XP internet security 2010 - mbam installer won't run - defogger disabled (posted) - DDS ran and posted - GMER log attached

Packman Jones · February 27, 2010

Bad infection on my Dell 6000. XP Antivirus 2010. I can't install mbam (installer will not open, even with randomly named file) I've posted mt Defogger disable, DDS log, and attached dds attach, and GMER log

Here is my defogger-disable log:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 01:16 on 27/02/2010 (Kim Lowe)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

My DDS log:

DDS (Ver_09-12-01.01) - NTFSx86

Run by Kim Lowe at 1:25:33.60 on Sat 02/27/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.113 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\Documents and Settings\Kim Lowe\Local Settings\Application Data\av.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\WINDOWS\system32\ICO.EXE

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exe

C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Search Guard PlusU\sgpUpdaters.exe

C:\Program Files\Search Guard Plus\SearchGuardPlus.exe

C:\Program Files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Documents and Settings\Kim Lowe\Local Settings\Application Data\Google\Update\1.2.183.17\GoogleCrashHandler.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Kim Lowe\Desktop\dds.scr

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.dell4me.com/myway

uSearch Bar = hxxp://bfc.myway.com/search/de_srchlft.html

uInternet Connection Wizard,ShellNext = iexplore

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: H - No File

uURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\2.bin\MWSSRCAS.DLL

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

mURLSearchHooks: N/A: {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\2.bin\MWSSRCAS.DLL

BHO: MyWebSearch Search Assistant BHO: {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\2.bin\MWSSRCAS.DLL

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: mwsBar BHO: {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\2.bin\MWSBAR.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: Search Assistant: {f0626a63-410b-45e2-99a1-3f2475b2d695} - c:\program files\sgpsa\BHO.dll

TB: My Web Search: {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\2.bin\MWSBAR.DLL

TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

{555d4d79-4bd2-4094-a395-cfc534424a05}

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [Google Update] "c:\documents and settings\kim lowe\local settings\application data\google\update\GoogleUpdate.exe" /c

mRun: [Apoint] c:\program files\apoint\Apoint.exe

mRun: [intelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"

mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe

mRun: [PMX Daemon] ICO.EXE

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [My Web Search Bar Search Scope Monitor] "c:\progra~1\mywebs~1\bar\2.bin\m3SrchMn.exe" /m=2 /w

mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [sGPUpdater] c:\program files\search guard plusu\sgpUpdaters.exe

mRun: [FBSearch] c:\program files\search guard plus\SearchGuardPlus.exe

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [DACSMiniApp] c:\program files\fisher-price\dacs\miniapp\DACSMiniApp.exe

StartupFolder: c:\docume~1\kimlow~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partypoker\PartyPoker.exe

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL

DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=48835

DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab

DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab

DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab

DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159218937906

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} - hxxp://support.microsoft.com/mats/DiagWebControl.cab

DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab

DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} - hxxp://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: AtiExtEvent - Ati2evxx.dll

Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kimlow~1\applic~1\mozilla\firefox\profiles\b58bjj77.default\

FF - component: c:\documents and settings\kim lowe\application data\mozilla\firefox\profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll

FF - component: c:\documents and settings\kim lowe\application data\mozilla\firefox\profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - plugin: c:\documents and settings\kim lowe\local settings\application data\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-4-22 24652]

S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [2006-8-24 477696]

=============== Created Last 30 ================

2010-02-27 07:16:25 0 ----a-w- c:\documents and settings\kim lowe\defogger_reenable

