a.exe

[Tycho]

Hello,

I have a problem with a process named a.exe.

It starts when I connect to ADSL (I see it at task manager) only for a few seconds and drop to my system several malware.

Malwarebytes or Avira scans detect and clean the malware and my system appears clean, but when I connect to ADSL, a.exe appears again and repeats its work.

With no internet connection my PC works fine and I can't find a.exe anywhere in my system. (Windows XP)

I've tried at avira forums and ESET & PANDA online scans with no success.

Several days ago I used rmmabez to clean a Mabezat.B.79 worm (a gently present fron a.exe) and all the .exe files it created.

a.exe doesn't appear in safe mode.

Hope you can help me. I've followed instructions of your pinned post.

Sorry I have now only an Avira log file (not Malwarebytes log), from the last time it clean my system. I attach it with the DDS/GMER log fles.

I can do a Malwarebyten scan and post it later (I'm at work now)

Thank you very much,

Jordi

DDS (Ver_10-03-17.01) - NTFSx86

Run by Usuari at 6:42:39,17 on 30/04/2010

Internet Explorer: 6.0.2900.5512

Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.511.173 [GMT 2:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Archivos de programa\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Archivos de programa\Telefonica\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\Archivos de programa\Avira\AntiVir Desktop\avgnt.exe

C:\Documents and Settings\Usuari\Escritorio\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.softcatala.org/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = local.,

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\archivos de programa\archivos comunes\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\archiv~1\spybot~1\SDHelper.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\archivos de programa\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\archivos de programa\java\jre1.5.0_06\bin\ssv.dll

BHO: Auxiliar d'inici de sessi

Attach.zip

Avira_Logfile.txt

[Tycho]

Still with problems.

I add malwarebytes' log, but it detects nothing.

is there some idea?

thanks,

Jordi

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Versi

[Maniac]

Hello Tycho! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install any software or hardware, while work on.
  

Step 1:

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Step 2:

Please, uninstall the following applications:

1. Adobe Reader 9.3
   

You can read, how to this in:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 3:

I also see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

• 
  
• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  

Step 4:

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 5:

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

1. JavaRa log
   
2. MalwareBytes' Anti-Malware log
   

[Tycho]

Hello Borislav and many thanks for your help,

I've been two days out, I'm gonna follow your instructions this afternoon, just one question:

I need to download tools and update MB in safe mode to avoid a.exe running.

I'll run tools and uninstall things in normal mode.

Please don't reply if you think it's ok.

Thanks again,

Jordi

[Tycho]

Hello Borislav,

All done, a.exe is still running.

I add MB's log after making a try and disconnecting immediately when a.exe appears

at task manager.

Thany you very much,

Jordi

The logs:

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Tue May 04 22:25:00 2010

Found and removed: Software\JavaSoft\Java2D\1.5.0_02

Found and removed: Software\JavaSoft\Java2D\1.5.0_04

Found and removed: Software\JavaSoft\Java2D\1.5.0_06

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

------------------------------------

Finished reporting.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

04/05/2010 22:36:33

mbam-log-2010-05-04 (22-36-33).txt

Scan type: Quick scan

Objects scanned: 124311

Time elapsed: 5 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

MB log afer trying to connect:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

04/05/2010 23:05:06

mbam-log-2010-05-04 (23-05-06).txt

Scan type: Quick scan

Objects scanned: 124442

Time elapsed: 5 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

c:\WINDOWS\system32\Iasex.dll (Backdoor.Bot) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ias (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\Iasex.dll (Backdoor.Bot) -> Delete on reboot.

[Maniac]

Your database version is old, so please update it:

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

[Tycho]

Hello Borislav,

MB updated, quick scan, nothing detected.

Sorry, I wish I could help a little more...

Thanks,

Jordi

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4070

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

05/05/2010 23:54:17

mbam-log-2010-05-05 (23-54-17).txt

Scan type: Quick scan

Objects scanned: 125428

Time elapsed: 5 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Maniac]

Don't be sorry!

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[Tycho]

Hello,

Combo-fix log:

ComboFix 10-05-05.0D - Usuari 06/05/2010 20:07:51.11.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.511.276 [GMT 2:00]

Running from: c:\documents and settings\Usuari\Escritorio\Combo-Fix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_IAS

((((((((((((((((((((((((( Files Created from 2010-04-06 to 2010-05-06 )))))))))))))))))))))))))))))))

.

