Need help with malware removal.

newguy · March 4, 2010

Hi,

My daughter was having problems with her laptop and asked me to take a look at it. I usually do OK with this sort of stuff following online guides and information but this one is proving to be trickier.

The original complaint was "My Security Wall" popping up and telling her she needed to purchase the program. I followed an online guide and thought I got rid of it but a few days later she told me her Google searches were being redirected. I'm not sure what is causing this but I suspect "My Security Wall" was not completely removed and/or she has other malware.

I followed the instructions in the "I'm infected - What do I do now?" post and ran Malwarebytes, her antivirus (AVG), DeFogger, and GMER. I may have made a mistake though. I ran these over several days and in between my daughter came over and copied some files that she needed. I decided that maybe I better start over from scratch and ran the programs again in preparation for posting here.

When I ran DeFogger the first time it did not ask for a restart so I restarted manually. When I decided to rerun everything I first ran DeFogger and re-enabled before I ran Malwarebytes again. Then I ran AVG again and DeFogger to disable (Still no restart request). I got through everything OK until I ran GMER and it crashed, (Microsoft window: ...has encountered a problem and needs to close.)

I would appreciate any help you could give me in solving this problem. I'm not sure if the following will help since GMER did not finish but I'm posting them just in case.

Thanks again in advance

Malwarebytes' Anti-Malware 1.44

Database version: 3817

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

3/4/2010 11:31:57 AM

mbam-log-2010-03-04 (11-31-57).txt

Scan type: Quick Scan

Objects scanned: 128894

Time elapsed: 13 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_09-12-01.01) - NTFSx86

Run by User at 13:53:45.27 on Thu 03/04/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.222.50 [GMT -5:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: My Security Wall *On-access scanning enabled* (Updated) {CA38A626-1DD4-4079-AD95-CCBE6C7309B4}

FW: My Security Wall *enabled* {F99BA31B-4625-4B89-871B-50A50C45ECF1}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AVG\AVG9\Identity Protection\agent\bin\avgidsmonitor.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\AVG\AVG9\avgfws9.exe

C:\Program Files\AVG\AVG9\avgam.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Documents and Settings\User\Desktop\Malware stuff\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.comcast.net/comcast.html

uSearch Bar = hxxp://www.comcast.net/toolbar2.0/search/

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

mSearchAssistant = hxxp://www.comcast.net/toolbar2.0/search/

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~2\COMCAS~1.DLL

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: Comcast Toolbar: {4e7bd74f-2b8d-469e-93be-be2df4d9ae29} - c:\progra~1\comcas~2\COMCAS~1.DLL

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

uPolicies-system: EnableProfileQuota = 1 (0x1)

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: &Search

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.4.2/jinstall-1_4_2_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: igfxcui - igfxsrvc.dll

AppInit_DLLs: c:\windows\system32\

IFEO: image file execution options - svchost.exe

Hosts: 74.125.45.100 4-open-davinci.com

Hosts: 74.125.45.100 securitysoftwarepayments.com

Hosts: 74.125.45.100 privatesecuredpayments.com

Hosts: 74.125.45.100 secure.privatesecuredpayments.com

Hosts: 74.125.45.100 getantivirusplusnow.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: browser.search.selectedEngine - search

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\user\application data\mozilla\firefox\profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\user\application data\facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\user\application data\move networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2010-2-27 25608]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-2-27 161800]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-2-27 333192]

R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-2-27 28424]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-2-27 360584]

R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-2-27 285392]

R2 avgfws9;AVG Firewall;c:\program files\avg\avg9\avgfws9.exe [2010-2-27 2304192]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\avg\avg9\identity protection\agent\bin\AVGIDSAgent.exe [2010-2-27 5832712]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSDriver.sys [2010-2-27 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSFilter.sys [2010-2-27 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\avg\avg9\identity protection\agent\driver\platform_xp\AVGIDSShim.sys [2010-2-27 25736]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-2-27 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-6-3 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-26 24652]

=============== Created Last 30 ================

2010-03-04 18:45:44 0 ----a-w- c:\documents and settings\user\defogger_reenable

2010-03-04 15:58:50 0 d-sh--w- C:\found.000

2010-02-27 23:31:09 0 d--h--w- C:\$AVG

2010-02-27 23:30:38 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-02-27 23:30:37 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30:19 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:29:48 0 d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29:40 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar

2010-02-27 23:28:49 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28:47 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27:51 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27:51 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27:26 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

2010-02-20 18:53:57 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-20 18:53:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-13 04:00:50 0 d-----w- c:\docume~1\user\applic~1\Facebook

2010-02-12 22:25:04 0 d-----w- c:\docume~1\user\applic~1\MSNInstaller

2010-02-12 12:56:16 0 d-sh--w- c:\docume~1\alluse~1\applic~1\MSTUIBBW

2010-02-12 12:55:50 0 d-sh--w- c:\docume~1\alluse~1\applic~1\7a7704e

2010-02-12 02:07:54 0 d-----w- c:\program files\common files\xing shared

2010-02-11 15:26:39 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16:10 0 d-sh--w- c:\documents and settings\user\IECompatCache