2010-02-14 21:43:51 0 d-----w- c:\docume~1\kimlow~1\applic~1\Fisher-Price

2010-02-14 21:41:21 0 d-----w- c:\docume~1\alluse~1\applic~1\Fisher-Price

2010-02-14 21:39:50 0 d-----w- c:\program files\Fisher-Price

2010-02-14 21:39:18 266088 ----a-w- c:\windows\system32\xactengine2_8.dll

2010-02-14 21:39:18 18280 ----a-w- c:\windows\system32\x3daudio1_2.dll

2010-02-14 21:39:16 443752 ----a-w- c:\windows\system32\d3dx10_34.dll

2010-02-14 21:39:15 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll

2010-02-14 21:39:13 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll

2010-02-14 21:39:11 81768 ----a-w- c:\windows\system32\xinput1_3.dll

2010-02-14 21:39:07 261480 ----a-w- c:\windows\system32\xactengine2_7.dll

2010-02-14 21:39:05 443752 ----a-w- c:\windows\system32\d3dx10_33.dll

2010-02-14 21:39:05 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll

2010-02-14 21:39:01 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll

2010-02-14 21:39:00 255848 ----a-w- c:\windows\system32\xactengine2_6.dll

2010-02-14 21:39:00 251672 ----a-w- c:\windows\system32\xactengine2_5.dll

2010-02-07 01:05:47 0 d-----w- c:\program files\iTunes

2010-02-07 01:05:47 0 d-----w- c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2010-02-07 00:19:35 0 d-----w- c:\program files\Windows Installer Clean Up

2010-02-07 00:19:08 0 d-----w- c:\program files\MSECACHE

==================== Find3M ====================

2010-02-24 21:58:44 50496 ---ha-w- c:\windows\system32\mlfcache.dat

2010-02-14 21:41:31 1516 ----a-w- c:\docume~1\kimlow~1\applic~1\wklnhst.dat

2010-01-24 01:42:38 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-01 01:57:47 12288 ----a-w- C:\mtwb.dat

2009-12-31 16:50:03 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-31 16:50:03 353792 ------w- c:\windows\system32\dllcache\srv.sys

2009-12-21 13:19:18 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-16 18:43:27 343040 ------w- c:\windows\system32\dllcache\mspaint.exe

2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-14 07:08:23 33280 ------w- c:\windows\system32\dllcache\csrsrv.dll

2009-12-09 05:53:44 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

2009-12-08 19:27:51 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 19:27:51 2189184 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-12-08 18:43:50 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 18:43:50 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-12-08 09:23:28 474112 ------w- c:\windows\system32\dllcache\shlwapi.dll

2009-12-07 01:05:29 23101 ----a-w- c:\windows\hpqins15.dat

2009-12-07 00:57:09 19521 ----a-w- c:\windows\hpqins13.dat

2009-12-04 18:22:22 455424 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2008-04-27 06:13:09 0 ----a-w- c:\program files\temp01

2005-12-23 03:40:56 403199 --sh--w- c:\windows\system32\hjjlm.bak1

2005-12-23 20:43:05 404926 --sh--w- c:\windows\system32\hjjlm.bak2

2005-12-24 01:42:07 405585 --sh--w- c:\windows\system32\hjjlm.ini2

2008-09-11 04:41:25 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091020080911\index.dat

============= FINISH: 1:27:00.46 ===============

GMER and DDS attach are attached

I would really appreciate any help! thank you!

ark.txt

Attach.txt

Maniac · February 28, 2010

Hello Packman Jones! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install any software or hardware, while work on.

Step 1:

Please uninstall the following applications:

Adobe Reader 8.1.6

My Web Search (Cursor Mania)

Yahoo! Toolbar

After finish our work, please download and install the latest version of Adobe Reader from:

http://www.adobe.com

Step 2:

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 3:

I also see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

Viewpoint
Viewpoint Manager
Viewpoint Media Player

Step 4:

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Admin

You only need to get one of them to run, not all of them.

Please post the log in your next reply.

Note: The log can be found at the root of your installed hard drive entitled rkill.log

In your next reply, please include these log(s):

* JavaRa log

* RKill log

Packman Jones · February 28, 2010

Thank You!

Here are the logs:

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Sun Feb 28 11:20:27 2010

Found and removed: SOFTWARE\Classes\JavaPlugin.142_03

Found and removed: Software\Classes\JavaPlugin.160_02

------------------------------------

Finished reporting.

