infection and MBAM BSOD rookit infection 4DW4R3nnQoxYXNLp.sys

ofudd · March 2, 2010

Noticed XP security alert 2010

ran mbam ---> nothing happened

ran rkill.exe and fixexe.reg; reinstalled MBAM from USB,

allowed MBAM to update and launch, clicked full scan. ---> BSOD (page fault)

uninstalled mbam via control panel.

ran mbam-clean.exe ---> requested restart, restarted.

ran mbam-clean.exe ---> SHGetValue failed with error code 0

ran defogger thru "finished!" & "ok" ---> no reboot request, I just returend to same disable/re-enable box. clicked "disable" again, same thing happened. so I restarted.

ran DDS.

ran GMER.

clicked "no" at warning.

unchecked as instructed.

DDS (Ver_09-12-01.01) - NTFSx86

Run by Boki at 20:57:26.79 on Mon 03/01/2010

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_07

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.18 [GMT -10:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Skype\Plugin Manager\skypePM.exe

F:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ask.com/?o=20011&l=dis

uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe" //mailurl:mailto:dvord@hpu.edu

mSearchAssistant = hxxp://www.google.com/ie

mWinlogon: Taskman=c:\recycler\s-1-5-21-7931194795-5318966221-165439664-1054\windll.exe

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

TB: IE Custom Tools: {efaf6ea3-615d-4f83-8748-2f7a576fcea6} - c:\program files\video add-on\ictmdl.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized

mRun: [Virtual PDF Printer] c:\program files\virtual pdf printer\VirtualPDFPrinter.exe

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxsrvc.dll

AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

STS: {075a465d-0af2-4b79-8db3-2fda0fd8d74c} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\boki\applic~1\mozilla\firefox\profiles\fkatzzuf.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - component: c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\boki\application data\mozilla\firefox\profiles\fkatzzuf.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07074039.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPInfotl.dll

FF - plugin: c:\program files\mozilla firefox\plugins\nppdf32(2).dll

FF - plugin: e:\program files\picasa3\npPicasa3.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-15 135664]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-5-31 30192]

S3 IKFileFlt;File Filter Driver;c:\windows\system32\drivers\ikfileflt.sys [2007-4-28 39248]

S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2007-4-28 52304]

S3 IkSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2007-4-28 59472]

S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2007-4-28 83536]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S4 sdAuxService;Spyware Doctor Auxiliary Service;c:\program files\spyware doctor\svcntaux.exe --> c:\program files\spyware doctor\svcntaux.exe [?]

S4 sdCoreService;Spyware Doctor Service;c:\program files\spyware doctor\swdsvc.exe --> c:\program files\spyware doctor\swdsvc.exe [?]

=============== Created Last 30 ================

2010-03-02 06:53:15 0 ----a-w- c:\documents and settings\boki\defogger_reenable

2010-03-02 05:54:01 0 d-----w- c:\docume~1\boki\applic~1\Malwarebytes

2010-03-02 05:46:13 5632 ----a-w- c:\windows\system32\ptpusb.dll

2010-03-02 05:46:12 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2010-03-02 05:46:10 159232 ----a-w- c:\windows\system32\ptpusd.dll

2010-02-27 22:00:20 0 d-----w- C:\ifmx.wmv

2010-02-27 05:50:24 0 d-----w- c:\program files\R

2010-02-15 19:40:46 0 d-----w- c:\program files\SomePDF

2010-02-15 19:35:53 0 d-----w- c:\program files\Freeware PDF Unlocker

==================== Find3M ====================

2003-09-16 11:19:48 99544 -c--a-w- c:\windows\inf\virprn.exe

2003-09-16 11:19:48 18950 -c--a-w- c:\windows\inf\virpntd.dll

2003-09-16 11:19:48 10240 -c--a-w- c:\windows\inf\virport.dll

2003-09-16 11:19:46 90624 -c--a-w- c:\windows\inf\prtproc.dll

2009-06-19 08:36:25 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009061820090619\index.dat

============= FINISH: 20:58:45.45 ===============

GMER log

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-03-01 22:25:22

Windows 5.1.2600 Service Pack 3

Running: 999hqde7.exe; Driver: C:\DOCUME~1\Boki\LOCALS~1\Temp\uwtdapob.sys

---- System - GMER 1.0.15 ----

Code F9383EB5 ZwCallbackReturn

Code F9383979 ZwEnumerateKey

Code F938396F ZwSaveKey

Code F9383974 ZwSaveKeyEx

Code F9383BD2 IofCompleteRequest

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys (*** hidden *** ) [sYSTEM] 4DW4R3 <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3@ImagePath \systemroot\system32\drivers\4DW4R3nnQoxYXNLp.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3@Type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3@Start 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3@group file system

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\connections

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\connections@5bf3bc6c

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\injector

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\injector@* 4DW4R3c

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\modules

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\modules@4DW4R3 \\?\globalroot\systemroot\system32\drivers\4DW4R3nnQoxYXNLp.sys

Reg HKLM\SYSTEM\CurrentControlSet\Services\4DW4R3\modules@4DW4R3c \\?\globalroot\systemroot\system32\4DW4R3TSpxUssedj.dll

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3@ImagePath \systemroot\system32\drivers\4DW4R3nnQoxYXNLp.sys

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3@Type 1

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3@Start 1

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3@group file system

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\connections (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\connections@5bf3bc6c

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\injector (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\injector@* 4DW4R3c

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\modules (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\modules@4DW4R3 \\?\globalroot\systemroot\system32\drivers\4DW4R3nnQoxYXNLp.sys

Reg HKLM\SYSTEM\ControlSet003\Services\4DW4R3\modules@4DW4R3c \\?\globalroot\systemroot\system32\4DW4R3TSpxUssedj.dll

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\4DW4R3c.dll 28160 bytes executable

File C:\WINDOWS\system32\4DW4R3mmjBdpoSFU.dll 28160 bytes executable

File C:\WINDOWS\system32\4DW4R3sv.dat 53 bytes

File C:\WINDOWS\system32\4DW4R3tpukwheoUf.dll 28160 bytes executable

File C:\WINDOWS\system32\4DW4R3TSpxUssedj.dll 28160 bytes executable

File C:\WINDOWS\system32\4DW4R3YRqeaTvvLY.dll 28160 bytes executable

File C:\WINDOWS\system32\drivers\4DW4R3.sys 46592 bytes executable

File C:\WINDOWS\system32\drivers\4DW4R3MtDinDsEpf.sys 46592 bytes executable

File C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys 46592 bytes executable <-- ROOTKIT !!!

File C:\WINDOWS\system32\drivers\4DW4R3WpMIExFMIS.sys 46592 bytes executable

File C:\WINDOWS\system32\drivers\4DW4R3xbUbtWwvvQ.sys 46592 bytes executable

File C:\WINDOWS\Temp\4DW4R3178ed2 53 bytes

File C:\WINDOWS\Temp\4DW4R32e7995 53 bytes

File C:\WINDOWS\Temp\4DW4R345637d 53 bytes

File C:\WINDOWS\Temp\4DW4R3a0d3 53 bytes

---- EOF - GMER 1.0.15 ----

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 4/27/2007 3:44:14 PM

System Uptime: 3/1/2010 8:55:46 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 0C2425

Processor: Intel

Edited March 4, 2010 by Maurice Naggar
GMER log & Attach placed In-line by moderator

Maurice Naggar · March 3, 2010

Hello ofudd.

