Jump to content

Need help with malware removal.


Recommended Posts

Hi,

My daughter was having problems with her laptop and asked me to take a look at it. I usually do OK with this sort of stuff following online guides and information but this one is proving to be trickier.

The original complaint was "My Security Wall" popping up and telling her she needed to purchase the program. I followed an online guide and thought I got rid of it but a few days later she told me her Google searches were being redirected. I'm not sure what is causing this but I suspect "My Security Wall" was not completely removed and/or she has other malware.

I followed the instructions in the "I'm infected - What do I do now?" post and ran Malwarebytes, her antivirus (AVG), DeFogger, and GMER. I may have made a mistake though. I ran these over several days and in between my daughter came over and copied some files that she needed. I decided that maybe I better start over from scratch and ran the programs again in preparation for posting here.

When I ran DeFogger the first time it did not ask for a restart so I restarted manually. When I decided to rerun everything I first ran DeFogger and re-enabled before I ran Malwarebytes again. Then I ran AVG again and DeFogger to disable (Still no restart request). I got through everything OK until I ran GMER and it crashed, (Microsoft window: ...has encountered a problem and needs to close.)

I would appreciate any help you could give me in solving this problem. I'm not sure if the following will help since GMER did not finish but I'm posting them just in case.

Thanks again in advance

Malwarebytes' Anti-Malware 1.44

Database version: 3817

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

3/4/2010 11:31:57 AM

mbam-log-2010-03-04 (11-31-57).txt

Scan type: Quick Scan

Objects scanned: 128894

Time elapsed: 13 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_09-12-01.01) - NTFSx86

Run by User at 13:53:45.27 on Thu 03/04/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.222.50 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: My Security Wall *On-access scanning enabled* (Updated) {CA38A626-1DD4-4079-AD95-CCBE6C7309B4}

FW: My Security Wall *enabled* {F99BA31B-4625-4B89-871B-50A50C45ECF1}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\AVG\AVG9\avgfws9.exe

C:\Program Files\AVG\AVG9\avgam.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Documents and Settings\User\Desktop\Malware stuff\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.comcast.net/comcast.html

uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

mSearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~2\COMCAS~1.DLL

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~2\COMCAS~1.DLL

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

uPolicies-system: EnableProfileQuota = 1 (0x1)

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: &Search

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: igfxcui - igfxsrvc.dll

AppInit_DLLs: c:\windows\system32\

IFEO: image file execution options - svchost.exe

Hosts: 74.125.45.100 4-open-davinci.com

Hosts: 74.125.45.100 securitysoftwarepayments.com

Hosts: 74.125.45.100 privatesecuredpayments.com

Hosts: 74.125.45.100 secure.privatesecuredpayments.com

Hosts: 74.125.45.100 getantivirusplusnow.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: browser.search.selectedEngine - search

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\user\application data\facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-27 25608]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-27 161800]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-27 333192]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-27 28424]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 360584]

R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-2-27 285392]

R2 avgfws9;AVG Firewall;c:\program files\avg\avg9\avgfws9.exe [2010-2-27 2304192]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-2-27 5832712]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-27 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-27 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-27 25736]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-6-3 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-26 24652]

=============== Created Last 30 ================

2010-03-04 18:45:44 0 ----a-w- c:\documents and settings\user\defogger_reenable

2010-03-04 15:58:50 0 d-sh--w- C:\found.000

2010-02-27 23:31:09 0 d--h--w- C:\$AVG

2010-02-27 23:30:38 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-02-27 23:30:37 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30:19 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:29:48 0 d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29:40 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar

2010-02-27 23:28:49 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28:47 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27:51 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27:51 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27:26 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

2010-02-20 18:53:57 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-20 18:53:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-13 04:00:50 0 d-----w- c:\docume~1\user\applic~1\Facebook