This log file is located at C:\rkill.log.

Please post this only if requested to by the person helping you.

Otherwise you can close this log when you wish.

Ran as Kim Lowe on 02/28/2010 at 11:39:53.

Processes terminated by Rkill or while it was running:

C:\Documents and Settings\Kim Lowe\Local Settings\Application Data\av.exe

C:\Documents and Settings\Kim Lowe\Local Settings\Application Data\Google\Update\1.2.183.17\GoogleCrashHandler.exe

C:\WINDOWS\system32\rundll32.exe

C:\Documents and Settings\Kim Lowe\Desktop\rkill.exe

Rkill completed on 02/28/2010 at 11:39:56.

Maniac · February 28, 2010

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply with a new hijackthis log.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

Packman Jones · February 28, 2010

the installer program will not start. I am asked if I wish to run the program by windows, but it does not open.

Maniac · February 28, 2010

Let's try another way:

Please try this version of malwarebytes: Click the link here

Save it on your desktop. You'll see it will have a random name, and will look similar like this:

Doubleclick on it, so it will extract the files and will start Malwarebytes automatically.

In case the installer (random named file) won't run either, rename it to EXPLORER.EXE and try again.

When Malwarebytes opens, click the "Update" tab FIRST and select to check for updates in order to get the latest updates.

In case Malwarebytes doesn't open, search for the folder mbam-installer on your desktop, open it and doubleclick the file winlogon.exe which will be present in there. This should launch Malwarebytes.

Then perform a scan and let it remove what it found. Reboot afterwards (important).

After reboot, post the malwarebytes log together with a new HijackThislog.

Packman Jones · February 28, 2010

I'm sorry, but I found the winlogon.exe file, but nothing happens when I double click it. the program still won't run.

Maniac · February 28, 2010

What do you mean? What winlogon.exe ?

Packman Jones · February 28, 2010

"In case Malwarebytes doesn't open, search for the folder mbam-installer on your desktop, open it and doubleclick the file winlogon.exe which will be present in there. This should launch Malwarebytes."

It wouldn't open normally, and that method wouldn't work either

Maniac · February 28, 2010

oh, I'm so sorry. Here is 10:49 PM . Let's try another way:

Please visit Combofix Guide & Instructions for instructions for installing the recovery console and downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to Combo-Fix.exe please.

Post the log from ComboFix when you've accomplished that along with a new HijackThis log.

Important notes regarding ComboFix:

ComboFix may reset a number of Internet Explorer's settings, including making it the default browser. This can easily be changed once we're finished.

ComboFix also prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you, please let me know. This can be undone manually when we're finished. Read HERE for an article written by dvk01 on why we disable autoruns.

Note: During this process, it would help a great deal and be very much appreciated if you would refrain from installing any new software or hardware on this machine, unless absolutely necessary, until the clean up process is finished as it makes our job more tedious, with additional new files that may have to be researched, which is very time consuming.

Also, please do not run any security programs or fixes on your own as doing so may compromise what we will be doing. It is important that you wait for instructions.

P.S.: I'm going to sleep. Tomorrow, I will analyze your log.

Packman Jones · February 28, 2010

This appears to have cleared the symptoms. Thank You!

V VV ComboFix 10-02-27.04 - Kim Lowe 02/28/2010 15:39:21.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.256 [GMT -6:00]

Running from: c:\documents and settings\Kim Lowe\Desktop\Combo-Fix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Kim Lowe\Local Settings\Application Data\av.exe

c:\documents and settings\Kim Lowe\Local Settings\Temporary Internet Files\pse_350_enu.exe

c:\documents and settings\Kim Lowe\Local Settings\Temporary Internet Files\udDownload[1].tmp