Your system has a rootkit infection. With a modicum of fortune, we can remove it.

Please follow my guidance.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not ofudd and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Take out the trash (temporary files & temporary internet files)

Please download ATF Cleaner by Atribune, saving it to your desktop. It is used to cleanout temporary files & temp areas used by internet browsers.

Start ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

If you use Firefox browser, do this also:

Click Firefox at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser, do this also:

Click Opera at the top and choose: Select All

Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

ATF-Cleaner should be run per the above in every user-login account {User Profile}

Step 3

Disable temporarily your antivirus program. Use the following as a guide. Do NOT turn off the firewall

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Step 4

Download The Avenger by Swandog46 from here.

Unzip/extract it to a folder on your desktop.
Double click on avenger.exe to run The Avenger.
Click OK.
Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.

Copy all of the text in the below textbox to the clibpboard by highlighting it and then pressing Ctrl+C.

Drivers to disable:
4DW4R3
Drivers to delete:
4DW4R3

Files to delete:
C:\WINDOWS\system32\4DW4R3c.dll
C:\WINDOWS\system32\4DW4R3mmjBdpoSFU.dll
C:\WINDOWS\system32\4DW4R3sv.dat
C:\WINDOWS\system32\4DW4R3tpukwheoUf.dll
C:\WINDOWS\system32\4DW4R3TSpxUssedj.dll
C:\WINDOWS\system32\4DW4R3YRqeaTvvLY.dll
C:\WINDOWS\system32\drivers\4DW4R3.sys
C:\WINDOWS\system32\drivers\4DW4R3MtDinDsEpf.sys
C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys
C:\WINDOWS\system32\drivers\4DW4R3WpMIExFMIS.sys
C:\WINDOWS\system32\drivers\4DW4R3xbUbtWwvvQ.sys
C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys

Registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\4DW4R3
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\4DW4R3


Folders to delete:
C:\WINDOWS\Temp\4DW4R3178ed2
C:\WINDOWS\Temp\4DW4R32e7995
C:\WINDOWS\Temp\4DW4R345637d
C:\WINDOWS\Temp\4DW4R3a0d3
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler

In the avenger window, click the Paste Script from Clipboard icon, button.
Make sure that what appears in Avenger matches exactly what you were asked to Copy/Paste from the Code box above.
Click the Execute button.
You will be asked Are you sure you want to execute the current script?.
Click Yes.
You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
Click Yes.
Your PC will now be rebooted.
Note: If the above script contains Drivers to delete: or Drivers to disable:, then The Avenger will require two reboots to complete its operation.
If that is the case, it will force a BSOD on the first reboot. This is normal & expected behaviour.
After your PC has completed the necessary reboots, a log should automatically open. Please copy/paste the contents of c:\avenger.txt into your next reply.

Not all the items will be found; so do not worry. Hopefully enough of the rootkit will be removed so that we can continue forward with more cleaning.

If you get a blue screen abort when it reboots, please write down all the information, STOP codes and description.

and then reboot the system again.

Step 5

Start MBAM and do a full scan.

Step 6

Reply with the C:\Avenger.txt

and the latest MBAM scan log

There will be much much more to do later.

BTW, do NOT surf the web, nor play online games. Just go to this forum & the sites I guide you to. Your system has a rootkit infection.

Do NOT use the attach feature to upload your log reports !! Always Copy & Paste them into main body of reply box.

Use single or multiple posts as needed. Just do not attach unless asked by me. Thanks.

ofudd · March 3, 2010

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "4DW4R3" found!

ImagePath: \systemroot\system32\drivers\4DW4R3nnQoxYXNLp.sys

Start Type: 4 (Disabled)

Rootkit scan completed.

Driver "4DW4R3" disabled successfully.

Driver "4DW4R3" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3c.dll" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3mmjBdpoSFU.dll" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3sv.dat" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3tpukwheoUf.dll" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3TSpxUssedj.dll" deleted successfully.

File "C:\WINDOWS\system32\4DW4R3YRqeaTvvLY.dll" deleted successfully.

File "C:\WINDOWS\system32\drivers\4DW4R3.sys" deleted successfully.

File "C:\WINDOWS\system32\drivers\4DW4R3MtDinDsEpf.sys" deleted successfully.

File "C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys" deleted successfully.

File "C:\WINDOWS\system32\drivers\4DW4R3WpMIExFMIS.sys" deleted successfully.

File "C:\WINDOWS\system32\drivers\4DW4R3xbUbtWwvvQ.sys" deleted successfully.

Error: file "C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys" not found!

Deletion of file "C:\WINDOWS\system32\drivers\4DW4R3nnQoxYXNLp.sys" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\4DW4R3" not found!

Deletion of registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\4DW4R3" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Registry key "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\4DW4R3" deleted successfully.

Error: folder "C:\WINDOWS\Temp\4DW4R3178ed2" not found!

Deletion of folder "C:\WINDOWS\Temp\4DW4R3178ed2" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: folder "C:\WINDOWS\Temp\4DW4R32e7995" not found!

Deletion of folder "C:\WINDOWS\Temp\4DW4R32e7995" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: folder "C:\WINDOWS\Temp\4DW4R345637d" not found!

Deletion of folder "C:\WINDOWS\Temp\4DW4R345637d" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Error: folder "C:\WINDOWS\Temp\4DW4R3a0d3" not found!

Deletion of folder "C:\WINDOWS\Temp\4DW4R3a0d3" failed!

Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)

--> the object does not exist

Folder "C:\recycler" deleted successfully.

Error: could not open folder "D:\recycler"

Deletion of folder "D:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Folder "e:\recycler" deleted successfully.

Error: could not open folder "f:\recycler"

Deletion of folder "f:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "g:\recycler"

Deletion of folder "g:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Error: could not open folder "h:\recycler"

Deletion of folder "h:\recycler" failed!

Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)

--> bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

Maurice Naggar · March 3, 2010

Very good result so far. It appears we knocked the heart out of the rootkit. We do need much more followup.

I'll await the results of the MBAM scan before I reply further.

ofudd · March 3, 2010

Malwarebytes' Anti-Malware 1.44

Database version: 3817

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

3/3/2010 5:40:33 AM

mbam-log-2010-03-03 (05-40-19).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 214555

Time elapsed: 6 hour(s), 26 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 1

Registry Data Items Infected: 4

Folders Infected: 0

Files Infected: 10

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijacker) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Online Add-on (Trojan.Zlob) -> No action taken.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> No action taken.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-7671178844-5555758450-598130829-7135\windll.exe) Good: (Explorer.exe) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-7671178844-5555758450-598130829-7135\windll.exe (Worm.P2P) -> No action taken.

