Mbam finds nothing but problems galore

claudia7531 · February 24, 2010

Mbam, Spybot, and Mcafee find nothing.

Malwarebytes' Anti-Malware 1.44

Database version: 3753

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

2/18/2010 10:10:54 AM

mbam-log-2010-02-18 (10-10-54).txt

Scan type: Quick Scan

Objects scanned: 134794

Time elapsed: 18 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Defogger ran, but did not ask me to reboot. Here is the error file.

defogger_disable by jpshortstuff (29.01.10.1)

Log created at 11:27 on 22/02/2010 (Owner)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

DDS (Ver_09-12-01.01) - NTFSx86

Run by Owner at 11:50:13.67 on Mon 02/22/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.441 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINNT\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\spoolsv.exe

C:\Program Files\ATT-SST\McciTrayApp.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Panasonic\PHOTOfunSTUDIO\PhAutoRun.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcshield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\WINNT\System32\nvsvc32.exe

C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS

C:\WINNT\System32\svchost.exe -k imgsvc

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcsysmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uSearch Page = hxxp://www.google.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

uSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = 127.0.0.1;*.local

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {ACB1E670-3217-45C4-A021-6B829A8A27CB} - No File

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MSKAgent.exe

uRun: [icmcli] rundll32.exe "c:\documents and settings\owner\application data\adobe\update\cliwnd.dat""

uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe

mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\owner\startm~1\programs\startup\connec~1.lnk - c:\program files\bellsouth\connection manager\CManager.exe

StartupFolder: c:\documents and settings\owner\start menu\programs\startup\RCA Detective.lnk.disabled

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\apcups~1.lnk - c:\program files\apc\apc powerchute personal edition\Display.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\winnt\system32\spool\drivers\w32x86\3\E_SRCV02.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\photof~1.lnk - c:\program files\panasonic\photofunstudio\PhAutoRun.exe

StartupFolder: c:\documents and settings\all users\start menu\programs\startup\ymetray.lnk.disabled

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: SchoolCash - file://c:\program files\schoolcashreminderservice\system\temp\scash_script.htm

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {DD6687B5-CB43-4211-BFC9-2942CCBDCB3E} - c:\program files\microsoft money\system\mnyside.dll

Trusted Zone: motive.com\pattta.att

Trusted Zone: motive.com\patttbc.att

Trusted Zone: musicmatch.com\online

DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - hxxp://download.yahoo.com/dl/installs/yinst0309.cab

DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} - hxxp://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab

DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB

DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} - hxxp://www.pqpc.com/plugin/axversion/1410/printquick1410.cab

DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - hxxp://software-dl.real.com/13c7e007ab175eb34f15/netzip/RdxIE601.cab

DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} - hxxps://mysupport.nai.com/amiuptodate/bin/1,0,0,7/McUpdatePortal.cab

DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} - hcp://system/RunExeActiveX.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} - hxxp://cs5b.instantservice.com/jars/customerxsigned35.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} - hcp://system/StartFirstControl.CAB

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37873.5106018518

DPF: {A1662FB6-39BE-41BB-ACDC-0448FB1B5817} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_5/PhotoCenter_ActiveX_Control.cab

DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab

DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553550000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - hxxp://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab

DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,4,0,4247/mcfscan.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R0 sonyhcb;Sony Digital Imaging Base;c:\winnt\system32\drivers\sonyhcb.sys [2003-1-31 6097]

R1 mfehidk;McAfee Inc. mfehidk;c:\winnt\system32\drivers\mfehidk.sys [2007-3-10 214664]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2008-12-5 236368]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-9-6 93320]

R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-3-10 359952]

R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~2\mcshield.exe [2007-3-10 144704]

R2 RioPNP;RioPNP;c:\winnt\system32\drivers\RioPnP.sys [2003-1-13 6736]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 MBAMProtector;MBAMProtector;c:\winnt\system32\drivers\mbam.sys [2008-12-5 19160]

R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~2\mcsysmon.exe [2007-3-10 606736]

R3 mfeavfk;McAfee Inc. mfeavfk;c:\winnt\system32\drivers\mfeavfk.sys [2007-3-10 79816]

R3 mfebopk;McAfee Inc. mfebopk;c:\winnt\system32\drivers\mfebopk.sys [2007-3-10 35272]

R3 mfesmfk;McAfee Inc. mfesmfk;c:\winnt\system32\drivers\mfesmfk.sys [2007-3-10 40552]

S0 Lbd;Lbd;c:\winnt\system32\drivers\lbd.sys --> c:\winnt\system32\drivers\Lbd.sys [?]