C:\mtwb.dat

c:\program files\Fast Browser Search

c:\program files\Fast Browser Search\IE\1.bat

c:\program files\Fast Browser Search\IE\about.html

c:\program files\Fast Browser Search\IE\affid.dat

c:\program files\Fast Browser Search\IE\basis.xml

c:\program files\Fast Browser Search\IE\basis_br.xml

c:\program files\Fast Browser Search\IE\basis_de.xml

c:\program files\Fast Browser Search\IE\basis_en.xml

c:\program files\Fast Browser Search\IE\basis_es.xml

c:\program files\Fast Browser Search\IE\basis_fr.xml

c:\program files\Fast Browser Search\IE\basis_it.xml

c:\program files\Fast Browser Search\IE\basis_nr.xml

c:\program files\Fast Browser Search\IE\basis_pt.xml

c:\program files\Fast Browser Search\IE\basis_ru.xml

c:\program files\Fast Browser Search\IE\basis_tr.xml

c:\program files\Fast Browser Search\IE\BHO.dll

c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe

c:\program files\Fast Browser Search\IE\error.html

c:\program files\Fast Browser Search\IE\FBSPlugin.dll

c:\program files\Fast Browser Search\IE\fbsSearchProvider.xml

c:\program files\Fast Browser Search\IE\search_fr.bmp

c:\program files\Fast Browser Search\IE\search_it.bmp

c:\program files\Fast Browser Search\IE\search_pt.bmp

c:\program files\Fast Browser Search\IE\search_ru.bmp

c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe

c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico

c:\program files\Fast Browser Search\IE\SGPU.ico

c:\program files\Fast Browser Search\IE\sgpUpdater.exe

c:\program files\Fast Browser Search\IE\sgpUpdater.xml

c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe

c:\program files\Fast Browser Search\IE\tbhelper.dll

c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js

c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js

c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js

c:\program files\Fast Browser Search\IE\Toolbar Help.htm

c:\program files\Fast Browser Search\IE\uninstall.exe

c:\program files\Fast Browser Search\IE\uninstalSGP.exe

c:\program files\Fast Browser Search\IE\uninstalSGPU.exe

c:\program files\Fast Browser Search\IE\update.exe

c:\program files\Fast Browser Search\IE\version.txt

c:\program files\FunWebProducts

c:\program files\FunWebProducts\Shared\02580875.dat

c:\program files\Search Guard Plus

c:\program files\Search Guard Plus\fbsSearchProvider.xml

c:\program files\Search Guard Plus\SearchGuardPlus.exe

c:\program files\Search Guard Plus\SearchGuardPlus.ico

c:\program files\Search Guard Plus\uninstalSGP.exe

c:\program files\Search Guard PlusU

c:\program files\Search Guard PlusU\SGPU.ico

c:\program files\Search Guard PlusU\sgpUpdater.exe

c:\program files\Search Guard PlusU\sgpUpdater.xml

c:\program files\Search Guard PlusU\sgpUpdaters.exe

c:\program files\Search Guard PlusU\uninstalSGPU.exe

c:\program files\SGPSA

c:\program files\SGPSA\BHO.dll

c:\program files\Uninstall Fun Web Products.dll

c:\windows\system32\bszip.dll

c:\windows\system32\hjjlm.bak1

c:\windows\system32\hjjlm.bak2

c:\windows\system32\hjjlm.ini

c:\windows\system32\hjjlm.ini2

c:\windows\system32\hjjlm.tmp

c:\windows\system32\mcrh.tmp

c:\windows\system32\pqtss.ini

.

((((((((((((((((((((((((( Files Created from 2010-01-28 to 2010-02-28 )))))))))))))))))))))))))))))))

.