C:\WINDOWS\system32\drivers\4DW4R3hARCjLuOpy.sys (Malware.Packer) -> No action taken.

C:\WINDOWS\system32\drivers\4DW4R3rATnQlxrPG.sys (Malware.Packer) -> No action taken.

C:\WINDOWS\system32\drivers\4DW4R3rptBqDXqki.sys (Malware.Packer) -> No action taken.

C:\Documents and Settings\Boki\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> No action taken.

C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> No action taken.

C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken.

C:\WINDOWS\system32\4DW4R3obvpCUsDjV.dll (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\4DW4R3wghWvUaXBn.dll (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\4DW4R3whMIQYlSLl.dll (Rootkit.Agent) -> No action taken.

Maurice Naggar · March 3, 2010

You see that MBAM log shows "no action taken". Did you not select for it to remove all it found? Please do that.

Follow the directions carefully; we need for MBAM to remove as much as it can.

Start your MBAM MalwareBytes' Anti-Malware.

Click the Settings Tab. Make sure all option lines have a checkmark.

When done, click the Scanner tab.

Do a FULL Scan.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Reply with copy of MBAM latest log for my review. There will be more to do later.

ofudd · March 3, 2010

I clicked removed, allowed reboot, and running MBAM again. 90 minutes into it, going to work and will follow up in about 12 hours.

thanks btw

Maurice Naggar · March 3, 2010

Take your time. I'll check back on you. We are certainly running more tools after this.

Reminder: do not use the system to surf the net or play online games, and certainly no financial transactions of any sort.

ofudd · March 4, 2010

results of second full scan:

Malwarebytes' Anti-Malware 1.44

Database version: 3817

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

3/3/2010 6:25:57 PM

mbam-log-2010-03-03 (18-25-57).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 214432

Time elapsed: 7 hour(s), 31 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451307.sys (Malware.Packer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451308.sys (Malware.Packer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451309.sys (Malware.Packer) -> Quarantined and deleted successfully.

ofudd · March 4, 2010

and here's from the first full scan after quarantine/delete

Malwarebytes' Anti-Malware 1.44

Database version: 3817

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

3/3/2010 5:45:21 AM

mbam-log-2010-03-03 (05-45-21).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 214555

Time elapsed: 6 hour(s), 26 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 1

Registry Data Items Infected: 4

Folders Infected: 0

Files Infected: 10

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijacker) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Online Add-on (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-7671178844-5555758450-598130829-7135\windll.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-7671178844-5555758450-598130829-7135\windll.exe (Worm.P2P) -> Delete on reboot.

C:\WINDOWS\system32\drivers\4DW4R3hARCjLuOpy.sys (Malware.Packer) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\4DW4R3rATnQlxrPG.sys (Malware.Packer) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\4DW4R3rptBqDXqki.sys (Malware.Packer) -> Quarantined and deleted successfully.

C:\Documents and Settings\Boki\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully.

C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4DW4R3obvpCUsDjV.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4DW4R3wghWvUaXBn.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4DW4R3whMIQYlSLl.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

Maurice Naggar · March 4, 2010

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not ofudd and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Next Step

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

If you have a prior copy of Combofix, delete it now !

Download Combofix from any of the links below. You must rename it before saving it. Save it to your Desktop.

Link 1

Link 2

Link 3

* IMPORTANT !!! SAVE AS Combo-Fix.exe to your Desktop

If your I.E. browser shows a warning message at the top, do a Right-Click on the bar and select Download, saving it to the Desktop.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

Please watch Combofix as it runs, as you may see messages which require your response, or the pressing of OK button.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

-------------------------------------------------------

A caution - Do not run Combofix more than once.

Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled.

If this occurs, please reboot to restore the desktop.

=

RE-Enable your AntiVirus and AntiSpyware applications.

Step 2

Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe

Close all open windows on the Task Bar. Click the icon (for Vista, right click the icon and Run as Administrator) to start the program.
In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
Exit OTL by clicking the X at top right.

Step 3

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Step 4

Reply with copy {Copy & Paste here} C:\Combofix.txt

OTL.txt

Extras.txt

Checkup.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

ofudd · March 4, 2010

Step 4
Reply with copy {Copy & Paste here} C:\Combofix.txt
OTL.txt
Extras.txt
Checkup.txt

ComboFix 10-03-03.09 - Boki 03/04/2010 6:16.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.93 [GMT -10:00]

Running from: e:\user documents\Boki_\Desktop\Combo-Fix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\j\Application Data\EurekaLog

c:\recycler\S-1-5-21-7671178844-5555758450-598130829-7135

.

((((((((((((((((((((((((( Files Created from 2010-02-04 to 2010-03-04 )))))))))))))))))))))))))))))))

.

2010-03-03 03:41 . 2010-01-08 02:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-03 03:41 . 2010-03-03 03:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-03-03 03:41 . 2010-01-08 02:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-03 03:24 . 2010-03-03 03:24 -------- d-----w- c:\program files\ERUNT

2010-03-02 05:54 . 2010-03-03 03:41 -------- d-----w- c:\documents and settings\Boki\Application Data\Malwarebytes

2010-03-02 05:46 . 2001-08-18 08:36 5632 ----a-w- c:\windows\system32\ptpusb.dll

2010-03-02 05:46 . 2008-04-13 18:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2010-03-02 05:46 . 2008-04-14 00:12 159232 ----a-w- c:\windows\system32\ptpusd.dll

2010-02-27 22:00 . 2010-02-27 22:00 -------- d-----w- C:\ifmx.wmv

2010-02-27 05:50 . 2010-02-27 05:50 -------- d-----w- c:\program files\R

2010-02-15 20:10 . 2010-02-15 20:10 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Identities

2010-02-15 19:40 . 2010-02-15 19:40 -------- d-----w- c:\program files\SomePDF

2010-02-15 19:35 . 2010-03-02 05:28 -------- d-----w- c:\program files\Freeware PDF Unlocker

2010-02-14 22:59 . 2010-02-14 22:59 29184 ----a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-02-13 15:36 . 2010-02-13 15:36 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Mozilla

2010-02-12 23:59 . 2010-02-13 00:02 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Adobe

2010-02-12 05:02 . 2010-02-13 15:16 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Google

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-04 16:28 . 2007-04-29 07:53 -------- d-----w- c:\documents and settings\Boki\Application Data\Skype

2010-03-04 16:28 . 2010-01-30 17:09 -------- d-----w- c:\documents and settings\Boki\Application Data\skypePM

2010-03-03 23:10 . 2007-04-29 08:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-03-03 03:41 . 2009-06-20 22:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-03-02 05:28 . 2010-01-16 20:59 -------- d-----w- c:\program files\Common Files\Akamai

2010-01-30 17:09 . 2010-01-30 17:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat

2010-01-30 17:06 . 2010-01-30 17:06 -------- d-----w- c:\program files\Common Files\Skype