2010-05-04 18:11 . 2010-05-04 18:11 -------- d-----w- c:\documents and settings\Usuari\Mis documentos

2010-04-24 11:16 . 2010-04-24 11:16 -------- d-----w- c:\archivos de programa\ESET

2010-04-24 10:53 . 2010-04-24 10:53 54016 ----a-w- c:\windows\system32\drivers\pjci.sys

2010-04-24 07:32 . 2009-06-30 07:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

2010-04-24 07:32 . 2010-04-24 07:32 -------- d-----w- c:\archivos de programa\Panda Security

2010-04-24 07:25 . 2010-04-24 07:25 -------- d-----w- c:\documents and settings\Administrador\Datos de programa\Lavasoft

2010-04-22 21:16 . 2010-04-22 21:16 -------- d-----r- c:\documents and settings\LocalService\Mis documentos

2010-04-22 21:15 . 2010-04-22 21:15 -------- d--h--r- c:\documents and settings\LocalService\Reciente

2010-04-21 18:43 . 2009-11-21 15:58 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2010-04-18 22:20 . 2010-04-18 22:20 -------- d-----w- c:\documents and settings\Administrador\Datos de programa\Malwarebytes

2010-04-18 21:49 . 2010-04-18 21:49 -------- d-----w- c:\archivos de programa\Trend Micro

2010-04-17 11:11 . 2010-04-17 11:10 10532055 ----a-w- C:\rmmabez.exe

2010-04-06 22:38 . 2010-04-06 22:38 -------- d-----w- c:\archivos de programa\Eidos Interactive

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-06 16:06 . 2010-01-10 15:05 -------- d-----w- c:\documents and settings\Usuari\Datos de programa\Spotify

2010-05-04 18:12 . 2005-10-09 10:20 -------- d-----w- c:\archivos de programa\Archivos comunes\Adobe

2010-05-04 17:21 . 2009-09-18 19:14 -------- d-----w- c:\archivos de programa\Malwarebytes' Anti-Malware

2010-05-04 17:21 . 2009-12-20 20:22 6153352 ----a-w- c:\documents and settings\All Users\Datos de programa\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-05-01 13:50 . 2008-10-06 19:45 -------- d-----w- c:\documents and settings\All Users\Datos de programa\Spybot - Search & Destroy

2010-04-29 13:39 . 2009-09-18 19:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 13:39 . 2009-09-18 19:14 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-24 11:11 . 2005-08-11 14:37 -------- d-----w- c:\documents and settings\All Users\Datos de programa\Autodesk

2010-04-24 11:11 . 2005-08-11 14:37 -------- d-----w- c:\archivos de programa\Archivos comunes\Autodesk Shared

2010-04-24 07:06 . 2006-12-25 10:44 -------- d-----w- c:\archivos de programa\EA GAMES

2010-04-19 18:14 . 2009-04-21 17:05 -------- d-----w- c:\documents and settings\All Users\Datos de programa\NOS

2010-04-17 15:04 . 2005-11-21 10:22 -------- d-----w- c:\archivos de programa\Binedit

2010-04-17 08:05 . 2006-02-04 12:42 299520 ----a-w- c:\windows\uninst.exe

2010-04-17 06:57 . 2009-12-21 18:08 1924744 ----a-w- c:\documents and settings\Usuari\Datos de programa\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2010-04-16 21:21 . 2002-01-01 10:18 253139 ----a-w- c:\windows\PDFCreator_Toolbar_Uninstaller_3671.exe

2010-04-16 14:13 . 2008-11-17 19:56 90112 ----a-w- c:\windows\unvise32.exe

2010-04-16 14:13 . 2005-08-17 10:42 306688 ----a-w- c:\windows\IsUninst.exe

2010-04-16 14:13 . 2005-08-11 15:11 327168 ----a-w- c:\windows\IsUn040a.exe

2010-04-16 14:13 . 2009-02-04 13:56 75112 ----a-w- c:\documents and settings\All Users\Datos de programa\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\DifXInstall32.exe

2010-04-16 14:13 . 2009-11-12 16:07 79144 ----a-w- c:\documents and settings\All Users\Datos de programa\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2010-04-10 15:58 . 2009-12-25 12:47 -------- d-----w- c:\archivos de programa\Bonjour

2010-04-05 15:38 . 2009-03-15 16:22 -------- d-----w- c:\archivos de programa\Celtx

2010-03-30 10:39 . 2008-12-06 13:01 -------- d-----w- c:\archivos de programa\TM22

2010-03-28 07:48 . 2004-08-20 12:00 85692 ----a-w- c:\windows\system32\perfc00A.dat

2010-03-28 07:48 . 2004-08-20 12:00 495180 ----a-w- c:\windows\system32\perfh00A.dat

2010-03-23 23:22 . 2005-09-06 06:51 -------- d-----w- c:\documents and settings\Usuari\Datos de programa\XnView

2010-03-21 22:31 . 2008-11-12 18:25 -------- d-----w- c:\archivos de programa\Google

2010-03-21 11:16 . 2008-11-30 22:16 -------- d-----w- c:\archivos de programa\ZModeler

2010-03-20 22:27 . 2009-10-28 19:30 -------- d-----w- c:\archivos de programa\ZModeler2

2010-02-13 07:53 . 2009-12-21 18:03 1 ----a-w- c:\documents and settings\Usuari\Datos de programa\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2008-11-17 19:56 . 2008-11-17 19:56 12997 ----a-w- c:\archivos de programa\uninstal.log

2006-03-17 09:13 . 2006-03-17 09:13 0 ----a-w- c:\archivos de programa\BinEdit.bcf

2004-04-02 14:14 . 2004-04-02 14:14 49 ----a-w- c:\archivos de programa\setup.lid

2004-04-02 14:14 . 2004-04-02 14:14 353 ----a-w- c:\archivos de programa\layout.bin

2004-04-02 14:14 . 2004-04-02 14:14 14087237 ----a-w- c:\archivos de programa\data1.cab

2004-04-02 14:14 . 2004-04-02 14:14 78 ----a-w- c:\archivos de programa\SETUP.INI

2004-04-02 14:14 . 2004-04-02 14:14 50487 ----a-w- c:\archivos de programa\_user1.cab

2004-04-02 14:14 . 2004-04-02 14:14 203985 ----a-w- c:\archivos de programa\_sys1.cab

2004-04-02 14:14 . 2004-04-02 14:14 102 ----a-w- c:\archivos de programa\DATA.TAG

2004-03-31 16:52 . 2004-03-31 16:52 57327 ------w- c:\archivos de programa\setup.ins

2004-03-31 14:16 . 2004-03-31 14:16 164984 ----a-w- c:\archivos de programa\setup.bmp

2003-11-10 15:26 . 2003-11-10 15:27 376884 ----a-w- c:\archivos de programa\image001.bmp

1999-04-23 09:57 . 1999-04-23 09:57 99840 ----a-w- c:\archivos de programa\Archivos comunes\IRAABOUT.DLL

1998-12-09 02:53 . 1998-12-09 02:53 70144 ----a-w- c:\archivos de programa\Archivos comunes\IRAMDMTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 48640 ----a-w- c:\archivos de programa\Archivos comunes\IRALPTTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 31744 ----a-w- c:\archivos de programa\Archivos comunes\IRAWEBTR.DLL

1998-12-09 02:53 . 1998-12-09 02:53 186368 ----a-w- c:\archivos de programa\Archivos comunes\IRAREG.DLL

1998-12-09 02:53 . 1998-12-09 02:53 17920 ----a-w- c:\archivos de programa\Archivos comunes\IRASRIAL.DLL

1997-12-17 16:47 . 1997-12-17 16:47 290586 ----a-w- c:\archivos de programa\_INST32I.EX_

1997-12-17 16:30 . 1997-12-17 16:30 8192 ----a-w- c:\archivos de programa\_ISDEL.EXE

1997-12-17 16:29 . 1997-12-17 16:29 11264 ----a-w- c:\archivos de programa\_SETUP.DLL

1997-05-30 09:31 . 1997-05-30 09:31 4557 ----a-w- c:\archivos de programa\lang.dat

1997-05-06 12:15 . 1997-05-06 12:15 417 ----a-w- c:\archivos de programa\os.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nwiz"="nwiz.exe" [2008-05-03 1630208]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-12 15:33 141600 ----a-w- c:\archivos de programa\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2008-05-03 04:46 13529088 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2008-05-03 04:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"iPodService"=3 (0x3)

"gupdate1c9ead6e2336e9e"=2 (0x2)

"getPlus® Helper"=3 (0x3)

"Creative Service for CDROM Access"=2 (0x2)

"C-DillaCdaC11BA"=2 (0x2)

"IDriverT"=3 (0x3)

"Macromedia Licensing Service"=3 (0x3)

"SeaPort"=2 (0x2)

"idsvc"=3 (0x3)

"iPod Service"=3 (0x3)

"Bonjour Service"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

"hpdj"=2 (0x2)

"SupportSoft RemoteAssist"=3 (0x3)

"ose"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Archivos de programa\\Caplio Software\\RGateLXP.exe"=

"c:\\Archivos de programa\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=

"c:\\Archivos de programa\\Terminal Reality\\Fly! II\\fly2.exe"=

"c:\\Archivos de programa\\iTunes\\iTunes.exe"=

"c:\\Archivos de programa\\Microsoft Office\\Office\\3082\\WFXMSRVR.EXE"=

"c:\\Archivos de programa\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Archivos de programa\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Archivos de programa\\Telefonica\\AsistCfg80\\awcbrwsr.exe"=

"c:\\Archivos de programa\\eMule\\emule.exe"=

"c:\\Archivos de programa\\Spotify\\spotify.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [24/04/2010 09:32 28552]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\archivos de programa\Avira\AntiVir Desktop\sched.exe [21/05/2009 20:39 108289]

R2 PCIE;PCI-Express Bus Driver;c:\windows\system32\drivers\pcie.sys [20/08/2004 14:00 9728]

R2 sprtsvc_Telefonica;SupportSoft Sprocket Service (Telefonica);c:\archivos de programa\Telefonica\bin\sprtsvc.exe [08/03/2007 20:22 202280]

S3 sndcast;sndcast;\??\c:\windows\system32\sndcast.sys --> c:\windows\system32\sndcast.sys [?]