2010-02-14 21:43 . 2010-02-14 21:43 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\Fisher-Price

2010-02-14 21:41 . 2010-02-14 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Fisher-Price

2010-02-14 21:38 . 2007-03-05 18:42 15128 ----a-w- c:\windows\system32\x3daudio1_1.dll

2010-02-07 01:05 . 2010-02-07 01:07 -------- d-----w- c:\program files\iTunes

2010-02-07 01:05 . 2010-02-07 01:07 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2010-02-07 01:03 . 2010-02-07 01:04 -------- d-----w- c:\program files\QuickTime

2010-02-07 00:19 . 2010-02-07 00:19 -------- d-----w- c:\program files\Windows Installer Clean Up

2010-02-07 00:19 . 2010-02-07 00:19 -------- d-----w- c:\program files\MSECACHE

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-28 17:31 . 2005-08-22 23:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint

2010-02-28 17:12 . 2005-12-19 02:46 -------- d-----w- c:\program files\Yahoo!

2010-02-28 17:10 . 2005-09-01 00:35 -------- d-----w- c:\program files\Common Files\Adobe

2010-02-24 21:58 . 2008-06-07 18:10 50496 ---ha-w- c:\windows\system32\mlfcache.dat

2010-02-14 21:42 . 2010-02-14 21:41 7158518 ----a-w- c:\documents and settings\All Users\Application Data\Fisher-Price\DACS\Download\setup.exe

2010-02-14 21:41 . 2009-10-06 00:56 1516 ----a-w- c:\documents and settings\Kim Lowe\Application Data\wklnhst.dat

2010-02-14 21:39 . 2010-02-14 21:39 -------- d-----w- c:\program files\Fisher-Price

2010-02-07 01:17 . 2010-01-01 03:04 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\Apple Computer

2010-02-07 01:06 . 2005-08-30 21:56 -------- d-----w- c:\program files\iPod

2010-02-07 01:06 . 2007-09-23 17:59 -------- d-----w- c:\program files\Common Files\Apple

2010-02-07 00:19 . 2010-02-07 00:19 3584 ----a-r- c:\documents and settings\Kim Lowe\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2010-01-27 16:37 . 2010-01-24 02:53 1 ----a-w- c:\documents and settings\Kim Lowe\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-01-24 03:12 . 2010-01-24 03:12 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\ElevatedDiagnostics

2010-01-24 03:08 . 2010-01-24 03:08 -------- d-----w- c:\program files\Microsoft ATS

2010-01-24 03:08 . 2009-08-18 02:44 68800 ----a-w- c:\documents and settings\Kim Lowe\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-24 02:52 . 2010-01-24 02:52 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\OpenOffice.org

2010-01-24 01:44 . 2010-01-24 01:44 -------- d-----w- c:\program files\JRE

2010-01-24 01:44 . 2010-01-24 01:43 -------- d-----w- c:\program files\OpenOffice.org 3

2010-01-24 01:42 . 2009-08-18 02:55 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-23 01:51 . 2010-01-23 01:51 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe

2010-01-22 12:08 . 2009-03-16 03:37 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-17 20:31 . 2010-01-17 20:31 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\StreamTorrent

2010-01-17 20:31 . 2010-01-17 20:31 -------- d-----w- c:\program files\StreamTorrent 1.0

2010-01-17 20:07 . 2010-01-17 20:07 -------- d-----w- c:\program files\Veetle

2010-01-09 03:58 . 2008-05-21 01:16 -------- d-----w- c:\program files\HP

2010-01-09 03:16 . 2008-05-21 02:25 -------- d-----w- c:\documents and settings\All Users\Application Data\HP

2010-01-09 01:41 . 2010-01-09 01:41 -------- d-----w- c:\program files\Windows Media Connect 2

2010-01-08 00:49 . 2010-01-08 00:49 1924744 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2010-01-03 23:07 . 2010-01-03 23:03 -------- d-----w- c:\program files\TVAnts

2010-01-02 02:53 . 2010-01-02 02:53 -------- d-----w- c:\documents and settings\Kim Lowe\Application Data\CyberLink

2010-01-01 21:41 . 2010-01-01 21:41 -------- d-----w- c:\program files\Intel Corporation

2009-12-31 16:50 . 2005-08-22 22:46 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14 . 2004-08-11 22:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 22:05 . 2010-01-01 05:47 347136 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