==================== Find3M ====================

2009-12-31 16:50:03 353792 ------w- c:\windows\system32\dllcache\srv.sys

2009-12-22 05:21:02 1509888 ------w- c:\windows\system32\dllcache\shdocvw.dll

2009-12-21 13:19:18 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2009-12-16 18:43:27 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-16 18:43:27 343040 ------w- c:\windows\system32\dllcache\mspaint.exe

2009-12-14 07:08:23 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-14 07:08:23 33280 ------w- c:\windows\system32\dllcache\csrsrv.dll

2009-12-11 08:38:55 69120 ------w- c:\windows\system32\dllcache\iecompat.dll

2009-12-09 05:53:44 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll

2009-12-08 19:27:51 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 19:27:51 2189184 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2009-12-08 19:26:15 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2009-12-08 18:43:51 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2009-12-08 18:43:50 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-12-08 18:43:50 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2009-12-08 09:23:28 474112 ------w- c:\windows\system32\dllcache\shlwapi.dll

============= FINISH: 13:55:18.79 ===============

Attach.zip

Elise · March 5, 2010

Hello, and welcome to Malwarebytes forum!

Before continuing, I would like to see a rootkit scan as well. Therefore, try to run GMER with the "devices" box unchecked.

Let me know if that allows you to finish the GMER run.

newguy · March 5, 2010

Hi Elise. Thanks for the reply.

I was able to run GMER with "Devices" unchecked. (Also unchecked "Sections", "IAT/EAT" and Show all".) I have attached the result to this post.

ark.zip

Elise · March 5, 2010

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

newguy · March 6, 2010

OK, here is the ComboFix log:

ComboFix 10-03-05.01 - User 03/06/2010 0:08.1.1 - x86

Running from: c:\documents and settings\User\Desktop\Malware stuff\ComboFix.exe

AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\User\Application Data\02000000f21cc486593C.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593O.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593P.manifest

c:\documents and settings\User\Application Data\02000000f21cc486593S.manifest

c:\program files\Mozilla Firefox\searchplugins\search.xml

c:\program files\outlook

c:\recycler\S-1-5-21-1390067357-1606980848-839522115-1003

c:\recycler\S-1-5-21-3416710187-3200794616-3878359226-1003

c:\windows\COUPON~1.OCX

c:\windows\CouponPrinter.ocx

c:\windows\system32\nsprs.dll

c:\windows\system32\ssprs.dll

c:\windows\system32\vb40032.dll

C:\xcrashdump.dat

c:\windows\system32\proquota.exe . . . is missing!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

((((((((((((((((((((((((( Files Created from 2010-02-06 to 2010-03-06 )))))))))))))))))))))))))))))))

.

2010-03-04 15:58 . 2010-03-04 15:58 -------- d-----w- C:\found.000

2010-02-27 23:31 . 2010-02-27 23:31 -------- d-----w- C:\$AVG

2010-02-27 23:30 . 2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-02-27 23:30 . 2010-02-27 23:30 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-02-27 23:30 . 2010-02-27 23:30 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-02-27 23:30 . 2010-02-27 23:30 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-02-27 23:29 . 2010-03-06 05:04 -------- d-----w- c:\windows\system32\drivers\Avg

2010-02-27 23:29 . 2010-03-02 23:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar

2010-02-27 23:28 . 2010-02-27 23:28 25608 ----a-w- c:\windows\system32\drivers\AVGIDSxx.sys

2010-02-27 23:28 . 2010-02-27 23:28 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys

2010-02-27 23:27 . 2010-02-27 23:27 50968 ----a-w- c:\windows\system32\avgfwdx.dll

2010-02-27 23:27 . 2010-02-27 23:27 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys

2010-02-27 23:27 . 2010-02-27 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-02-20 18:53 . 2010-01-07 21:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-20 18:53 . 2010-02-26 19:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-20 18:53 . 2010-01-07 21:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-13 04:00 . 2010-02-13 04:00 -------- d-----w- c:\documents and settings\User\Application Data\Facebook

2010-02-12 22:25 . 2010-02-12 22:25 -------- d-----w- c:\documents and settings\User\Application Data\MSNInstaller

2010-02-12 12:56 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\MSTUIBBW

2010-02-12 12:55 . 2010-02-12 12:56 -------- d-sh--w- c:\documents and settings\All Users\Application Data\7a7704e

2010-02-12 02:07 . 2010-02-12 02:07 -------- d-----w- c:\program files\Common Files\xing shared

2010-02-12 02:06 . 2010-02-12 02:06 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2010-02-11 15:26 . 2009-12-04 18:22 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-06 16:16 . 2010-02-06 16:16 -------- d-sh--w- c:\documents and settings\User\IECompatCache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-06 00:25 . 2008-07-10 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2010-03-03 00:17 . 2009-05-14 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-03-03 00:04 . 2008-11-02 00:25 -------- d-----w- c:\program files\CCleaner