2010-02-12 22:25:04 0 d-----w- c:\docume~1\user\applic~1\MSNInstaller

2010-02-12 12:56:16 0 d-sh--w- c:\docume~1\alluse~1\applic~1\MSTUIBBW

2010-02-12 12:55:50 0 d-sh--w- c:\docume~1\alluse~1\applic~1\7a7704e

2010-02-12 02:07:54 0 d-----w- c:\program files\common files\xing shared

2010-02-11 15:26:39 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16:10 0 d-sh--w- c:\documents and settings\user\IECompatCache

==================== Find3M ====================

2009-12-31 16:50:03 353792 ------w- c:\windows\system32\dllcache\srv.sys

2009-12-22 05:21:02 1509888 ------w- c:\windows\system32\dllcache\shdocvw.dll

2009-12-21 13:19:18 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-16 18:43:27 343040 ------w- c:\windows\system32\dllcache\mspaint.exe

2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-14 07:08:23 33280 ------w- c:\windows\system32\dllcache\csrsrv.dll

2009-12-11 08:38:55 69120 ------w- c:\windows\system32\dllcache\iecompat.dll

2009-12-09 05:53:44 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

2009-12-08 19:27:51 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 19:27:51 2189184 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-12-08 18:43:50 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 18:43:50 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-12-08 09:23:28 474112 ------w- c:\windows\system32\dllcache\shlwapi.dll

============= FINISH: 13:55:18.79 ===============

Attach.zip

Link to post
Share on other sites

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

OK, here is the ComboFix log:

ComboFix 10-03-05.01 - User 03/06/2010 0:08.1.1 - x86

Running from: c:\documents and settings\User\Desktop\Malware stuff\ComboFix.exe

AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\User\Application Data\02000000f21cc486593C.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593O.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593P.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593S.manifest

c:\program files\Mozilla Firefox\searchplugins\search.xml

c:\program files\outlook

c:\recycler\S-1-5-21-1390067357-1606980848-839522115-1003

c:\recycler\S-1-5-21-3416710187-3200794616-3878359226-1003

c:\windows\COUPON~1.OCX

c:\windows\CouponPrinter.ocx

c:\windows\system32\nsprs.dll

c:\windows\system32\ssprs.dll

c:\windows\system32\vb40032.dll

C:\xcrashdump.dat

c:\windows\system32\proquota.exe . . . is missing!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

((((((((((((((((((((((((( Files Created from 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))))

.

2010-03-04 15:58 . 2010-03-04 15:58 -------- d-----w- C:\found.000

2010-02-27 23:31 . 2010-02-27 23:31 -------- d-----w- C:\$AVG

2010-02-27 23:30 . 2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-02-27 23:30 . 2010-02-27 23:30 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30 . 2010-02-27 23:30 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:30 . 2010-02-27 23:30 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-02-27 23:29 . 2010-03-06 05:04 -------- d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29 . 2010-03-02 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-02-27 23:28 . 2010-02-27 23:28 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28 . 2010-02-27 23:28 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27 . 2010-02-27 23:27 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27 . 2010-02-27 23:27 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27 . 2010-02-27 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-02-20 18:53 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53 . 2010-02-26 19:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-20 18:53 . 2010-01-07 21:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-13 04:00 . 2010-02-13 04:00 -------- d-----w- c:\documents and settings\User\Application Data\Facebook

2010-02-12 22:25 . 2010-02-12 22:25 -------- d-----w- c:\documents and settings\User\Application Data\MSNInstaller

2010-02-12 12:56 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\MSTUIBBW

2010-02-12 12:55 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\7a7704e

2010-02-12 02:07 . 2010-02-12 02:07 -------- d-----w- c:\program files\Common Files\xing shared

2010-02-12 02:06 . 2010-02-12 02:06 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2010-02-11 15:26 . 2009-12-04 18:22 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16 . 2010-02-06 16:16 -------- d-sh--w- c:\documents and settings\User\IECompatCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-06 00:25 . 2008-07-10 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-03-03 00:17 . 2009-05-14 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-03-03 00:04 . 2008-11-02 00:25 -------- d-----w- c:\program files\CCleaner

2010-02-27 23:27 . 2009-05-22 22:33 -------- d-----w- c:\program files\AVG

2010-02-26 20:55 . 2009-05-26 06:28 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-02-26 04:06 . 2009-07-17 10:29 -------- d-----w- c:\program files\DivX