2010-01-30 17:06 . 2007-04-29 07:53 -------- d-----r- c:\program files\Skype

2010-01-30 17:06 . 2007-04-29 07:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-01-12 06:39 . 2010-01-12 06:39 -------- d-----w- c:\program files\ETS

2010-01-10 03:23 . 2010-01-10 03:22 3054384 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\Unpack\bfgsetup_s1_l1.exe

2010-01-10 03:22 . 2010-01-10 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache

2010-01-09 10:41 . 2010-01-09 10:40 -------- d-----w- c:\program files\WorldOfGooDemo

2010-01-09 10:41 . 2010-01-09 10:41 -------- d-----w- c:\documents and settings\All Users\Application Data\2DBoy

2010-01-06 20:07 . 2010-01-06 20:07 143264 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\world-of-goo_s1_l1_gF5079T1L1_d749754644.exe

2010-01-06 20:07 . 2010-01-06 20:07 2997384 ----a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\clientinstaller\bfgsetup_s1_l1.exe

2009-12-04 20:03 . 2009-12-04 20:03 251376 ----a-w- c:\documents and settings\j\Application Data\Mozilla\plugins\npgoogletalk.dll

2009-12-21 20:06 . 2009-06-01 08:26 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-29 68856]

"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-12-21 30192]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^Joni^Start Menu^Programs^Startup^Dropbox.lnk]

path=c:\documents and settings\Joni\Start Menu\Programs\Startup\Dropbox.lnk

backup=c:\windows\pss\Dropbox.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-01-12 08:16 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApproveItForOfficeSetup]

2007-10-29 19:49 155648 -c--a-w- c:\program files\ApproveIt\Support\Tools\ApproveItForOfficeSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-10-19 18:59 126976 -c--a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2005-10-19 18:59 155648 -c--a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2008-06-10 14:27 144784 -c--a-w- c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"sdCoreService"=3 (0x3)

"sdAuxService"=3 (0x3)

"ose"=3 (0x3)

"Netlogon"=3 (0x3)

"mnmsrvc"=3 (0x3)

"iPod Service"=3 (0x3)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"helpsvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\\Documents and Settings\\j\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\j\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/15/2009 8:45 PM 135664]

S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [5/31/2009 10:26 PM 30192]

S4 sdAuxService;Spyware Doctor Auxiliary Service;c:\program files\Spyware Doctor\svcntaux.exe --> c:\program files\Spyware Doctor\svcntaux.exe [?]

.

Contents of the 'Scheduled Tasks' folder

2010-03-04 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-28 19:24]

2010-03-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-16 06:45]

2010-03-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-16 06:45]

2010-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-796845957-839522115-1010Core.job

- c:\documents and settings\j\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-10 07:28]

2010-03-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-796845957-839522115-1010UA.job

- c:\documents and settings\j\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-10 07:28]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.ask.com/?o=20011&l=dis

uInternet Connection Wizard,ShellNext = "c:\program files\Outlook Express\msimn.exe" //mailurl:mailto:dvord@hpu.edu

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

FF - ProfilePath - c:\documents and settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - plugin: c:\documents and settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPInfotl.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\nppdf32(2).dll

FF - plugin: e:\program files\Picasa3\npPicasa3.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-Virtual PDF Printer - c:\program files\Virtual PDF Printer\VirtualPDFPrinter.exe

HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe

MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe

AddRemove-HijackThis - F:\HijackThis.exe

AddRemove-KB923789 - c:\windows\system32\MacroMed\Flash\genuinst.exe

AddRemove-Spyware Doctor - c:\program files\Spyware Doctor\unins000.exe

AddRemove-Works2003Setup - c:\program files\Microsoft Works Suite 2003\Setup\Launcher.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-04 06:26

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3900)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Skype\Phone\Skype.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

.

**************************************************************************

.

Completion time: 2010-03-04 06:34:53 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-04 16:34

Pre-Run: 885,993,472 bytes free

Post-Run: 1,507,782,656 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 6545AFBDD2757F599A049B9DA167FE45

OTL logfile created on: 3/4/2010 6:41:37 AM - Run 1

OTL by OldTimer - Version 3.1.33.0 Folder = C:\Documents and Settings\Boki\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

254.00 Mb Total Physical Memory | 83.00 Mb Available Physical Memory | 33.00% Memory free

622.00 Mb Paging File | 446.00 Mb Available in Paging File | 72.00% Paging File free

Paging file location(s): E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 9.77 Gb Total Space | 1.43 Gb Free Space | 14.65% Space Free | Partition Type: NTFS

Drive D: | 439.54 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Drive E: | 28.48 Gb Total Space | 20.35 Gb Free Space | 71.45% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: OLEDELL

Current User Name: Boki

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/03/04 06:10:34 | 000,552,960 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Boki\Desktop\OTL.exe

PRC - [2008/04/13 14:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/04/28 22:11:42 | 000,068,856 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

========== Modules (SafeList) ==========

MOD - [2010/03/04 06:10:34 | 000,552,960 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Boki\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (sdCoreService)

SRV - File not found [Disabled | Stopped] -- -- (sdAuxService)

SRV - [2009/12/21 10:06:22 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-110309-193829)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)

DRV - [2007/02/25 23:45:42 | 000,059,472 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iksysflt.sys -- (IkSysFlt)

DRV - [2007/02/23 00:09:54 | 000,083,536 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\iksyssec.sys -- (IKSysSec)

DRV - [2007/02/19 18:13:38 | 000,052,304 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ikfilesec.sys -- (IKFileSec)

DRV - [2007/02/19 18:13:34 | 000,039,248 | ---- | M] (PCTools Research Pty Ltd.) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ikfileflt.sys -- (IKFileFlt)

DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)

DRV - [2002/07/18 16:35:20 | 000,056,192 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=20011&l=dis

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.07074039

FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.45

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/19 10:05:32 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/19 10:05:32 | 000,000,000 | ---D | M]

[2008/09/02 12:07:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\Mozilla\Extensions

[2010/03/03 19:59:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\extensions

[2009/11/06 07:34:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/02/10 22:52:58 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

[2007/10/08 23:23:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\Mozilla\Firefox\Profiles\fkatzzuf.default\extensions\moveplayer@movenetworks.com

[2010/03/03 19:59:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2008/09/28 16:50:18 | 000,626,688 | ---- | M] (ebrary) -- C:\Program Files\Mozilla Firefox\plugins\NPInfotl.dll

[2008/09/28 16:48:20 | 000,626,688 | ---- | M] (ebrary) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32(2).dll

O1 HOSTS File: ([2010/03/04 06:26:20 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)

O4 - HKCU..\Run: [skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)

O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)

O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 24.25.227.55 209.18.47.61 24.25.227.53

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2007/04/27 15:41:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - comfile [open] -- "%1" %*

O35 - exefile [open] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/04 06:39:50 | 000,552,960 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Boki\Desktop\OTL.exe

