and settings\jar1153\Application Data\Windows Desktop Search

2010-01-04 15:56 . 2010-01-05 15:54 -------- d-----w- c:\program files\Windows Desktop Search

2010-01-04 15:55 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll

2010-01-04 15:55 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll

2010-01-04 15:55 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll

2010-01-04 14:55 . 2010-01-04 14:55 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-12-24 14:49 . 2009-12-24 14:49 -------- d-----w- c:\windows\Sun

2009-12-23 21:28 . 2007-12-30 11:01 307200 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe

2009-12-23 21:28 . 2007-12-30 11:01 172032 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe

2009-12-23 21:28 . 2007-12-30 11:01 90112 ----a-w- c:\documents and settings\jar1153\Application Data\Mozilla\Firefox\Profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll

2009-12-21 18:23 . 2010-01-04 20:27 -------- d-----w- C:\JwSoftworks

2009-12-21 17:38 . 2009-12-21 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2009-12-17 14:43 . 2008-04-14 11:42 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-12-17 14:43 . 2001-08-18 04:36 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-12-17 14:43 . 2008-04-14 06:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-12-17 14:43 . 2008-04-14 06:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-12-17 11:29 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2009-12-16 23:20 . 2009-12-21 17:42 -------- d-----w- c:\documents and settings\jar1153\code_js

2009-12-14 20:07 . 2009-12-14 20:07 -------- d-----w- c:\documents and settings\jar1153\mcsmtest

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-11 17:29 . 2009-11-20 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-01-08 06:09 . 2009-08-31 17:27 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-01-07 19:04 . 2004-08-04 03:59 96512 ------w- c:\windows\system32\drivers\atapi.sys

2009-12-23 16:34 . 2009-08-31 17:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic

2009-12-22 21:33 . 2009-08-27 14:42 70000 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-12-16 18:25 . 2009-11-19 16:49 -------- d-----w- c:\program files\Notepad++

2009-12-11 17:11 . 2009-09-14 21:27 -------- d-----w- c:\program files\MSECache

2009-12-11 14:56 . 2009-12-11 14:47 -------- d-----w- c:\documents and settings\jar1153\Application Data\GetRightToGo

2009-12-09 21:11 . 2009-12-09 21:11 -------- d-----w- c:\documents and settings\jar1153\Application Data\PDF Writer

2009-12-09 21:11 . 2009-12-09 21:11 -------- d-----w- c:\documents and settings\All Users\Application Data\PDF Writer

2009-12-09 21:09 . 2009-12-09 21:09 -------- d-----w- c:\program files\Common Files\Bullzip

2009-12-09 21:09 . 2009-12-09 21:09 -------- d-----w- c:\program files\Bullzip

2009-12-03 15:12 . 2009-12-03 15:12 -------- d-----w- c:\program files\DebugMode

2009-11-30 17:17 . 2009-11-30 17:17 -------- d-----w- c:\program files\Microsoft Works

2009-11-30 17:17 . 2009-09-14 23:02 -------- d-----w- c:\program files\MSBuild

2009-11-30 17:15 . 2009-11-30 17:15 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2009-11-28 20:37 . 2009-12-09 21:09 6144 ----a-w- c:\windows\system32\BioPdf.PdfWriter.Lib.dll

2009-11-25 18:48 . 2009-11-25 18:48 -------- d-----w- c:\documents and settings\jar1153\Application Data\Yahoo!

2009-11-25 18:47 . 2009-11-25 18:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!

2009-11-25 18:47 . 2009-11-25 18:45 -------- d-----w- c:\program files\Yahoo!

2009-11-24 18:14 . 2009-08-31 17:27 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-11-23 22:37 . 2009-11-23 22:37 193824 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VBExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:37 . 2009-11-23 22:14 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll

2009-11-23 22:36 . 2009-11-23 22:13 -------- d-----w- c:\program files\Microsoft Visual Studio 9.0

2009-11-23 22:33 . 2009-11-23 22:33 488576 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VWDExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:32 . 2009-11-23 22:32 -------- d-----w- c:\program files\Microsoft Web Designer Tools

2009-11-23 22:23 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft SQL Server

2009-11-23 22:23 . 2009-11-23 22:23 -------- d-----w- c:\program files\MSXML 6.0

2009-11-23 22:23 . 2009-11-23 22:13 -------- d-----w- c:\program files\Microsoft.NET

2009-11-23 22:15 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft Synchronization Services

2009-11-23 22:15 . 2009-11-23 22:15 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2009-11-23 22:14 . 2009-11-23 22:14 187328 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCSExpress\9.0\1033\ResourceCache.dll

2009-11-23 22:12 . 2009-11-23 22:12 -------- d-----w- c:\program files\Microsoft SDKs

2009-11-21 15:51 . 2004-08-04 05:56 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2009-11-20 00:25 . 2009-11-20 00:19 -------- d-----w- c:\program files\Microsoft Office2007

2009-11-19 16:49 . 2009-11-19 16:49 -------- d-----w- c:\documents and settings\jar1153\Application Data\Notepad++

2009-11-10 20:39 . 2009-11-25 18:47 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

2009-10-30 23:59 . 2009-10-30 23:59 9176 ----a-w- c:\windows\system32\drivers\WNTHW.SYS

2009-10-29 07:45 . 2004-08-04 05:56 916480 ------w- c:\windows\system32\wininet.dll

2009-10-21 05:38 . 2004-08-04 05:56 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38 . 2004-08-04 05:56 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 04:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

--- c:\windows\inf\explorer.exe ---

Company: Microsoft Corporation

File Description: Windows Explorer

File Version: 6.00.2900.5512 (xpsp.080413-2105)

Product Name: Microsoft

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

Can you post a new DDS log as well? Because it's confusing if your default explorer shell is still pointing to the explorer.exe present in your inf folder or not - or if the default shell was restored by Combofix again.

Also, Go to this page.

Enter the url of this thread in the first field.

Where it says, browse to the file that you want to submit, click the browse button next to it and browse to next file:

c:\windows\inf\explorer.exe

Select it and click ok:

Then click the Send File button below.

Note, do NOT browse to the C:\Windows\explorer.exe file, because that one is legitimate.

Also do the following..

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    *explorer.exe*


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

So I need 2 logs in your next reply, a DDS log and the log from Systemlook + let me know if you have uploaded the C:\Windows\inf\explorer.exe to that site as well.

Link to post
Share on other sites
JarAce

JarAce

Posted
  • Author
Posted

1. The DDS log is posted below. I also attached the Attach.txt file.

2. The SystemLook log is posted below.

3. I submitted c:\windows\inf\explorer.exe via the link you provided.

DDS (Ver_09-12-01.01) - NTFSx86

Run by jar1153 at 11:59:41.40 on Tue 01/12/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3292.2588 [GMT -6:00]

AV: eTrust ITM *On-access scanning disabled* (Updated) {33EA71EA-56CF-40B5-A06B-BD3A27397C44}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Novell\ZENworks\Asset Management\bin\CClientSvc.exe

C:\Program Files\Webroot\Client\commagent.exe

C:\Program Files\Novell\ZENworks\Asset Management\bin\CClient.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Webroot\Client\spysweeper.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\CA\eTrustITM\realmon.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Webroot\Client\SpySweeperUI.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Novell\Messenger\NMCL32.exe

C:\PROGRA~1\Yahoo!\Messenger\YahooMessenger.exe

C:\Program Files\Microsoft ActiveSync\wcescomm.exe

C:\PROGRA~1\MI3AA1~1\rapimgr.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Microsoft ActiveSync\WCESMgr.exe

C:\WINDOWS\Explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\jar1153\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.dcccd.edu/

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [Google Update] "c:\documents and settings\jar1153\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [Novell Messenger] "c:\novell\messenger\NMCL32.exe"

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"

mRun: [NWTRAY] "NWTRAY.EXE"

mRun: [Realtime Monitor] "c:\program files\ca\etrustitm\realmon.exe" -s

mRun: [igfxTray] "c:\windows\system32\igfxtray.exe"

mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe"

mRun: [Persistence] "c:\windows\system32\igfxpers.exe"

mRun: [soundMAXPnP] "c:\program files\analog devices\core\smax4pnp.exe"

mRun: [WebrootClientUI] "c:\program files\webroot\client\SpySweeperUI.EXE" /StartInTray

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\jar1153\startm~1\programs\startup\grpwis~1.lnk - c:\novell\groupwise\grpwise.exe

StartupFolder: c:\docume~1\jar1153\startm~1\programs\startup\taskmg~1.lnk - c:\windows\system32\taskmgr.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

uPolicies-explorer: NoSMHelp = 01000000

mPolicies-system: CompatibleRUPSecurity = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - c:\novell\messen~1\NMCL32.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259015365959

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8B0F07E1-00F9-4B1B-9A2F-456DC0F54EBF} - hxxp://khse.vlab.elementk.com/vlab/ax/PortTester.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E99D3E39-5D92-4360-BA86-2C563B3CFFEB} - hxxp://cmstraining.dcccd.edu/DCCCD/CMS/WebAuthor/Client/PlaceholderControlSupport/nrdhtml.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: nim - {3D206AE2-3039-413B-B748-3ACC562EC22A} - c:\novell\messenger\nmcg32.dll

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

LSA: Authentication Packages = msv1_0 nwv1_0

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jar1153\applic~1\mozilla\firefox\profiles\cm7wckyb.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.dcccd.edu/

FF - component: c:\documents and settings\jar1153\application data\mozilla\firefox\profiles\cm7wckyb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\jar1153\local settings\application data\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 atiide;ATI SATA Controller IDE mode;c:\windows\system32\drivers\atiide.sys [2009-9-28 3456]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-9-28 24064]

R0 ssfs0bbc;Spy Sweeper File System Filter Driver: 0BBC;c:\windows\system32\drivers\ssfs0bbc.sys [2009-8-25 30136]

R2 TSCensus Collection Client;ZENworks Asset Management - Collection Client;c:\program files\novell\zenworks\asset management\bin\CClientSvc.exe [2009-10-30 49152]

R2 WebrootCommAgentService;Webroot CommAgent Service;c:\program files\webroot\client\CommAgent.exe [2009-8-25 715176]

R2 WNTHW;WNTHW;c:\windows\system32\drivers\WNTHW.SYS [2009-10-30 9176]

R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [2009-9-28 144992]

R3 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\client\SPYSWEEPER.EXE [2009-8-25 4110352]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]

S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688]

=============== Created Last 30 ================

2010-01-12 17:21:09 0 d-----w- C:\ComboFix

2010-01-11 23:19:49 0 d-sha-r- C:\cmdcons

2010-01-11 23:18:04 98816 ----a-w- c:\windows\sed.exe

2010-01-11 23:18:04 77312 ----a-w- c:\windows\MBR.exe

2010-01-11 23:18:04 261632 ----a-w- c:\windows\PEV.exe

2010-01-11 23:18:04 161792 ----a-w- c:\windows\SWREG.exe

2010-01-11 16:55:09 0 d-----w- c:\documents and settings\jar1153\Job Aids

2010-01-07 16:47:05 0 d-----w- c:\program files\trend micro

2010-01-06 23:12:45 0 d-----w- c:\program files\Microsoft ActiveSync

2010-01-05 16:26:12 0 d-----w- c:\documents and settings\jar1153\Projects

2010-01-05 16:23:40 0 d-----w- c:\documents and settings\jar1153\Forms

2010-01-05 16:05:35 0 d-----w- c:\docume~1\jar1153\applic~1\Malwarebytes

2010-01-05 16:05:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-05 16:05:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-05 16:05:30 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-05 16:05:30 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-04 20:28:17 0 d-----w- c:\docume~1\jar1153\applic~1\Windows Search

2010-01-04 15:56:37 0 d-----w- c:\docume~1\jar1153\applic~1\Windows Desktop Search

2010-01-04 15:56:07 0 d-----w- c:\program files\Windows Desktop Search

2010-01-04 15:55:31 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll

2010-01-04 15:55:31 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll

2010-01-04 15:55:31 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll

2009-12-21 18:23:56 0 d-----w- C:\JwSoftworks

2009-12-18 20:07:44 3249 ----a-w- c:\windows\system32\wbem\Outlook_01ca801dc2b51f83.mof

2009-12-17 14:43:19 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-12-17 14:43:19 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-12-17 14:43:18 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-12-17 14:43:18 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-12-17 11:29:34 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2009-12-16 23:20:42 0 d-----w- c:\documents and settings\jar1153\code_js

2009-12-14 20:07:00 0 d-----w- c:\documents and settings\jar1153\mcsmtest

2009-12-14 15:08:58 11 ----a-w- c:\windows\NetWare.INI

==================== Find3M ====================

2010-01-08 06:09:53 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-01-07 19:04:23 96512 ------w- c:\windows\system32\drivers\atapi.sys

2009-11-28 20:37:06 6144 ----a-w- c:\windows\system32\BioPdf.PdfWriter.Lib.dll

2009-10-29 07:45:38 916480 ------w- c:\windows\system32\wininet.dll

2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-09-28 15:27:00 73728 ----a-w- c:\windows\inf\uiu\t2\rtnicprop32.dll

2009-09-28 15:27:00 67584 ----a-w- c:\windows\inf\uiu\t2\rtnicprop64.dll

2009-09-28 15:27:00 63872 ----a-w- c:\windows\inf\uiu\t1\sisraid4.sys

2009-09-28 15:27:00 159744 ----a-w- c:\windows\inf\uiu\t1\property.dll

2009-09-28 15:27:00 156672 ----a-w- c:\windows\inf\uiu\t2\rtenic64.sys

2009-09-28 15:27:00 130688 ----a-w- c:\windows\inf\uiu\t2\rtenicxp.sys

2009-09-28 15:27:00 129024 ----a-w- c:\windows\inf\uiu\t2\rtenic.sys

2009-09-28 15:25:55 80128 ----a-w- c:\windows\inf\uiu\x86\oxpar.sys

2009-09-28 15:24:55 372736 ----a-w- c:\windows\inf\uiu\b_61170\atidemgx.dll

2009-09-28 15:23:59 266240 ----a-w- c:\windows\inf\uiu\t5\rtcomdll.dll

2009-09-28 15:22:59 659456 ----a-w- c:\windows\inf\uiu\netw5c32.dll

2009-09-28 15:21:51 75264 ----a-w- c:\windows\inf\uiu\snxppalx.sys

2009-09-28 15:20:41 92768 ----a-w- c:\windows\inf\uiu\t3\e1qmsg.dll

2009-09-28 15:19:56 344064 ----a-w- c:\windows\inf\uiu\b_50254\atidemgx.dll

2009-09-28 15:18:53 307200 ----a-w- c:\windows\inf\uiu\b_44319\atiiiexx.dll

2009-09-28 15:17:56 75520 ----a-w- c:\windows\inf\uiu\51\agr1310_51.sys

2009-09-28 15:16:47 307200 ----a-w- c:\windows\inf\uiu\b_23862\atiiiexx.dll

2009-09-28 15:15:57 307200 ----a-w- c:\windows\inf\uiu\b_24491\atiiiexx.dll

2009-09-28 15:14:59 229376 ----a-w- c:\windows\inf\uiu\b_10679\atiiiexx.dll

2009-09-28 15:13:59 682624 ----a-w- c:\windows\inf\uiu\t6\hsf_cnxt.sys

2008-04-14 10:42:20 1033216 ----a-w- c:\windows\inf\explorer.exe

============= FINISH: 11:59:46.28 ===============

==========================================

==========================================

SystemLook v1.0 by jpshortstuff (10.01.10)

Log created at 12:08 on 12/01/2010 by jar1153 (Administrator - Elevation successful)

========== filefind ==========

Searching for "*explorer.exe*"

C:\backup\explorer.exe --a--- 1033728 bytes [15:56 24/11/2009] [10:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923

C:\WINDOWS\$NtServicePackUninstall$\explorer.exe --a--c 1032192 bytes [23:32 28/08/2009] [05:56 04/08/2004] A0732187050030AE399B241436565E64

C:\WINDOWS\ERDNT\cache\explorer.exe --a--- 1033728 bytes [23:34 11/01/2010] [10:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923

C:\WINDOWS\explorer.exe ------ 1033728 bytes [05:56 04/08/2004] [10:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923

C:\WINDOWS\inf\explorer.exe --a--- 1033216 bytes [05:56 04/08/2004] [10:42 14/04/2008] 7257E5E7CC700C69AEEAF4E5D9E9D318

C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf --a--- 80548 bytes [17:43 08/01/2010] [18:05 12/01/2010] 1973F82FEF69E195D2D29C1D91EAB139

C:\WINDOWS\Prefetch\EXPLORER.EXE-2D0F6BF9.pf --a--- 80688 bytes [14:42 21/12/2009] [15:02 11/01/2010] 0E9DABAD32E11F07BC2745C0A8968B28

C:\WINDOWS\ServicePackFiles\i386\explorer.exe --a--- 1033728 bytes [23:39 28/08/2009] [10:42 14/04/2008] 12896823FB95BFB3DC9B46BCAEDC9923

-=End Of File=-

Attach.txt

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

The file you submitted is Ok.

* Go to start > run and copy and paste next command in the field:

ComboFix /Uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Then, * Go here to run an online scannner from ESET.

  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan unwanted applications.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log in your next reply and also let me know how things are now.

Link to post
Share on other sites
JarAce

JarAce

Posted
  • Author
Posted

Thanks! Everything appears to be working fine now.

I ran the online scan you requested. The log is posted below.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=c8170cb4f8ead149a300f1807648f1fa

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-01-12 06:44:28

# local_time=2010-01-12 12:44:28 (-0600, Central Standard Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=75460

# found=1

# cleaned=1

# scan_time=1118

C:\Documents and Settings\jar1153\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_001303 JS/Exploit.Pdfka.ASD trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

Good to hear. I see Eset found a leftover as well and cleaned it.

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again! ;)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.