2010-02-20 18:54 . 2009-05-26 02:04 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes

2010-02-20 18:53 . 2009-05-26 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-02-12 02:08 . 2005-06-12 18:55 -------- d-----w- c:\program files\Common Files\Real

2010-02-11 15:25 . 2007-09-24 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-01-21 04:01 . 2008-12-05 20:25 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-09 15:20 . 2007-12-24 20:58 -------- d-----w- c:\documents and settings\User\Application Data\Move Networks

2009-12-31 16:50 . 2004-08-04 08:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43 . 2004-08-04 08:00 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08 . 2004-08-04 08:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:27 . 2004-08-04 08:00 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43 . 2004-08-04 08:00 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-11-25 18:02 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk

backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 22:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

2008-06-19 17:51 50528 ----a-w- c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 17:25 202560 -c--a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]

2009-11-03 00:24 257440 ----a-r- c:\windows\system32\Macromed\Flash\FlashUtil10d.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2004-06-17 20:43 118784 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2004-06-17 20:48 155648 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 01:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2008-09-06 20:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 20:07 2260480 -csha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-05-17 23:43 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-02-12 02:07 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2009-06-03 12:46 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Viewpoint Manager Service"=2 (0x2)

"UStorage Server Service"=2 (0x2)

"TomTomHOMEService"=2 (0x2)

"sprtsvc_ddoctorv2"=2 (0x2)

"SNDSrvc"=2 (0x2)

"ScsiAccess"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"KodakCCS"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"IDriverT"=3 (0x3)

"hpqwmi"=3 (0x3)

"gusvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Documents and Settings\\User\\My Documents\\Programs\\Limewire\\LimeWire.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2/27/2010 6:28 PM 25608]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/27/2010 6:28 PM 161800]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/27/2010 6:30 PM 333192]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/27/2010 6:30 PM 360584]

R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2/27/2010 6:28 PM 285392]

R2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [2/27/2010 6:28 PM 2304192]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2/27/2010 6:28 PM 5832712]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [2/27/2010 6:28 PM 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [2/27/2010 6:28 PM 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [2/27/2010 6:28 PM 25736]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [6/3/2009 7:46 AM 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/26/2008 9:30 AM 24652]

.

Contents of the 'Scheduled Tasks' folder

2010-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-03-06 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-10 18:26]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/comcast.html

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-A00F101E0C - c:\docume~1\User\LOCALS~1\Temp\_A00F101E0C.exe

MSConfigStartUp-A00F28C60E - c:\docume~1\User\LOCALS~1\Temp\_A00F28C60E.exe

MSConfigStartUp-A00F72AF1 - c:\docume~1\User\LOCALS~1\Temp\_A00F72AF1.exe

MSConfigStartUp-A00FDD23B7 - c:\docume~1\User\LOCALS~1\Temp\_A00FDD23B7.exe

MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe

MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

MSConfigStartUp-SmileboxTray - c:\documents and settings\User\Application Data\Smilebox\SmileboxTray.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-06 01:01

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2704)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wdfmgr.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-03-06 01:21:21 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-06 06:21

Pre-Run: 13,699,641,344 bytes free

Post-Run: 14,097,940,480 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 9426177753A8967E830110336F40D4A7

Link to post
Share on other sites

OK, here is the ComboFix log:

ComboFix 10-03-05.01 - User 03/06/2010 0:08.1.1 - x86

Running from: c:\documents and settings\User\Desktop\Malware stuff\ComboFix.exe

AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\User\Application Data\02000000f21cc486593C.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593O.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593P.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593S.manifest

c:\program files\Mozilla Firefox\searchplugins\search.xml

c:\program files\outlook

c:\recycler\S-1-5-21-1390067357-1606980848-839522115-1003

c:\recycler\S-1-5-21-3416710187-3200794616-3878359226-1003

c:\windows\COUPON~1.OCX

c:\windows\CouponPrinter.ocx

c:\windows\system32\nsprs.dll

c:\windows\system32\ssprs.dll

c:\windows\system32\vb40032.dll

C:\xcrashdump.dat

c:\windows\system32\proquota.exe . . . is missing!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

((((((((((((((((((((((((( Files Created from 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))))

.

2010-03-04 15:58 . 2010-03-04 15:58 -------- d-----w- C:\found.000

2010-02-27 23:31 . 2010-02-27 23:31 -------- d-----w- C:\$AVG

2010-02-27 23:30 . 2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-02-27 23:30 . 2010-02-27 23:30 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30 . 2010-02-27 23:30 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:30 . 2010-02-27 23:30 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-02-27 23:29 . 2010-03-06 05:04 -------- d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29 . 2010-03-02 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-02-27 23:28 . 2010-02-27 23:28 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28 . 2010-02-27 23:28 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27 . 2010-02-27 23:27 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27 . 2010-02-27 23:27 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27 . 2010-02-27 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-02-20 18:53 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53 . 2010-02-26 19:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-20 18:53 . 2010-01-07 21:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-13 04:00 . 2010-02-13 04:00 -------- d-----w- c:\documents and settings\User\Application Data\Facebook

2010-02-12 22:25 . 2010-02-12 22:25 -------- d-----w- c:\documents and settings\User\Application Data\MSNInstaller

2010-02-12 12:56 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\MSTUIBBW

2010-02-12 12:55 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\7a7704e

2010-02-12 02:07 . 2010-02-12 02:07 -------- d-----w- c:\program files\Common Files\xing shared

2010-02-12 02:06 . 2010-02-12 02:06 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2010-02-11 15:26 . 2009-12-04 18:22 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16 . 2010-02-06 16:16 -------- d-sh--w- c:\documents and settings\User\IECompatCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-06 00:25 . 2008-07-10 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-03-03 00:17 . 2009-05-14 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-03-03 00:04 . 2008-11-02 00:25 -------- d-----w- c:\program files\CCleaner

2010-02-27 23:27 . 2009-05-22 22:33 -------- d-----w- c:\program files\AVG

2010-02-26 20:55 . 2009-05-26 06:28 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-02-26 04:06 . 2009-07-17 10:29 -------- d-----w- c:\program files\DivX

2010-02-20 18:54 . 2009-05-26 02:04 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes

2010-02-20 18:53 . 2009-05-26 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-02-12 02:08 . 2005-06-12 18:55 -------- d-----w- c:\program files\Common Files\Real

2010-02-11 15:25 . 2007-09-24 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-01-21 04:01 . 2008-12-05 20:25 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-09 15:20 . 2007-12-24 20:58 -------- d-----w- c:\documents and settings\User\Application Data\Move Networks

2009-12-31 16:50 . 2004-08-04 08:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43 . 2004-08-04 08:00 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08 . 2004-08-04 08:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:27 . 2004-08-04 08:00 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43 . 2004-08-04 08:00 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-11-25 18:02 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk

backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 22:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

2008-06-19 17:51 50528 ----a-w- c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 17:25 202560 -c--a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]

2009-11-03 00:24 257440 ----a-r- c:\windows\system32\Macromed\Flash\FlashUtil10d.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2004-06-17 20:43 118784 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2004-06-17 20:48 155648 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 01:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2008-09-06 20:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 20:07 2260480 -csha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-05-17 23:43 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-02-12 02:07 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2009-06-03 12:46 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Viewpoint Manager Service"=2 (0x2)

"UStorage Server Service"=2 (0x2)

"TomTomHOMEService"=2 (0x2)

"sprtsvc_ddoctorv2"=2 (0x2)

"SNDSrvc"=2 (0x2)

"ScsiAccess"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"KodakCCS"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"IDriverT"=3 (0x3)

"hpqwmi"=3 (0x3)

"gusvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Documents and Settings\\User\\My Documents\\Programs\\Limewire\\LimeWire.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2/27/2010 6:28 PM 25608]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/27/2010 6:28 PM 161800]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/27/2010 6:30 PM 333192]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/27/2010 6:30 PM 360584]

R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2/27/2010 6:28 PM 285392]

R2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [2/27/2010 6:28 PM 2304192]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2/27/2010 6:28 PM 5832712]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [2/27/2010 6:28 PM 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [2/27/2010 6:28 PM 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [2/27/2010 6:28 PM 25736]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [6/3/2009 7:46 AM 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/26/2008 9:30 AM 24652]

.