[2010/03/04 06:34:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2010/03/04 06:14:36 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/03/04 06:12:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/03/04 06:12:13 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/03/04 06:12:13 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/03/04 06:12:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/03/04 06:10:42 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/03/02 17:41:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/03/02 17:41:36 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/03/02 17:41:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/03/02 17:25:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/03/02 17:24:29 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2010/03/01 19:54:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Boki\Application Data\Malwarebytes

[2010/03/01 19:46:13 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll

[2010/03/01 19:46:10 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll

[2010/02/27 12:00:20 | 000,000,000 | ---D | C] -- C:\ifmx.wmv

[2010/02/26 19:50:24 | 000,000,000 | ---D | C] -- C:\Program Files\R

[2010/02/15 09:40:46 | 000,000,000 | ---D | C] -- C:\Program Files\SomePDF

[2010/02/15 09:35:53 | 000,000,000 | ---D | C] -- C:\Program Files\Freeware PDF Unlocker

[2010/02/10 17:18:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft

[2009/11/17 05:37:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google

[2009/11/15 20:46:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google

[2007/04/30 12:53:37 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft

[2007/04/27 15:45:11 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

[2007/04/27 15:45:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

[9 E:\User Documents\Boki_\My Documents\*.tmp files -> E:\User Documents\Boki_\My Documents\*.tmp -> ]

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Documents and Settings\Boki\Desktop\*.tmp files -> C:\Documents and Settings\Boki\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/04 06:38:05 | 000,843,187 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\SecurityCheck.exe

[2010/03/04 06:26:33 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/03/04 06:26:20 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/03/04 06:26:15 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/03/04 06:26:13 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/03/04 06:25:57 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job

[2010/03/04 06:25:47 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/03/04 06:25:42 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/03/04 06:25:41 | 266,407,936 | -HS- | M] () -- C:\hiberfil.sys

[2010/03/04 06:24:53 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Boki\ntuser.ini

[2010/03/04 06:24:52 | 003,670,016 | -H-- | M] () -- C:\Documents and Settings\Boki\NTUSER.DAT

[2010/03/04 06:14:44 | 000,000,281 | RHS- | M] () -- C:\boot.ini

[2010/03/04 06:10:34 | 000,552,960 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Boki\Desktop\OTL.exe

[2010/03/04 05:56:03 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/03/04 05:13:00 | 000,000,962 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-583907252-796845957-839522115-1010UA.job

[2010/03/03 08:13:00 | 000,000,910 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-583907252-796845957-839522115-1010Core.job

[2010/03/02 17:41:42 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/03/02 17:24:30 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\NTREGOPT.lnk

[2010/03/02 17:24:30 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\ERUNT.lnk

[2010/03/01 20:53:15 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Boki\defogger_reenable

[2010/03/01 19:17:04 | 000,011,820 | -HS- | M] () -- C:\Documents and Settings\Boki\Local Settings\Application Data\dsw6tj

[2010/02/28 19:44:19 | 005,785,084 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\CoolTools2.pdf

[2010/02/27 11:56:48 | 000,000,655 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\PowerArchiver.lnk

[2010/02/26 19:57:59 | 000,052,063 | ---- | M] () -- E:\User Documents\Boki_\My Documents\Fig6_2_better.jpg

[2010/02/26 19:51:19 | 000,000,788 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\R 2.10.1.lnk

[2010/02/26 04:30:03 | 000,013,918 | ---- | M] () -- E:\User Documents\Boki_\My Documents\.Rhistory

[2010/02/26 04:30:03 | 000,005,509 | ---- | M] () -- E:\User Documents\Boki_\My Documents\.RData

[2010/02/23 20:35:32 | 173,215,331 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\HDsamplerV.mp4

[2010/02/16 14:09:09 | 003,777,024 | ---- | M] () -- E:\User Documents\Boki_\My Documents\Borjana Lubura - capstone rr 5.doc

[2010/02/15 09:12:12 | 007,596,306 | ---- | M] () -- C:\Documents and Settings\Boki\Desktop\portfolio(encrptyed).pdf

[2010/02/11 18:54:40 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

[2010/02/10 17:18:34 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf

[2010/02/03 17:56:11 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk

[9 E:\User Documents\Boki_\My Documents\*.tmp files -> E:\User Documents\Boki_\My Documents\*.tmp -> ]

[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\Documents and Settings\Boki\Desktop\*.tmp files -> C:\Documents and Settings\Boki\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/04 06:39:50 | 000,843,187 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\SecurityCheck.exe

[2010/03/04 06:14:44 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2010/03/04 06:14:38 | 000,260,272 | ---- | C] () -- C:\cmldr

[2010/03/04 06:12:13 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/03/04 06:12:13 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/03/04 06:12:13 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/03/04 06:12:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/03/04 06:12:13 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/03/02 17:41:42 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/03/02 17:31:51 | 000,731,136 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\avenger.exe

[2010/03/02 17:24:30 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\NTREGOPT.lnk

[2010/03/02 17:24:30 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\ERUNT.lnk

[2010/03/01 20:53:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Boki\defogger_reenable

[2010/03/01 20:35:08 | 266,407,936 | -HS- | C] () -- C:\hiberfil.sys

[2010/03/01 19:15:10 | 000,011,820 | -HS- | C] () -- C:\Documents and Settings\Boki\Local Settings\Application Data\dsw6tj

[2010/02/28 19:43:41 | 005,785,084 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\CoolTools2.pdf

[2010/02/27 11:56:47 | 000,000,655 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\PowerArchiver.lnk

[2010/02/26 19:57:49 | 000,052,063 | ---- | C] () -- E:\User Documents\Boki_\My Documents\Fig6_2_better.jpg

[2010/02/26 19:51:19 | 000,000,788 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\R 2.10.1.lnk

[2010/02/26 04:30:03 | 000,013,918 | ---- | C] () -- E:\User Documents\Boki_\My Documents\.Rhistory

[2010/02/26 04:30:02 | 000,005,509 | ---- | C] () -- E:\User Documents\Boki_\My Documents\.RData

[2010/02/23 20:29:50 | 173,215,331 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\HDsamplerV.mp4

[2010/02/16 14:09:07 | 003,777,024 | ---- | C] () -- E:\User Documents\Boki_\My Documents\Borjana Lubura - capstone rr 5.doc

[2010/02/15 09:45:29 | 007,596,306 | ---- | C] () -- C:\Documents and Settings\Boki\Desktop\portfolio(encrptyed).pdf

[2010/02/03 17:56:11 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk

[2010/01/11 20:40:02 | 000,000,058 | ---- | C] () -- C:\WINDOWS\OSA.INI

[2009/01/26 19:04:20 | 000,000,147 | ---- | C] () -- C:\WINDOWS\STATVIEW.INI

[2008/12/04 06:24:08 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\virport.dll

[2007/11/28 21:00:34 | 000,000,276 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI

[2007/06/03 23:54:11 | 000,039,424 | ---- | C] () -- C:\Documents and Settings\Boki\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007/05/12 23:08:00 | 000,000,025 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2007/04/27 20:29:06 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2000/03/29 22:00:00 | 000,125,440 | ---- | C] () -- C:\WINDOWS\System32\UNZDLL.DLL

[1999/10/23 18:29:44 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\UNRAR.DLL

[1999/08/11 15:28:02 | 000,101,888 | ---- | C] () -- C:\WINDOWS\System32\LIBBZ2.DLL

[1999/05/21 21:10:00 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ZIPDLL.DLL

[1998/01/28 00:06:04 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\UNACE.DLL

========== LOP Check ==========

[2010/01/09 00:41:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\2DBoy

[2008/08/27 11:07:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PureEdge

[2008/11/11 19:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2008/08/27 10:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZipSE

[2009/04/06 05:11:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\Dropbox

[2008/02/20 21:24:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\MSNInstaller

[2008/08/27 07:32:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\PureEdge

[2009/04/06 05:15:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Boki\Application Data\Scilab

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras logfile created on: 3/4/2010 6:41:37 AM - Run 1

OTL by OldTimer - Version 3.1.33.0 Folder = C:\Documents and Settings\Boki\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

254.00 Mb Total Physical Memory | 83.00 Mb Available Physical Memory | 33.00% Memory free

622.00 Mb Paging File | 446.00 Mb Available in Paging File | 72.00% Paging File free

Paging file location(s): E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 9.77 Gb Total Space | 1.43 Gb Free Space | 14.65% Space Free | Partition Type: NTFS

Drive D: | 439.54 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Drive E: | 28.48 Gb Total Space | 20.35 Gb Free Space | 71.45% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: OLEDELL

Current User Name: Boki

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] --

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.exe [@ = exefile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- Reg Error: Key error.

https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /k "cd %L" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 1

"FirewallOverride" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 -- File not found

"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Files and Settings Transfer Wizard -- (Microsoft Corporation)

"C:\Documents and Settings\j\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll" = C:\Documents and Settings\j\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.dll:*:Enabled:Google Talk Plugin -- (Google)

"C:\Documents and Settings\j\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\j\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)

"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)

"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies)

"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{1CB92574-96F2-467B-B793-5CEB35C40C29}" = Image Resizer Powertoy for Windows XP

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{2EAF7E61-068E-11DF-953C-005056806466}" = Google Earth

"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java SE Runtime Environment 6 Update 1

"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java 6 Update 2

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java 6 Update 3

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{5299C5E1-70F9-3D1D-A1FA-BDECA4EC8015}" = Google Talk Plugin

"{666CF041-77BE-414E-9A9D-0A227E9B48F8}" = Norton

Maurice Naggar · March 5, 2010

Next step

Download to your Desktop FixPolicies.exe, by Bill Castner, MS-MVP, a self-extracting ZIP archive from

>>> here <<<

Double-click FixPolicies.exe.
Click the "Install" button on the bottom toolbar of the box that will open.
The program will create a new Folder called FixPolicies.
Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
A black box will briefly appear and then close.
This fix may prove temporary. Active malware may revert these changes at your next startup. You can safely run the utility again.

Step 2

Please double-click OTL.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy all the lines in between the **** stars lines **** below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
*****************************************************************
:files
C:\Documents and Settings\Boki\Local Settings\Application Data\dsw6tj
C:\recycler
D:\recycler
e:\recycler
f:\recycler
g:\recycler
h:\recycler
:Commands
[purity]
[emptytemp]
[CREATERESTOREPOINT]
*****************************************************************
Return to OTL. Right click in the "Custom Scans/Fixes" window (under the aqua-blue bar) and choose Paste.
Close any browser(s) windows that may be open.
Using your mouse, click on the red-lettered button Run Fix.
Once you see a message box "Fix complete! Click OK to open the fix log."
Click the OK button
The log will open in Notepad (your default text editor).
Save the log. Post a copy of that log in your next reply.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.

If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Step 3

I do not see an antivirus program here. If cost is an issue, get & setup Avira Antivir (free for personal non-commercial use). See http://www.free-av.com

Do that right away and as a first priority. You should never be without an antivirus.

Step 4

Do a full scan of your system with antivirus program and tell me what the results are.

ofudd · March 5, 2010

At Step 2: the bottom of OTL window shows "Fix Complete!" and the green marks have filled to the right of the progress indicator bar. But there is no OK dialog box, no response to mouse clicking or keyboard.

Maurice Naggar · March 5, 2010

Close /exit OTL. If it is stuck, use Task Manager (CTRL+ALT+DEL keys) and end OTL.

In any event, proceed to the next steps.

ofudd · March 5, 2010

All processes killed

========== FILES ==========

C:\Documents and Settings\Boki\Local Settings\Application Data\dsw6tj moved successfully.

File\Folder C:\recycler not found.

File\Folder D:\recycler not found.

e:\RECYCLER\S-1-5-21-583907252-796845957-839522115-1008 folder moved successfully.

e:\RECYCLER folder moved successfully.

File\Folder f:\recycler not found.

File\Folder g:\recycler not found.

File\Folder h:\recycler not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Boki

->Temp folder emptied: 220304 bytes

->Temporary Internet Files folder emptied: 35373922 bytes

->Java cache emptied: 5673627 bytes

->FireFox cache emptied: 68629783 bytes

->Flash cache emptied: 1603876 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: Guest

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Java cache emptied: 50533 bytes

->FireFox cache emptied: 69244150 bytes

->Flash cache emptied: 5663 bytes

User: j

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Java cache emptied: 3124408 bytes

->FireFox cache emptied: 44516015 bytes

->Flash cache emptied: 210364 bytes

User: Joni

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 11739204 bytes

->Java cache emptied: 45657585 bytes

->FireFox cache emptied: 73318887 bytes

->Flash cache emptied: 47496 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32835 bytes

User: Stefi

->Temp folder emptied: 14356 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Java cache emptied: 416364 bytes

->FireFox cache emptied: 75933761 bytes

->Google Chrome cache emptied: 9152398 bytes

->Flash cache emptied: 65208 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2195181 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 427.00 mb

Restore point Set: OTL Restore Point (64424509440)

OTL by OldTimer - Version 3.1.33.0 log created on 03042010_173842

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Avira AntiVir Personal

Report file date: Friday, March 05, 2010 06:00

Scanning for 1819771 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : OLEDELL

Version information:

BUILD.DAT : 9.0.0.415 21609 Bytes 11/8/2009 10:00:00

AVSCAN.EXE : 9.0.3.10 466689 Bytes 10/13/2009 21:26:33

AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 20:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 21:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 20:58:52

VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 17:35:52

VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 15:43:10

VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 15:46:07

VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 15:47:16

VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 15:48:52

VBASE005.VDF : 7.10.4.204 2048 Bytes 3/5/2010 15:48:52

VBASE006.VDF : 7.10.4.205 2048 Bytes 3/5/2010 15:48:52

VBASE007.VDF : 7.10.4.206 2048 Bytes 3/5/2010 15:48:52

VBASE008.VDF : 7.10.4.207 2048 Bytes 3/5/2010 15:48:53

VBASE009.VDF : 7.10.4.208 2048 Bytes 3/5/2010 15:48:54

VBASE010.VDF : 7.10.4.209 2048 Bytes 3/5/2010 15:48:54

VBASE011.VDF : 7.10.4.210 2048 Bytes 3/5/2010 15:48:54

VBASE012.VDF : 7.10.4.211 2048 Bytes 3/5/2010 15:48:54

VBASE013.VDF : 7.10.4.212 2048 Bytes 3/5/2010 15:48:55

VBASE014.VDF : 7.10.4.213 2048 Bytes 3/5/2010 15:48:55

VBASE015.VDF : 7.10.4.214 2048 Bytes 3/5/2010 15:48:55

VBASE016.VDF : 7.10.4.215 2048 Bytes 3/5/2010 15:48:55

VBASE017.VDF : 7.10.4.216 2048 Bytes 3/5/2010 15:48:57

VBASE018.VDF : 7.10.4.217 2048 Bytes 3/5/2010 15:48:57

VBASE019.VDF : 7.10.4.218 2048 Bytes 3/5/2010 15:48:57

VBASE020.VDF : 7.10.4.219 2048 Bytes 3/5/2010 15:48:57

VBASE021.VDF : 7.10.4.220 2048 Bytes 3/5/2010 15:48:58

VBASE022.VDF : 7.10.4.221 2048 Bytes 3/5/2010 15:48:58

VBASE023.VDF : 7.10.4.222 2048 Bytes 3/5/2010 15:48:58

VBASE024.VDF : 7.10.4.223 2048 Bytes 3/5/2010 15:48:58

VBASE025.VDF : 7.10.4.224 2048 Bytes 3/5/2010 15:48:59

VBASE026.VDF : 7.10.4.225 2048 Bytes 3/5/2010 15:49:00

VBASE027.VDF : 7.10.4.226 2048 Bytes 3/5/2010 15:49:00

VBASE028.VDF : 7.10.4.227 2048 Bytes 3/5/2010 15:49:00

VBASE029.VDF : 7.10.4.228 2048 Bytes 3/5/2010 15:49:00

VBASE030.VDF : 7.10.4.229 2048 Bytes 3/5/2010 15:49:01

VBASE031.VDF : 7.10.4.232 16384 Bytes 3/5/2010 15:49:01

Engineversion : 8.2.1.180

AEVDF.DLL : 8.1.1.3 106868 Bytes 3/5/2010 15:51:07

AESCRIPT.DLL : 8.1.3.17 1032570 Bytes 3/5/2010 15:51:05

AESCN.DLL : 8.1.5.0 127347 Bytes 3/5/2010 15:50:54

AESBX.DLL : 8.1.2.0 254323 Bytes 3/5/2010 15:51:12

AERDL.DLL : 8.1.4.2 479602 Bytes 3/5/2010 15:50:52

AEPACK.DLL : 8.2.1.0 426356 Bytes 3/5/2010 15:50:41

AEOFFICE.DLL : 8.1.0.39 196987 Bytes 3/5/2010 15:50:27

AEHEUR.DLL : 8.1.1.7 2326902 Bytes 3/5/2010 15:50:21

AEHELP.DLL : 8.1.10.1 237942 Bytes 3/5/2010 15:49:21

AEGEN.DLL : 8.1.2.0 373107 Bytes 3/5/2010 15:49:14

AEEMU.DLL : 8.1.1.0 393587 Bytes 11/8/2009 17:38:26

AECORE.DLL : 8.1.12.2 188790 Bytes 3/5/2010 15:49:06

AEBB.DLL : 8.1.0.3 53618 Bytes 11/8/2009 17:38:20

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 18:47:59

AVPREF.DLL : 9.0.3.0 44289 Bytes 8/27/2009 01:14:02

AVREP.DLL : 8.0.0.7 159784 Bytes 3/5/2010 15:51:17

AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 20:32:09

AVARKT.DLL : 9.0.0.3 292609 Bytes 3/25/2009 01:05:41

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 20:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/29/2009 01:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 18:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 20:32:10

RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/16/2009 01:39:58

RCTEXT.DLL : 9.0.73.0 86785 Bytes 10/13/2009 22:25:47

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:, E:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: Friday, March 05, 2010 06:00

Starting search for hidden objects.

'44332' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'skypePM.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'Skype.exe' - '1' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned

Scan process 'notepad.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

28 processes with 28 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'E:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '50' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\hiberfil.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451310.exe

[DETECTION] Is the TR/FakeRean.A.163 Trojan

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451311.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451312.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451313.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

Begin scan in 'E:\' <bigun>

E:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

E:\User Documents\Boki_\My Documents\Downloads\SetupGamevance.exe

[DETECTION] Contains recognition pattern of the ADSPY/GameVance.C.65 adware or spyware

Beginning disinfection:

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451310.exe

[DETECTION] Is the TR/FakeRean.A.163 Trojan

[NOTE] The file was moved to '4bc534b7.qua'!

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451311.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4bc534b8.qua'!

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451312.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4ab2e569.qua'!

C:\System Volume Information\_restore{0E5C4E5F-E8AD-443B-A23A-72A7924320DC}\RP990\A0451313.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4ab3feb1.qua'!

E:\User Documents\Boki_\My Documents\Downloads\SetupGamevance.exe

[DETECTION] Contains recognition pattern of the ADSPY/GameVance.C.65 adware or spyware

[NOTE] The file was moved to '4c0534ed.qua'!

End of the scan: Friday, March 05, 2010 06:42

Used time: 41:10 Minute(s)

The scan has been done completely.

6474 Scanned directories

217914 Files were scanned

5 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

5 Files were moved to quarantine

0 Files were renamed

2 Files cannot be scanned

217907 Files not concerned

1607 Archives were scanned

2 Warnings

7 Notes

44332 Objects were scanned with rootkit scan

0 Hidden objects were found

Maurice Naggar · March 5, 2010

You are fortunate in that the Avira scan found only 1 item & removed it, a suspect downloaded game.

The other items it tagged were already out of the way.

You will want to print out or copy these instructions to Notepad for offline reference!

Let's have you get the Java runtime updated to the latest, and then run an online scan at ESET.

Step 1

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
Scroll down to where it says "Java Platform Standard Edition"
Click the "Download JRE" button to the right.
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement . ". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Start button > in Start menu -- Control Panel > Uninstall a Program (listed under Programs).
{In Classic view, double click Program and features}.
and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java) in the name.
De-intall/Remove each of the following
Java SE Runtime Environment 6 Update 1
Java 6 Update 2
Java 6 Update 3
Java 6 Update 5
Java 6 Update 7
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH Checked
  - Applications and Applets
    Trace and Log Files
  [*]Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  [*]Click OK to leave the Temporary Files Window

Small tweaks for Java runtime, since most all users do not need to load Java at each Windows startup:

Click Advanced Tab. Expand the Miscellaneous item.

UN-check the line Java quick starter

If you want to also un-check the "Check for updates automatically" you may:

Click the Update tab. un-check the line if it is checked.