2010-02-27 23:27 . 2009-05-22 22:33 -------- d-----w- c:\program files\AVG

2010-02-26 20:55 . 2009-05-26 06:28 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-02-26 04:06 . 2009-07-17 10:29 -------- d-----w- c:\program files\DivX

2010-02-20 18:54 . 2009-05-26 02:04 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes

2010-02-20 18:53 . 2009-05-26 02:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-02-12 02:08 . 2005-06-12 18:55 -------- d-----w- c:\program files\Common Files\Real

2010-02-11 15:25 . 2007-09-24 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-01-21 04:01 . 2008-12-05 20:25 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-09 15:20 . 2007-12-24 20:58 -------- d-----w- c:\documents and settings\User\Application Data\Move Networks

2009-12-31 16:50 . 2004-08-04 08:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-21 19:14 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-16 18:43 . 2004-08-04 08:00 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:08 . 2004-08-04 08:00 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-08 19:27 . 2004-08-04 08:00 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-08 18:43 . 2004-08-04 08:00 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2009-11-25 18:02 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-02-27 23:30 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ WinCinema Manager.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ WinCinema Manager.lnk

backup=c:\windows\pss\ WinCinema Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 22:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

2008-06-19 17:51 50528 ----a-w- c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 17:25 202560 -c--a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate]

2009-11-03 00:24 257440 ----a-r- c:\windows\system32\Macromed\Flash\FlashUtil10d.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2004-06-17 20:43 118784 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2004-06-17 20:48 155648 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 01:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2008-09-06 20:09 413696 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 20:07 2260480 -csha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-05-17 23:43 148888 -c--a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2010-02-12 02:07 198160 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2009-06-03 12:46 251240 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Viewpoint Manager Service"=2 (0x2)

"UStorage Server Service"=2 (0x2)

"TomTomHOMEService"=2 (0x2)

"sprtsvc_ddoctorv2"=2 (0x2)

"SNDSrvc"=2 (0x2)

"ScsiAccess"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"KodakCCS"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"IDriverT"=3 (0x3)

"hpqwmi"=3 (0x3)

"gusvc"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Documents and Settings\\User\\My Documents\\Programs\\Limewire\\LimeWire.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgam.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgdiagex.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

R0 AVGIDSErHrxpx;AVG9IDSErHr;c:\windows\system32\drivers\AVGIDSxx.sys [2/27/2010 6:28 PM 25608]

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2/27/2010 6:28 PM 161800]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/27/2010 6:30 PM 333192]

R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/27/2010 6:30 PM 360584]

R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2/27/2010 6:28 PM 285392]

R2 avgfws9;AVG Firewall;c:\program files\AVG\AVG9\avgfws9.exe [2/27/2010 6:28 PM 2304192]

R2 AVGIDSAgent;AVG9IDSAgent;c:\program files\AVG\AVG9\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2/27/2010 6:28 PM 5832712]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

R3 AVGIDSDriverxpx;AVG9IDSDriver;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSDriver.sys [2/27/2010 6:28 PM 122376]

R3 AVGIDSFilterxpx;AVG9IDSFilter;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSFilter.sys [2/27/2010 6:28 PM 30216]

R3 AVGIDSShimxpx;AVG9IDSShim;c:\program files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys [2/27/2010 6:28 PM 25736]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2/27/2010 6:27 PM 30104]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [6/3/2009 7:46 AM 92008]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/26/2008 9:30 AM 24652]

.

Contents of the 'Scheduled Tasks' folder

2010-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2010-03-06 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-10 18:26]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.comcast.net/comcast.html

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tbff50ie7&query=

FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=TB50TRFF;homepage=no;search=yesab&query=

FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\01r7o3qn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\User\Application Data\Facebook\npfbplugin_1_0_1.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071503000010.dll

FF - plugin: c:\documents and settings\User\Application Data\Move Networks\plugins\npqmp071701000002.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-A00F101E0C - c:\docume~1\User\LOCALS~1\Temp\_A00F101E0C.exe

MSConfigStartUp-A00F28C60E - c:\docume~1\User\LOCALS~1\Temp\_A00F28C60E.exe

MSConfigStartUp-A00F72AF1 - c:\docume~1\User\LOCALS~1\Temp\_A00F72AF1.exe

MSConfigStartUp-A00FDD23B7 - c:\docume~1\User\LOCALS~1\Temp\_A00FDD23B7.exe

MSConfigStartUp-AVG8_TRAY - c:\progra~1\AVG\AVG8\avgtray.exe

MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

MSConfigStartUp-SmileboxTray - c:\documents and settings\User\Application Data\Smilebox\SmileboxTray.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-06 01:01

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2704)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wdfmgr.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-03-06 01:21:21 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-06 06:21

Pre-Run: 13,699,641,344 bytes free

Post-Run: 14,097,940,480 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 9426177753A8967E830110336F40D4A7

newguy · March 6, 2010