S4 gupdate1c9ead6e2336e9e;Google Update Service (gupdate1c9ead6e2336e9e);"c:\archivos de programa\Google\Update\GoogleUpdate.exe" /svc --> c:\archivos de programa\Google\Update\GoogleUpdate.exe [?]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.softcatala.org/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = local.,

DPF: {9F787D15-B2FE-4CB8-BB44-E3CBAA920D6E} - hxxp://www.tornadoviz.com/download/web/npxviz.cab

FF - ProfilePath - c:\documents and settings\Usuari\Datos de programa\Mozilla\Firefox\Profiles\hf4db7sc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.softcatala.org/

FF - plugin: c:\archivos de programa\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\archivos de programa\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\archivos de programa\Mozilla Firefox\plugins\npigl.dll

FF - plugin: c:\archivos de programa\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\archivos de programa\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nppl3260.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprjplug.dll

FF - plugin: c:\program files\Real\RealPlayer\Netscape6\nprpjplug.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\archivos de programa\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\archivos de programa\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\archivos de programa\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\archivos de programa\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

.

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Adobe ARM - c:\archivos de programa\Archivos comunes\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Reader Speed Launcher - c:\archivos de programa\Adobe\Reader 9.0\Reader\Reader_sl.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-06 20:16

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-05-06 20:22:04 - machine was rebooted

ComboFix-quarantined-files.txt 2010-05-06 18:22

ComboFix2.txt 2010-04-22 19:13

Pre-Run: 27.479.244.800 bytes libres

Post-Run: 27.439.726.592 bytes libres

- - End Of File - - EA8BCC3019271631DCE4713C94EE0018

tanks,

Jordi

[Maniac]

Hey Jordi,

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Now click on Advanced Settings and select the following:
  

• • Remove found threats
    
  • Scan archives
    
  • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[Tycho]

Hello Borislav,

can I do all this in safe mode?

[Maniac]

It's good to be in Normal mode, if there is any problem, please use Safe Mode with Networking.

[Tycho]

Hello Borislav,

Done it in safe mode. Nothing found.

I see the log includes the scan I did on apr-24: I post log.txt as it is now.

Thank you,

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=bb38735a5aae564ab5b4d838123e2fdb

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2010-04-24 03:46:07

# local_time=2010-04-24 05:46:07 (+0100, Hora de verano romance)

# country="Spain"

# lang=3082

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 480567 480567 0 0

# compatibility_mode=1797 16775166 100 100 232348 48548802 225305 0

# compatibility_mode=8192 67108863 100 0 145 145 0 0

# scanned=150049

# found=5

# cleaned=5

# scan_time=16007

C:\Archivos de programa\MiniG\MiniRacer\MiniRacer.exe probablemente desconocido NewHeur_PE virus (eliminado - puesto en Cuarentena) 00000000000000000000000000000000 C

C:\Archivos de programa\MiniG\MiniRacer\miniracer.zip probablemente desconocido NewHeur_PE virus (eliminado - puesto en Cuarentena) 00000000000000000000000000000000 C

C:\Documents and Settings\LocalService\Configuraci

[Maniac]

How are things now?

[Tycho]

It has stopped!!

I've connected and a.exe doesn't run!

Avira has made an update and windows has downloaded updates (I have not installed it yet), and all seems to be normal.

Sorry, I don't understand. It seems combo-fix and eset didn't found nothing.

What do I've to do now?

[Maniac]

In your last scan, EOS not found anything, but in previous did. Both tools found and removed anything.

Last steps:

Step 1:

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2:

Please manually delete ResetTeaTimer, DDS and JavaRa.

Step 3:

Please download and install the latest version of Adobe Reader from:

http://www.adobe.com/

About Java:

http://java.com/en/

Step 4:

Some malware preventions:

http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html

Safe surfing!

[Tycho]

Ok, things are returning to normality.

I'll read quietly mikiemoes blogspot and have a sight often at this forum.

Well done, Borislav. Please, take a beer at your honour, you deserve it!

Много благодаря!

Jordi

[Maniac]

I'm underage and I can't drink alcohol, but I'm addicted to Coca-Cola, so I'll drink for yours and my health.

You're welcome, Jordi!