Press Apply then OK. Close the applet when done.

To test your Java Run-time, you may go to this page http://www.java.com/en/download/help/testvm.xml

When all is well, you should see Java Version: 1.6.0_18 from Sun Microsystems Inc.

Step 2

Temporarily disable your antivirus. Do not turn off the firewall. See this reference

How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

You will want to print out or copy these instructions to Notepad for offline reference!

Start Internet Explorer & go to ESET Online Scanner website:

http://www.eset.com/onlinescan/

Accept the Terms of Use and press Start button;
Approve the install of the required ActiveX Control, then follow on-screen instructions;
Enable (check) the Remove found threats option, and run the scan.
After the scan completes, the Details tab in the Results window will display what was found and removed.
- A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt.
Look at contents of this file using Notepad or Wordpad.
The Frequently Asked Questions for ESET Online Scanner can be viewed here
http://www.eset.com/onlinescan/cac4.php?page=faq
- From ESET Tech Support: If you have ESET NOD32 installed, you should disable it prior to running this scanner.
  Otherwise the scan will take twice as long to do:
  everytime the ESET online scanner opens a file on your computer to scan it, NOD32 on your machine will rescan the file as a result.
- It is emphasized to temporarily disable any pc-resident {active} antivirus program prior to any on-line scan by any on-line scanner.
  (And the prompt re-enabling when finished.)
- If you use Firefox, you have to install IETab, an add-on. This is to enable ActiveX support.
- Do not use the system while the scan is running. Once the full scan is underway, go take a long break

Step 3

De-install the HijackThis program currently installed, if still present. Start menu -- Control Panel > Add-Or-Remove Programs.

RE-Enable your AntiVirus and AntiSpyware applications.

Download the HijackThis Installer

Save the HJT Installer to your desktop or the folder of your choice, then navigate to that folder and double-click Hijackthis.msi to start the installation.

When the Trend Micro HJT install box appears, click Install.

HijackThis (HJT) will be installed in the C:\Program Files\Trend Micro\HijackThis folder by default and a desktop shortcut will be created.

Next, start HijackThis. Do a "Scan and Save log".

Post back with copies of the the Eset scan log and

HijackThis log.

How is your system now

There will be more to do.

ofudd · March 6, 2010

the computer seems fine now, my original complaints (browser redirects and MBAM doesnt run) do not happen anymore.

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=40e6c5888f945743af15ea324384af76

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-03-06 04:59:20

# local_time=2010-03-05 06:59:20 (-1000, Hawaiian Standard Time)

# country="United States"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1797 16775141 100 94 0 40377770 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=53069

# found=1

# cleaned=1

# scan_time=2308

C:\Documents and Settings\j\My Documents\Downloads\SetupPlaySushi.exe probably a variant of Win32/Adware.Gamevance.AE application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 7:15:58 PM, on 3/5/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=20011&l=dis

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:dvord@hpu.edu

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--

End of file - 5137 bytes

Maurice Naggar · March 6, 2010

I see that you are clear of your original issues.

If you have a problem with these steps, or something does not quite work here, do let me know.

De-install your Adobe Reader: Use Control Panel's Add-Remove programs, Remove Adobe Reader.

De-install also ESET Online

HijackThis

Exit Control Panel.

Older versions of Adobe Reader pose a potential security risk.

Get latest Adobe Reader version 9.3

http://get.adobe.com/reader/

Be sure to un-check the box for Free McAfee Security Scan

The following few steps will remove tools we used; followed by advice on staying safer.

We have to remove Combofix and all its associated folders.

By whichever name you named it, ( you had named it combo-fix ), put that name in the RUN box stated just below.

The "/uninstall" in the Run line below is to start Combofix for it's cleanup & removal function.

Note the space after exe and before the slash mark.

The utility must be removed to prevent any un-intentional or accidental usage, PLUS, to free up much space on your hard disk.

Click Start, then click Run. Then type in
```
CMD
```
and press Enter-key.
This will open a command-prompt window.
In the command box that opens, type or copy/paste
e:\user documents\Boki_\Desktop\Combo-Fix.exe /uninstall
and then click OK.

Please double-click OTL.exe to run it.
Click on the CleanUp! button at upper Right corner. When you do this a text file named cleanup.txt will be downloaded from the internet. If you get a warning from your firewall or other security programs regarding OTL attempting to contact the internet you should allow it to do so. After the list has been download you'll be asked if you want to Begin cleanup process? Select Yes.
This step removes the files, folders, and shortcuts created by the tools I had you download and run.

Run Disk Cleanup with the System Restore Cleanup as outlined here by Bert Kinney, MS MVP
http://bertk.mvps.org/html/diskclean.html
Configure your Antivirus software to check for updates daily, at a time in which you are sure the computer will be on.
Check in at Windows Update and install any Critical Updates offered.
Make certain that Automatic Updates is enabled.
How to configure and use Automatic Updates in WinXP:
http://support.microsoft.com/kb/306525
Check on other update issues as well, visit Secunia Online Software Inspector (OSI)
Download, install, and keep updated Spyware Blaster (free): http://www.javacoolsoftware.com/spywareblaster.html (all Protections should be enabled at all times)
I'd recommend that you get and use MVP Mike Burgess' custom hosts file http://mvps.org/winhelp2002/hosts.htm
See the FAQ page http://mvps.org/winhelp2002/hostsfaq.htm
That would help to keep your browser away from known spyware/malware sites.
Make regular backups of your system to removable media: DVD, USB external hard drive, etc.
On some regular schedule, it is a good idea to do an online scan for viruses and malware. Here is a very short list of sites where this may be done:
Kaspersky Webscan Online Virus Scanner
ESET Online Scanner
Panda ActiveScan
Trend Micro Housecall
F-Secure Online Scanner
Read Tony Klein's article How Did I Get Infected In The First Place
Never, ever download free games, free tools, smileys, or anything free unless you can be absolutely sure the source is safe !

We are finished here. Best regards.

ofudd · March 6, 2010

thank you. should I re-enable whatever was disabled by defogger?

FYI, in the command-prompt window, this instruction returns an error related to not finding the directory "e:\user":

In the command box that opens, type or copy/paste
e:\user documents\Boki_\Desktop\Combo-Fix.exe /uninstall
and then click OK.

so I wrapped the path in quotation marks.

I have posted a related infection topic at http://forums.malwarebytes.org/index.php?showtopic=42466

Maurice Naggar · March 6, 2010

On the Combofix uninstall, if it did not uninstall, then (and in any event) proceed forward with the OTL Cleanup and the rest.

To reverse whatever you had done with Defogger:

DeFogger - Re-Enable To re-enable your Emulation drivers, double click DeFogger to run the tool.
The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers.
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
Your Emulation drivers are now re-enabled.

Since this case is resolved, I'll close it.

Others having similar issues should open their own topic.

The procedures used here were tailored for this system only, and for no other.

infection and MBAM BSOD rookit infection 4DW4R3nnQoxYXNLp.sys

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information