Contents of the 'Scheduled Tasks' folder

2010-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-03-06 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-10 18:26]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/comcast.html

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-A00F101E0C - c:\docume~1\User\LOCALS~1\Temp\_A00F101E0C.exe

MSConfigStartUp-A00F28C60E - c:\docume~1\User\LOCALS~1\Temp\_A00F28C60E.exe

MSConfigStartUp-A00F72AF1 - c:\docume~1\User\LOCALS~1\Temp\_A00F72AF1.exe

MSConfigStartUp-A00FDD23B7 - c:\docume~1\User\LOCALS~1\Temp\_A00FDD23B7.exe

MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe

MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

MSConfigStartUp-SmileboxTray - c:\documents and settings\User\Application Data\Smilebox\SmileboxTray.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-06 01:01

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2704)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wdfmgr.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-03-06 01:21:21 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-06 06:21

Pre-Run: 13,699,641,344 bytes free

Post-Run: 14,097,940,480 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 9426177753A8967E830110336F40D4A7

Link to post
Share on other sites

Hello ,

P2P WARNING

-------------------

Going over your logs I noticed that you have LimeWire installed.

[*] Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.

[*]They are a security risk which can make your computer susceptible to a sm

Link to post
Share on other sites

Hi.

Again, thanks for all your help.

I spoke with my daughter and she agreed that deleting LimeWire was a good idea. She said she hadn't used it in a while anyway so I just went ahead and uninstalled it. I updated Java and then ran Malwarebytes and allowed it to update before scanning. After all that was done I ran DDS again. Not sure if you wanted the attach.txt file so I attached it just in case. Here are the other logs:

Malwarebytes' Anti-Malware 1.44

Database version: 3829

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

3/6/2010 5:02:50 PM

mbam-log-2010-03-06 (17-02-50).txt

Scan type: Full Scan (C:\|)

Objects scanned: 209345

Time elapsed: 2 hour(s), 4 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_09-12-01.01) - NTFSx86

Run by User at 17:05:19.19 on Sat 03/06/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.222.45 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\AVG\AVG9\avgfws9.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG9\avgam.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Documents and Settings\User\Desktop\Malware stuff\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.comcast.net/comcast.html

uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=laptop

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

TB: {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: igfxcui - igfxsrvc.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-27 25096]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-27 52872]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-27 216200]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-27 29512]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 242696]

R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-6 308064]

R2 avgfws9;AVG Firewall;c:\program files\avg\avg9\avgfws9.exe [2010-3-6 2325816]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-3-6 5888008]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-27 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-27 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-27 26120]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-6-3 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-26 24652]

=============== Created Last 30 ================

2010-03-06 18:29:54 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-03-06 18:25:59 0 d-----w- c:\docume~1\user\applic~1\AVG9

2010-03-06 17:20:19 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-03-06 04:44:57 0 d-sha-r- C:\cmdcons

2010-03-06 04:14:58 98816 ----a-w- c:\windows\sed.exe

2010-03-06 04:14:58 77312 ----a-w- c:\windows\MBR.exe

2010-03-06 04:14:58 261632 ----a-w- c:\windows\PEV.exe

2010-03-06 04:14:58 161792 ----a-w- c:\windows\SWREG.exe

2010-03-04 18:45:44 0 ----a-w- c:\documents and settings\user\defogger_reenable

2010-03-04 15:58:50 0 d-----w- C:\found.000

2010-02-27 23:31:09 0 d-----w- C:\$AVG

2010-02-27 23:30:37 242696 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30:19 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:29:48 0 d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29:40 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar

2010-02-27 23:28:49 25096 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28:47 52872 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27:51 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27:51 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27:26 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

2010-02-20 18:53:57 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-20 18:53:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-13 04:00:50 0 d-----w- c:\docume~1\user\applic~1\Facebook

2010-02-12 22:25:04 0 d-----w- c:\docume~1\user\applic~1\MSNInstaller

2010-02-12 12:56:16 0 d-sh--w- c:\docume~1\alluse~1\applic~1\MSTUIBBW

2010-02-12 12:55:50 0 d-sh--w- c:\docume~1\alluse~1\applic~1\7a7704e

2010-02-12 02:07:54 0 d-----w- c:\program files\common files\xing shared

2010-02-11 15:26:39 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16:10 0 d-sh--w- c:\documents and settings\user\IECompatCache

==================== Find3M ====================

2010-03-06 18:29:07 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-12-31 16:50:03 353792 ------w- c:\windows\system32\dllcache\srv.sys

2009-12-22 05:21:02 1509888 ------w- c:\windows\system32\dllcache\shdocvw.dll

2009-12-21 13:19:18 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-16 18:43:27 343040 ------w- c:\windows\system32\dllcache\mspaint.exe

2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-14 07:08:23 33280 ------w- c:\windows\system32\dllcache\csrsrv.dll

2009-12-11 08:38:55 69120 ------w- c:\windows\system32\dllcache\iecompat.dll

2009-12-09 05:53:44 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

2009-12-08 19:27:51 2189184 ------w- c:\windows\system32\ntoskrnl.exe

2009-12-08 19:27:51 2189184 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-12-08 18:43:50 2066048 ------w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 18:43:50 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-12-08 09:23:28 474112 ------w- c:\windows\system32\dllcache\shlwapi.dll

============= FINISH: 17:06:57.30 ===============

Attach.zip

Link to post
Share on other sites

Hello , things are looking quite good. How is everything running now? Do you still have the original problems?

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    11. Push the esetBack.png button.
    12. Push esetFinish.png


      In your next reply, please include the following:
      • ESET online scan results

Link to post
Share on other sites

Hello.

I did a couple of Google searches and it seems the redirect issue has gone away, so hopefully that problem is solved. I noticed "My Security Wall" listed in the first DDS log, but not in the later one. I'm assuming this was the problem with the browser being redirected when clicking on Google search results. Was it ComboFix that removed it or something else we did? Just curious about what exactly removed it. Whatever it was thank you again for your assistance.

I ran ESET OnlineScan and it seems there were some more issues. Here are the results:

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined

C:\Documents and Settings\User\My Documents\My Music\Spaced Age Love Song.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined

C:\Documents and Settings\User\My Documents\Programs\Limewire\quiet in my town civil.mp3 WMA/TrojanDownloader.GetCodec.C trojan cleaned by deleting - quarantined

C:\Documents and Settings\User\My Documents\Programs\Limewire\sex on fire kings of leone.mp3 WMA/TrojanDownloader.GetCodec.C trojan cleaned by deleting - quarantined

C:\Documents and Settings\User\My Documents\Programs\Limewire\shimmers shawn mullins.mp3 WMA/TrojanDownloader.GetCodec.C trojan cleaned by deleting - quarantined

C:\Documents and Settings\User\My Documents\Programs\Limewire\thats not my name tin tins .mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined

C:\Program Files\BearShare\Installer\BSInstall5.2.5.1.exe multiple threats deleted - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185553.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185604.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185614.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185615.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185616.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185617.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185621.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185623.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185628.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185629.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185630.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-185633.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190506.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190508.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190510.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190511.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190512.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190513.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190514.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190515.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100226-190518.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000032.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000036.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000037.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000038.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000039.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000041.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000042.backup Win32/Qhost trojan cleaned by deleting - quarantined

C:\WINDOWS\system32\drivers\etc\hosts.20100227-000043.backup Win32/Qhost trojan cleaned by deleting - quarantined

Link to post
Share on other sites

Hello again,

No worries about the stuff ESET found, mostly leftovers, not active infections. :)

My Security Wall was most likely removed by Combofix (it doesn't keep record in the log of all registry entries that are removed).

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :)

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete DDS and GMER (this is a random named file)

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing :P.

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.