S2 CoachCap;Visioneer LX200 Video Capture;c:\winnt\system32\drivers\coachcap.sys [2002-3-3 93068]

S2 HidCom;USB-HID -> COM Driver Service;c:\winnt\system32\drivers\HidCom.sys [2007-9-17 21016]

S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter;\??\c:\winnt\system32\drivers\nsdriver.sys --> c:\winnt\system32\drivers\NSDriver.sys [?]

S3 mferkdk;McAfee Inc. mferkdk;c:\winnt\system32\drivers\mferkdk.sys [2007-3-10 34248]

S3 NPF;NetGroup Packet Filter Driver;c:\winnt\system32\drivers\npf.sys [2007-1-25 42000]

S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\qctest\pcdoc\pcdrdrv.sys --> c:\atf\qctest\pcdoc\PCDRDRV.sys [?]

S3 sonyhcs;Sony Digital Imaging Video;c:\winnt\system32\drivers\sonyhcs.sys [2003-1-31 299731]

S3 XKSZEWRH;XKSZEWRH;c:\docume~1\owner\locals~1\temp\XKSZEWRH.exe [2010-2-11 551808]

=============== Created Last 30 ================

2066-11-26 20:12:24 79947 ------w- c:\winnt\fw20.vxd

2010-02-22 17:27:04 0 ----a-w- c:\documents and settings\owner\defogger_reenable

2010-02-16 16:10:04 0 d-----w- c:\program files\common files\Motive

2010-02-16 16:09:49 0 d-----w- c:\program files\ATT-SST

2010-02-14 15:51:56 0 d-----w- c:\docume~1\owner\applic~1\McAfee

2010-02-13 19:14:43 181120 ------w- c:\winnt\system32\MpSigStub.exe

2010-02-11 19:19:40 0 ----a-w- c:\winnt\system32\D

2010-02-09 14:21:14 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-02-09 14:20:56 0 d-----w- c:\program files\SUPERAntiSpyware

2010-02-09 14:20:56 0 d-----w- c:\docume~1\owner\applic~1\SUPERAntiSpyware.com

==================== Find3M ====================

2010-02-08 23:40:13 16892 ----a-w- c:\winnt\fonts\Adonais.ttf

2010-02-08 23:39:54 6792 ----a-w- c:\winnt\fonts\elektra.ttf

2010-01-07 22:07:14 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys

2010-01-07 22:07:04 19160 ----a-w- c:\winnt\system32\drivers\mbam.sys

2009-12-31 16:50:03 353792 ----a-w- c:\winnt\system32\drivers\srv.sys

2009-12-31 16:50:03 353792 ------w- c:\winnt\system32\dllcache\srv.sys

2009-12-21 13:19:18 173056 ------w- c:\winnt\system32\dllcache\ie4uinit.exe

2009-12-17 23:14:00 411368 ----a-w- c:\winnt\system32\deploytk.dll

2009-12-16 18:43:27 343040 ------w- c:\winnt\system32\mspaint.exe

2009-12-16 18:43:27 343040 ------w- c:\winnt\system32\dllcache\mspaint.exe

2009-12-14 07:08:23 33280 ------w- c:\winnt\system32\dllcache\csrsrv.dll

2009-12-14 07:08:23 33280 ------w- c:\winnt\system32\csrsrv.dll

2009-12-08 19:27:51 2189184 ------w- c:\winnt\system32\ntoskrnl.exe

2009-12-08 19:27:51 2189184 ------w- c:\winnt\system32\dllcache\ntoskrnl.exe

2009-12-08 19:26:15 2145280 ------w- c:\winnt\system32\dllcache\ntkrnlmp.exe

2009-12-08 18:43:51 2023936 ------w- c:\winnt\system32\dllcache\ntkrpamp.exe

2009-12-08 18:43:50 2066048 ------w- c:\winnt\system32\ntkrnlpa.exe

2009-12-08 18:43:50 2066048 ------w- c:\winnt\system32\dllcache\ntkrnlpa.exe

2009-12-08 09:23:28 474112 ------w- c:\winnt\system32\dllcache\shlwapi.dll

2009-12-04 18:22:22 455424 ------w- c:\winnt\system32\dllcache\mrxsmb.sys

2009-11-27 17:11:44 17920 ------w- c:\winnt\system32\msyuv.dll

2009-11-27 17:11:44 17920 ------w- c:\winnt\system32\dllcache\msyuv.dll

2009-11-27 17:11:44 1291776 ------w- c:\winnt\system32\quartz.dll

2009-11-27 17:11:44 1291776 ------w- c:\winnt\system32\dllcache\quartz.dll

2009-11-27 16:07:35 8704 ------w- c:\winnt\system32\tsbyuv.dll

2009-11-27 16:07:35 8704 ------w- c:\winnt\system32\dllcache\tsbyuv.dll

2009-11-27 16:07:35 28672 ------w- c:\winnt\system32\msvidc32.dll

2009-11-27 16:07:35 28672 ------w- c:\winnt\system32\dllcache\msvidc32.dll

2009-11-27 16:07:34 84992 ----a-w- c:\winnt\system32\avifil32.dll

2009-11-27 16:07:34 84992 ------w- c:\winnt\system32\dllcache\avifil32.dll

2009-11-27 16:07:34 48128 ------w- c:\winnt\system32\iyuv_32.dll

2009-11-27 16:07:34 48128 ------w- c:\winnt\system32\dllcache\iyuv_32.dll

2009-11-27 16:07:34 11264 ------w- c:\winnt\system32\msrle32.dll

2009-11-27 16:07:34 11264 ------w- c:\winnt\system32\dllcache\msrle32.dll

2006-02-02 13:53:37 41 ------w- c:\program files\dskplmlink.hfp

2004-01-20 21:14:23 461 ------w- c:\program files\Shortcut to Winamp.lnk

2009-10-01 17:00:28 245760 --sha-w- c:\winnt\system32\config\systemprofile\ietldcache\index.dat

2008-10-18 02:50:52 32768 --sha-w- c:\winnt\system32\config\systemprofile\local settings\history\history.ie5\mshist012008101720081018\index.dat

============= FINISH: 11:51:24.67 ===============

I'm sure scripts blocking was disabled properly. Thanks for your help.

ark.zip

screen317 · March 17, 2010

Hi and welcome to Malwarebytes.

Do you still need help?

claudia7531 · March 17, 2010

Yes!!!! Please Help! I gave up and bought an imac, I had to get back online, but I would like to clean my PC so I can save my pictures and files.

My problem was: I became infected, I think via a thumb drive from my daughters school. Mbam, Mcafee, and Spybot were all shut down, but I got them all working again. I ran all scans, removed everything, ran them again, and everything was clean. All programs seemed to be running normally again and my cpu usage was way down, 1% when nothing was running. But every time I went online, I became reinfected. After I posted my logs to this forum on Feb. 24, I ran Rootrepeal and removed a few obvious items, but the problem continues.

What do you need me to do now? My computer is in a pile in the corner at the moment, but I could get it back up and running Monday and post anything you need on Tuesday.

Thanks for your assistance. I really do still need help.

screen317 · March 17, 2010

Hi,

When you get the computer back up, run DDS again and post its log.

After you post the log, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

-screen317

claudia7531 · March 23, 2010

I set my computer back up, ran DDS, Combofix and Hijackthis and I have the logs. But I can no longer connect to the internet, or use my keyboard, or cd/dvd drives or my sound card.

Help!

screen317 · March 27, 2010

Hi,

My apologies for the delay.

Do you have a flash drive?? If so, transfer the logs via flash drive. Otherwise, we may have a large issue here. Do you have your Windows XP CD??

claudia7531 · March 27, 2010

No problem.

I have a flash drive and will try to get the log files on to it. I believe the computer was infected via a flash drive. How do I keep from infecting another computer via this flash drive?

I have my Windows XP CD and I believe I can boot from it. I wasn't sure how to proceed so I waited till I heard from you.

I may not be able to work on the computer till Monday. I will post as soon as I can.

Thank you so much for your assistance.

screen317 · March 28, 2010

Hi,

Thanks for letting me know.

Plug the flash drive into the infected computer, then run ComboFix again. Only then will the flash drive itself be scanned.

Copy the previous ComboFix log (first), then run ComboFix with the flash drive inserted, then copy the second log over.

claudia7531 · March 29, 2010

OK. I started the computer in safe mode, plugged in the thumb drive, copied the logs to the thumb drive, ran combofix again with the thumb drive plugged in and then copied the second combofix log. Here are the logs:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Owner at 11:31:08.89 on Tue 03/23/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.440 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning disabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINNT\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~2\mcshield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\WINNT\System32\NMSSvc.exe

C:\WINNT\System32\nvsvc32.exe

C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS

C:\Program Files\ATT-SST\McciTrayApp.exe

C:\WINNT\System32\svchost.exe -k imgsvc

C:\Program Files\Panasonic\PHOTOfunSTUDIO\PhAutoRun.exe

C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\WINNT\system32\taskmgr.exe

C:\WINNT\system32\wscntfy.exe

C:\WINNT\system32\ctfmon.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank

uSearch Page = hxxp://www.google.com

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

uSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = 127.0.0.1;*.local

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {ACB1E670-3217-45C4-A021-6B829A8A27CB} - No File

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MSKAgent.exe

uRun: [icmcli] rundll32.exe "c:\documents and settings\owner\application data\adobe\update\cliwnd.dat""

uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe

mRun: [ATT-SST_McciTrayApp] "c:\program files\att-sst\McciTrayApp.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t