2009-12-16 22:05 . 2010-01-01 05:47 340992 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll

2009-12-16 22:05 . 2010-01-01 05:47 471040 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll

2009-12-16 22:05 . 2010-01-01 05:47 43008 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll

2009-12-16 22:05 . 2010-01-01 05:47 1452032 ----a-w- c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

2009-12-16 18:43 . 2004-08-11 22:11 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08 . 2004-08-11 22:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:27 . 2004-08-11 22:00 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43 . 2004-08-04 03:59 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-07 01:05 . 2009-12-07 01:03 23101 ----a-w- c:\windows\hpqins15.dat

2009-12-07 00:57 . 2009-12-07 00:49 19521 ----a-w- c:\windows\hpqins13.dat

2009-12-04 18:22 . 2005-08-22 22:46 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2008-04-27 06:13 . 2008-04-27 06:13 0 ----a-w- c:\program files\temp01

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

"Google Update"="c:\documents and settings\Kim Lowe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-09 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-13 344064]

"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]

"PMX Daemon"="ICO.EXE" [2006-06-09 47104]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]

"DACSMiniApp"="c:\program files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe" [2008-03-13 128256]

c:\documents and settings\Nic\Start Menu\Programs\Startup\

wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-9-16 15360]

c:\documents and settings\Kim Lowe\Start Menu\Programs\Startup\

OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2005-8-22 156784]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-8-22 24576]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 21:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\1132732177\\ee\\aolsoftware.exe"=

"c:\\Program Files\\Common Files\\AOL\\1132732177\\ee\\aim6.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\TVAnts\\Tvants.exe"=

"c:\\Program Files\\StreamTorrent 1.0\\StreamTorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

S3 ZD1211BU(SMC);802.11g Wireless USB2.0 Adapter Driver(SMC);c:\windows\system32\drivers\ZD1211BU.sys [8/24/2006 5:44 AM 477696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

2010-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:34]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-219612428-2456359044-841806917-1006Core.job

- c:\documents and settings\Kim Lowe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-09 02:27]

2010-02-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-219612428-2456359044-841806917-1006UA.job

- c:\documents and settings\Kim Lowe\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-09 02:27]

.

------- Supplementary Scan -------

.

uInternet Connection Wizard,ShellNext = iexplore

DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15-3.cab

DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} - hxxp://imikimi.com/download/imikimi_plugin_0.5.1.cab

FF - ProfilePath - c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\

FF - component: c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\DictionaryCompressionFF.dll

FF - component: c:\documents and settings\Kim Lowe\Application Data\Mozilla\Firefox\Profiles\b58bjj77.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - plugin: c:\documents and settings\Kim Lowe\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\Veetle\Player\npvlc.dll

FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

BHO-{F0626A63-410B-45E2-99A1-3F2475B2D695} - c:\program files\SGPSA\BHO.dll

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe

HKLM-Run-SGPUpdater - c:\program files\Search Guard PlusU\sgpUpdaters.exe

HKLM-Run-FBSearch - c:\program files\Search Guard Plus\SearchGuardPlus.exe

AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb

AddRemove-{AAC4FC36-8F89-4587-8DD3-EBC57C83374D} - c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\setup\hpzscr01.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-02-28 15:56

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SGPUpdater = c:\program files\Search Guard PlusU\sgpUpdaters.exe??o?LUDE_CUSTOM_XML id="customxml_19" name="custo

FBSearch = c:\program files\Search Guard Plus\SearchGuardPlus.exe?LUDE_CUSTOM_XML id="customxml_19" name="custo

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(984)

c:\windows\system32\Ati2evxx.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

.

Completion time: 2010-02-28 16:02:26

ComboFix-quarantined-files.txt 2010-02-28 22:02

Pre-Run: 30,570,561,536 bytes free

Post-Run: 33,072,431,104 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 208810FDFB5E71277ED3E5F520890164

Maniac · March 1, 2010

Very good! Let's try again with MalwareBytes' Anti-Malware: