Multiple Infections, Assistance Please

diburning · April 30, 2010

Hello, I am not completely computer illiterate, but on the most part, I probably am.

Last night, I got a popup on my system tray saying that I was infected, blah blah blah. Then, it locked all of my applications saying that it was infected, would not let me open the taskmanager, would not let me access the internet saying that chrome.exe may be infected (my browser).

I forcefully shut the computer off, then turned it back on in safe mode. I did a scan with Spybot S&D and it found Fraud.sysguard. It removed it, then I restarted in normal mode, and the popup came back. So, I shut the computer down forcefully again (by holding down the power button).

I installed Malwarebytes and did a scan while in safe mode. (I cannot run anything in Normal mode because of the rogue antivirus software) I will restart and do another scan, but I expect to have more problems (as in the viruses coming back). Let me know if I need to take further steps to fix my computer.

Here is the log:

-----

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4053

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 6.0.2900.5512

4/30/2010 2:41:43 PM

mbam-log-2010-04-30 (14-41-43).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 271746

Time elapsed: 1 hour(s), 31 minute(s), 1 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 11

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\VSAdd-in (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Owner\Local Settings\Temp\htmR.exe (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\0TUVG56Z\eHd61162acV03003f36002Re8b21f98102T9dcb3edcQ000002fd901801F0020000aJ0f00060

1l0409Kd4e8e0b63180[1] (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\L80MEF2X\eH295db4c1V03f01530002R00000000102T62452262Q000002fa901801F0020000aJ0f00060

1l040930dP000301090[1] (Rootkit.MBR) -> Quarantined and deleted successfully.

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\T1RO3500\eH295db4c1V03f01530002R0143fdee102T624522cbQ000002fa901801F0020000aJ0f00060

1l04093180[1] (Rootkit.MBR) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\System\q_btqtoi32.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Mozilla Firefox\o.dat (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP65\A0002440.exe (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\TS.EXE (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\TDSScbqp.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

diburning · April 30, 2010

After a restart (back into safe mode) and a second scan, here is the log

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4053

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 6.0.2900.5512

4/30/2010 4:03:46 PM

mbam-log-2010-04-30 (16-03-46).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 271775

Time elapsed: 49 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP65\A0003559.dll (Trojan.Agent) -> Quarantined and deleted successfully.

diburning · April 30, 2010

Restarted in normal mode, popup still appears, the infection is most likely still on my computer. Help please.

Thank You.

Maniac · May 1, 2010

Hello diburning! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install any software or hardware, while work on.

Step 1:

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Step 2:

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
[*]Save both reports to your desktop. Post them back to your topic.

Step 3:

Please download the following scanning tool. GMER

Open the zip file and copy the file
gmer.exe
to your Desktop.
Double click on
gmer.exe
and run it.
It may take a minute to load and become available.
Do not make any changes. Click on the
SCAN
button and DO NOT use the computer while it's scanning.
Once the scan is done click on the
SAVE
button and browse to your Desktop and save the file as
GMER.LOG
Zip up the
GMER.LOG
file and save it as
gmerlog.zip
and attach it to your reply post.
DO NOT
directly post this log into a reply. You
MUST
attach it as a
.ZIP
file.
Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP

Compress and uncompress files (zip files) in Vista

In your next reply, please include these log(s) in this sequence:

MalwareBytes' Anti-Malware log
DDS log with Attach.txt
GMER log

diburning · May 2, 2010

Hi, responding to let you know that I am still here. Updated Malwarebytes, scanning now.

My computer can only run on safe mode at this time because the Sysclean rogue antivirus program regenerates itself and does not allow me to run any programs while in normal mode. Since I am running on safe mode with networking, I will not be able to upload the zip file.

However, I can save the log into a zip file, put it onto a flash drive, and upload it from a different computer, although I would not do it unless you tell me that it is ok as I may be spreading the infection with the flash drive.

diburning · May 2, 2010

Sorry, I meant to say Sysguard, not sysclean. It blocks the launching of any programs and alerts me saying that the program is infected and needs to close. It will not even allow me to launch the taskmanager.

diburning · May 2, 2010

MBAM Log

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4058
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 6.0.2900.5512
5/2/2010 12:14:05 AM
mbam-log-2010-05-02 (00-14-05).txt
Scan type: Quick scan
Objects scanned: 142642
Time elapsed: 8 minute(s), 35 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

DDS Log

DDS (Ver_10-03-17.01) - NTFSx86 NETWORK
Run by Owner at 0:14:55.84 on Sun 05/02/2010
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.197 [GMT -4:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\TurboIRC 7\t7.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = about:blank
uSearch Page = hxxp://srch-us8.hpwis.com/
uDefault_Page_URL = hxxp://us8.hpwis.com/
uDefault_Search_URL = hxxp://srch-us8.hpwis.com/
uSearch Bar = hxxp://srch-us8.hpwis.com/
mSearch Bar = hxxp://srch-us8.hpwis.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hewlett-packard\smart web
printing\hpswp_printenhancer.dll
BHO: HP Print Clips: {053f9267-dc04-4294-a72c-58f732d338c0} - c:\program files\hewlett-packard\smart web
printing\hpswp_framework.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common
files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6
\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
uRun: [Aim6]
uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HP Software Update] c:\program files\hewlett-packard\hp software update\HPWuSchd2.exe
mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [iMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [lxdxmon.exe] "c:\program files\lexmark 3600-4600 series\lxdxmon.exe"
mRun: [lxdxamon] "c:\program files\lexmark 3600-4600 series\lxdxamon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - c:\program files\hewlett-packard\smart
web printing\hpswp_extensions.dll
IE: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - c:\program files\hewlett-packard\smart
web printing\hpswp_extensions.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11
\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} -
hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230089275259
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: igfxcui - igfxdev.dll
Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 93.174.93.98 12chan.crabdance.com
Hosts: 93.174.93.98 img.12chan.crabdance.com
Hosts: 93.174.93.98 img.12chan.org
Hosts: 93.174.93.98 12chan.org
Note: multiple HOSTS entries found. Please refer to Attach.txt
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\t15ywiph.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - prefs.js: keyword.enabled - false
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-
0015-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref
("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name",
"chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-
3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
S0 ltfbyo;ltfbyo;c:\windows\system32\drivers\htjehtx.sys --> c:\windows\system32\drivers\htjehtx.sys [?]
S2 0040931234940054mcinstcleanup;McAfee Application Installer Cleanup (0040931234940054);c:\docume~1\owner\locals~1
\temp\004093~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\owner\locals~1
\temp\004093~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2009-8-24
98984]
S2 mrtRate;mrtRate; [x]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2008-6-1 34064]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-6-15
24652]
S2 xschuzjed;Windows Installer;c:\windows\system32\svchost.exe -k netsvcs [2003-6-3 14336]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2009-9-12 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [2009-9-12 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [2009-9-12 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [2009-9-12 121856]
=============== Created Last 30 ================
2010-05-01 02:42:21 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-30 20:06:50 0 d-----w- c:\docume~1\owner\applic~1\Malwarebytes
2010-04-30 07:55:33 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 07:55:32 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-04-30 07:55:31 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-30 07:55:31 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-30 07:42:02 0 d-----w- c:\program files\common files\Wise Installation Wizard
2010-04-30 07:32:07 98816 ----a-w- c:\windows\sed.exe
2010-04-30 07:32:07 77312 ----a-w- c:\windows\MBR.exe
2010-04-30 07:32:07 256512 ----a-w- c:\windows\PEV.exe
2010-04-30 07:32:07 161792 ----a-w- c:\windows\SWREG.exe
2010-04-19 04:27:47 0 d-----w- C:\.jagex_cache_32
2010-04-19 00:35:25 0 d-----w- c:\program files\Unlocker
==================== Find3M ====================
2010-04-30 04:32:22 75 ----a-w- c:\documents and settings\owner\jagex_runescape_preferences2.dat
2010-04-30 04:32:16 41 ----a-w- c:\documents and settings\owner\jagex_runescape_preferences.dat
2010-04-30 04:31:30 41 ----a-w- c:\documents and settings\owner\jagex__preferences3.dat
2010-02-19 23:47:50 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2003-09-09 05:30:52 0 --sha-w- c:\windows\sminst\HPCD.SYS
============= FINISH: 0:15:59.06 ===============

Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/23/2008 10:57:53 PM
System Uptime: 4/30/2010 4:07:16 PM (32 hours ago)
Motherboard: ASUSTeK Computer INC. | | 'P4SD-LA'
Processor: Intel® Pentium® 4 CPU 2.60GHz | CPU
1 | 2600/200mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 105 GiB total, 10.605 GiB free.
D: is FIXED (FAT32) - 6 GiB total, 2.608 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP1: 2/22/2010 2:40:51 PM - System Checkpoint
RP2: 2/22/2010 3:41:38 PM - Installed Windows XP KB958644.
RP3: 2/23/2010 3:44:31 PM - System Checkpoint
RP4: 2/24/2010 4:35:36 PM - System Checkpoint
RP5: 2/25/2010 5:46:36 PM - System Checkpoint
RP6: 2/26/2010 9:01:00 PM - System Checkpoint
RP7: 2/28/2010 12:01:41 AM - System Checkpoint
RP8: 3/1/2010 1:56:32 AM - System Checkpoint
RP9: 3/2/2010 2:56:31 AM - System Checkpoint
RP10: 3/3/2010 3:20:31 AM - System Checkpoint
RP11: 3/4/2010 5:20:32 AM - System Checkpoint
RP12: 3/5/2010 5:44:31 AM - System Checkpoint
RP13: 3/6/2010 7:08:34 AM - System Checkpoint
RP14: 3/7/2010 7:56:32 AM - System Checkpoint
RP15: 3/8/2010 12:28:55 PM - System Checkpoint
RP16: 3/9/2010 5:29:40 PM - System Checkpoint
RP17: 3/10/2010 6:56:32 PM - System Checkpoint
RP18: 3/12/2010 12:53:31 AM - System Checkpoint
RP19: 3/13/2010 1:44:40 AM - System Checkpoint
RP20: 3/14/2010 2:44:33 AM - System Checkpoint
RP21: 3/15/2010 5:42:44 AM - System Checkpoint
RP22: 3/16/2010 6:19:06 AM - System Checkpoint
RP23: 3/16/2010 8:52:52 PM - Installed Windows XP -- Software
Updates KB952011.
RP24: 3/17/2010 10:26:19 PM - System Checkpoint
RP25: 3/18/2010 10:46:58 PM - System Checkpoint
RP26: 3/20/2010 12:37:54 AM - System Checkpoint
RP27: 3/21/2010 6:27:52 AM - System Checkpoint
RP28: 3/22/2010 6:58:51 AM - System Checkpoint
RP29: 3/23/2010 7:46:51 AM - System Checkpoint
RP30: 3/24/2010 7:58:51 AM - System Checkpoint
RP31: 3/25/2010 8:46:52 AM - System Checkpoint
RP32: 3/26/2010 10:24:36 AM - System Checkpoint
RP33: 3/27/2010 1:34:52 PM - System Checkpoint
RP34: 3/28/2010 1:58:52 PM - System Checkpoint
RP35: 3/29/2010 4:26:26 PM - System Checkpoint
RP36: 3/31/2010 5:04:48 AM - System Checkpoint
RP37: 4/1/2010 5:46:38 AM - System Checkpoint
RP38: 4/2/2010 6:46:42 AM - System Checkpoint
RP39: 4/3/2010 7:46:41 AM - System Checkpoint
RP40: 4/4/2010 9:34:42 AM - System Checkpoint
RP41: 4/5/2010 9:46:35 AM - System Checkpoint
RP42: 4/6/2010 10:22:36 AM - System Checkpoint
RP43: 4/7/2010 10:46:35 AM - System Checkpoint
RP44: 4/8/2010 11:00:16 AM - System Checkpoint
RP45: 4/9/2010 11:46:35 AM - System Checkpoint
RP46: 4/10/2010 12:46:37 PM - System Checkpoint
RP47: 4/11/2010 1:05:35 PM - System Checkpoint
RP48: 4/12/2010 4:22:21 PM - System Checkpoint
RP49: 4/13/2010 7:05:53 PM - System Checkpoint
RP50: 4/14/2010 7:43:05 PM - System Checkpoint
RP51: 4/15/2010 7:46:31 PM - System Checkpoint
RP52: 4/16/2010 3:56:03 PM - Installed Yard Office
RP53: 4/17/2010 3:15:42 AM - Removed Samsung New PC Studio
RP54: 4/17/2010 3:19:34 AM - Removed Yard Office
RP55: 4/18/2010 4:16:09 AM - System Checkpoint
RP56: 4/19/2010 5:16:04 AM - System Checkpoint
RP57: 4/20/2010 5:36:47 AM - System Checkpoint
RP58: 4/21/2010 6:03:56 AM - System Checkpoint
RP59: 4/22/2010 7:39:57 AM - System Checkpoint
RP60: 4/23/2010 9:39:58 AM - System Checkpoint
RP61: 4/24/2010 5:26:15 PM - System Checkpoint
RP62: 4/25/2010 6:14:11 PM - System Checkpoint
RP63: 4/26/2010 7:14:06 PM - System Checkpoint
RP64: 4/27/2010 8:14:07 PM - System Checkpoint
RP65: 4/29/2010 2:15:18 AM - System Checkpoint
==== Hosts File Hijack ======================
Hosts: 127.0.0.1 www.spywareinfo.com
==== Installed Programs ======================

Maniac · May 2, 2010

Step 1:

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Step 2:

I also see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.

Viewpoint
Viewpoint Manager
Viewpoint Media Player

Step 3:

Please, uninstall the following applications:

Adobe Reader 9.1.3

You can read, how to this in:

Step 4:

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 5:

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

In your next reply, please include these log(s) in this sequence:

JavaRa log
ComboFix log

diburning · May 2, 2010

Step 1 - Done

Step 2 - Done - I only had Viewpoint Media Player on the list. It has now been deleted

Step 3 - Unable to do in safe mode. Cannot use windows installer.

Step 4 - Unable to do in safe mode. JavaRa crashed.

Step 5 - I probably shouldn't go there yet without further instructions

Maniac · May 2, 2010

Go ahead with Step 5.

diburning · May 3, 2010

ComboFix 10-05-02.01 - Owner 05/02/2010 20:33:02.2.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.369 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\WindowsUpdate
.
((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
.
2010-05-01 02:42 . 2010-05-02 23:15 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-30 22:16 . 2010-04-30 22:16 0 ----a-w- c:\documents and settings\Administrator.ERIC\jagex__preferences3.dat
2010-04-30 22:16 . 2010-04-30 22:53 75 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences2.dat
2010-04-30 22:15 . 2010-04-30 22:21 41 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences.dat
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-30 07:55 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-30 07:42 . 2010-04-30 07:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-30 05:54 . 2010-04-30 05:54 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\acccore
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL OCP
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL
2010-04-19 04:27 . 2010-04-19 04:27 -------- d-----w- C:\.jagex_cache_32
2010-04-19 00:35 . 2010-04-19 00:35 -------- d-----w- c:\program files\Unlocker
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-02 12:14 . 2006-06-24 05:19 -------- d-----w- c:\program files\Java
2010-05-02 12:06 . 2006-07-27 02:31 -------- d-----w- c:\documents and settings\Owner\Application Data\Viewpoint
2010-05-02 12:06 . 2006-06-24 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-05-02 12:05 . 2007-07-01 05:10 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent
2010-05-01 04:37 . 2009-05-04 03:38 -------- d-----w- c:\program files\TurboIRC 7
2010-04-30 04:32 . 2009-09-03 17:18 75 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences2.dat
2010-04-30 04:32 . 2008-07-01 16:42 41 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences.dat
2010-04-30 04:31 . 2010-03-29 18:10 41 ----a-w- c:\documents and settings\Owner\jagex__preferences3.dat
2010-04-17 07:17 . 2009-09-13 02:53 -------- d-----w- c:\documents and settings\Owner\Application Data\Samsung
2010-04-17 07:17 . 2009-09-13 02:51 -------- d-----w- c:\program files\Samsung
2010-04-17 07:16 . 2009-09-13 02:52 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-09 01:45 . 2009-10-19 09:21 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-03-23 04:26 . 2008-12-02 19:30 -------- d-----w- c:\documents and settings\Owner\Application Data\LimeWire
2010-03-17 00:51 . 2010-03-17 00:50 -------- d-----w- c:\program files\Google
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-02 23:52 . 2010-02-02 23:52 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{C05C78A4-31ED-4DE0-B925-D574790A11B2}\qsi.exe
2010-02-02 23:32 . 2010-02-02 23:32 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{AAB04084-D284-455F-B093-48F22C60EF3E}\qsi.exe
2003-09-09 05:30 . 2006-06-24 06:05 0 --sha-w- c:\windows\SMINST\HPCD.SYS
.
((((((((((((((((((((((((((((( SnapShot@2010-04-30_20.22.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-05-19 16:44 . 2010-04-30 04:31 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
+ 2009-05-19 16:44 . 2010-04-30 22:15 49152 c:\windows\.jagex_cache_32\runescape\jagmisc.dll
+ 2009-05-19 16:44 . 2010-04-30 22:15 94208 c:\windows\.jagex_cache_32\runescape\jaggl.dll
- 2009-05-19 16:44 . 2010-04-30 04:31 94208 c:\windows\.jagex_cache_32\runescape\jaggl.dll
+ 2010-03-29 18:09 . 2010-04-30 22:15 851456 c:\windows\.jagex_cache_32\runescape\sw3d.dll
- 2010-03-29 18:09 . 2010-04-30 04:31 851456 c:\windows\.jagex_cache_32\runescape\sw3d.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-03-03 831557]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-02 133104]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-07-18 257440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-03 4595712]
"nwiz"="nwiz.exe" [2003-03-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-29 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Administrator.ERIC\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator.ERIC^Start Menu^Programs^Startup^AutoTBar.exe]
backup=c:\windows\pss\AutoTBar.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-06-22 14:27 69632 ----a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 03:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-18 00:42 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2003-04-10 06:36 151597 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\TurboIRC 7\\t7.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\lxdxcfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3298:TCP"= 3298:TCP:zirdij
S0 ltfbyo;ltfbyo;c:\windows\system32\drivers\htjehtx.sys --> c:\windows\system32\drivers\htjehtx.sys [?]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/5/2006 11:34 AM 717296]
S2 0040931234940054mcinstcleanup;McAfee Application Installer Cleanup (0040931234940054);c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [8/24/2009 10:59 PM 98984]
S2 mrtRate;mrtRate; [x]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/1/2008 3:13 AM 34064]
S2 xschuzjed;Windows Installer;c:\windows\system32\svchost.exe -k netsvcs [6/3/2003 4:20 PM 14336]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [9/12/2009 10:53 PM 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [9/12/2009 10:53 PM 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [9/12/2009 10:53 PM 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [9/12/2009 10:53 PM 121856]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
xschuzjed
.
Contents of the 'Scheduled Tasks' folder
2010-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
2010-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://srch-us8.hpwis.com/
mSearch Bar = hxxp://srch-us8.hpwis.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\t15ywiph.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - prefs.js: keyword.enabled - false
FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Aim6 - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-02 20:40
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xschuzjed]
"ServiceDll"="c:\windows\system32\shtuhc.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(460)
c:\program files\Softex\OmniPass\opxpgina.dll
c:\windows\system32\igfxdev.dll
.
Completion time: 2010-05-02 20:43:30
ComboFix-quarantined-files.txt 2010-05-03 00:43
ComboFix2.txt 2010-04-30 20:25
Pre-Run: 11,630,739,456 bytes free
Post-Run: 11,618,623,488 bytes free
- - End Of File - - E5784C3762AE33BDB522D82AA2372979

Maniac · May 3, 2010

Please go to http://virustotal.com

Next to the "Browse" button, in to the blank field, please paste the following:

c:\documents and settings\Owner\Application Data\Microsoft\Installer\{C05C78A4-31ED-4DE0-B925-D574790A11B2}\qsi.exe

c:\documents and settings\Owner\Application Data\Microsoft\Installer\{AAB04084-D284-455F-B093-48F22C60EF3E}\qsi.exe

Hit SEND FILE. Please be patient, it will take a while to get it scanned. Once all the scanners are done, post back with the results (copy & paste them here)

diburning · May 3, 2010

File qsi.exe received on 2010.05.03 07:32:25 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/41 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.05.03 -
AhnLab-V3 2010.05.02.00 2010.05.01 -
AntiVir 8.2.1.224 2010.05.02 -
Antiy-AVL 2.0.3.7 2010.04.30 -
Authentium 5.2.0.5 2010.05.03 -
Avast 4.8.1351.0 2010.05.02 -
Avast5 5.0.332.0 2010.05.02 -
AVG 9.0.0.787 2010.05.02 -
BitDefender 7.2 2010.05.03 -
CAT-QuickHeal 10.00 2010.05.01 -
ClamAV 0.96.0.3-git 2010.05.03 -
Comodo 4745 2010.05.03 -
DrWeb 5.0.2.03300 2010.05.03 -
eSafe 7.0.17.0 2010.05.02 -
eTrust-Vet 35.2.7465 2010.05.03 -
F-Prot 4.5.1.85 2010.05.03 -
F-Secure 9.0.15370.0 2010.05.03 -
Fortinet 4.0.14.0 2010.05.02 -
GData 21 2010.05.03 -
Ikarus T3.1.1.80.0 2010.05.03 -
Jiangmin 13.0.900 2010.05.03 -
Kaspersky 7.0.0.125 2010.05.03 -
McAfee 5.400.0.1158 2010.05.03 -
McAfee-GW-Edition 6.8.5 2010.05.02 -
Microsoft 1.5703 2010.05.03 -
NOD32 5080 2010.05.02 -
Norman 6.04.12 2010.05.02 -
nProtect 2010-05-03.01 2010.05.03 -
Panda 10.0.2.7 2010.05.02 -
PCTools 7.0.3.5 2010.05.03 -
Prevx 3.0 2010.05.03 -
Rising 22.45.04.03 2010.04.30 -
Sophos 4.53.0 2010.05.03 -
Sunbelt 6250 2010.05.02 -
Symantec 20091.2.0.41 2010.05.03 -
TheHacker 6.5.2.0.275 2010.05.02 -
TrendMicro 9.120.0.1004 2010.05.03 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.03 -
VBA32 3.12.12.4 2010.04.30 -
ViRobot 2010.5.1.2299 2010.05.03 -
VirusBuster 5.0.27.0 2010.05.02 -
Additional information
File size: 766 bytes
MD5...: 80ae98102bf32298770ee40764e06a80
SHA1..: b9043cdccc9d5126f49cd1cbbd2b98c4261a3bce
SHA256: 8f5f9ce0a6c48e7b1ae21a87f8df4b14d95b5c40ceb83ce9369bd06ed5349277
ssdeep: 12:IEipSBzlQt1Mr1LetRQtQ5S6agfiu2G7ym:IEiIRgquXym
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Windows Icon (57.2%)
MPEG Video (42.7%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

File qsi.exe received on 2010.05.03 07:35:49 (UTC)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/41 (0%)
Loading server information...
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
a-squared 4.5.0.50 2010.05.03 -
AhnLab-V3 2010.05.02.00 2010.05.01 -
AntiVir 8.2.1.224 2010.05.02 -
Antiy-AVL 2.0.3.7 2010.04.30 -
Authentium 5.2.0.5 2010.05.03 -
Avast 4.8.1351.0 2010.05.02 -
Avast5 5.0.332.0 2010.05.02 -
AVG 9.0.0.787 2010.05.02 -
BitDefender 7.2 2010.05.03 -
CAT-QuickHeal 10.00 2010.05.01 -
ClamAV 0.96.0.3-git 2010.05.03 -
Comodo 4745 2010.05.03 -
DrWeb 5.0.2.03300 2010.05.03 -
eSafe 7.0.17.0 2010.05.02 -
eTrust-Vet 35.2.7465 2010.05.03 -
F-Prot 4.5.1.85 2010.05.03 -
F-Secure 9.0.15370.0 2010.05.03 -
Fortinet 4.0.14.0 2010.05.02 -
GData 21 2010.05.03 -
Ikarus T3.1.1.80.0 2010.05.03 -
Jiangmin 13.0.900 2010.05.03 -
Kaspersky 7.0.0.125 2010.05.03 -
McAfee 5.400.0.1158 2010.05.03 -
McAfee-GW-Edition 6.8.5 2010.05.02 -
Microsoft 1.5703 2010.05.03 -
NOD32 5080 2010.05.02 -
Norman 6.04.12 2010.05.02 -
nProtect 2010-05-03.01 2010.05.03 -
Panda 10.0.2.7 2010.05.02 -
PCTools 7.0.3.5 2010.05.03 -
Prevx 3.0 2010.05.03 -
Rising 22.45.04.03 2010.04.30 -
Sophos 4.53.0 2010.05.03 -
Sunbelt 6250 2010.05.02 -
Symantec 20091.2.0.41 2010.05.03 -
TheHacker 6.5.2.0.275 2010.05.02 -
TrendMicro 9.120.0.1004 2010.05.03 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.03 -
VBA32 3.12.12.4 2010.04.30 -
ViRobot 2010.5.1.2299 2010.05.03 -
VirusBuster 5.0.27.0 2010.05.02 -
Additional information
File size: 766 bytes
MD5...: 80ae98102bf32298770ee40764e06a80
SHA1..: b9043cdccc9d5126f49cd1cbbd2b98c4261a3bce
SHA256: 8f5f9ce0a6c48e7b1ae21a87f8df4b14d95b5c40ceb83ce9369bd06ed5349277
ssdeep: 12:IEipSBzlQt1Mr1LetRQtQ5S6agfiu2G7ym:IEiIRgquXym
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Windows Icon (57.2%)
MPEG Video (42.7%)
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

I know what QSI.exe is. I installed QSI.exe myself. It is a file editing application for sound chips in model trains. Company info is at http://www.qsisolutions.com

Maniac · May 3, 2010

Just wanted to check. Thank you! :lol:

Open Notepad and copy and paste the text in the code box below into it:

http://forums.malwarebytes.org/index.php?showtopic=48931

KillAll::

Collect::[8]
c:\windows\system32\shtuhc.dll

Driver::
xschuzjed
zirdij
ltfbyo
htjehtx

NetSvc::
xschuzjed

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xschuzjed]

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

diburning · May 3, 2010

Received an error message from combofix.

'NIRCCMDC' is not recognized as an internal or external command, operable program, or batch file.

diburning · May 3, 2010

Decided to try again. Dragged script onto Combo-Fix. Ran sucessfully. Here is the log.

ComboFix 10-05-02.01 - Owner 05/03/2010 13:36:20.3.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.273 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_XSCHUZJED
-------\Service_ltfbyo
-------\Service_xschuzjed
((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
.
2010-05-01 02:42 . 2010-05-02 23:15 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-30 22:16 . 2010-04-30 22:16 0 ----a-w- c:\documents and settings\Administrator.ERIC\jagex__preferences3.dat
2010-04-30 22:16 . 2010-04-30 22:53 75 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences2.dat
2010-04-30 22:15 . 2010-04-30 22:21 41 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences.dat
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-30 07:55 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-30 07:42 . 2010-04-30 07:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-30 05:54 . 2010-04-30 05:54 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\acccore
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL OCP
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL
2010-04-19 04:27 . 2010-04-19 04:27 -------- d-----w- C:\.jagex_cache_32
2010-04-19 00:35 . 2010-04-19 00:35 -------- d-----w- c:\program files\Unlocker
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-03 17:24 . 2009-05-04 03:38 -------- d-----w- c:\program files\TurboIRC 7
2010-05-02 12:14 . 2006-06-24 05:19 -------- d-----w- c:\program files\Java
2010-05-02 12:06 . 2006-07-27 02:31 -------- d-----w- c:\documents and settings\Owner\Application Data\Viewpoint
2010-05-02 12:06 . 2006-06-24 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-05-02 12:05 . 2007-07-01 05:10 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent
2010-04-30 04:32 . 2009-09-03 17:18 75 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences2.dat
2010-04-30 04:32 . 2008-07-01 16:42 41 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences.dat
2010-04-30 04:31 . 2010-03-29 18:10 41 ----a-w- c:\documents and settings\Owner\jagex__preferences3.dat
2010-04-17 07:17 . 2009-09-13 02:53 -------- d-----w- c:\documents and settings\Owner\Application Data\Samsung
2010-04-17 07:17 . 2009-09-13 02:51 -------- d-----w- c:\program files\Samsung
2010-04-17 07:16 . 2009-09-13 02:52 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-09 01:45 . 2009-10-19 09:21 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-03-23 04:26 . 2008-12-02 19:30 -------- d-----w- c:\documents and settings\Owner\Application Data\LimeWire
2010-03-17 00:51 . 2010-03-17 00:50 -------- d-----w- c:\program files\Google
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-02 23:52 . 2010-02-02 23:52 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{C05C78A4-31ED-4DE0-B925-D574790A11B2}\qsi.exe
2010-02-02 23:32 . 2010-02-02 23:32 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{AAB04084-D284-455F-B093-48F22C60EF3E}\qsi.exe
2003-09-09 05:30 . 2006-06-24 06:05 0 --sha-w- c:\windows\SMINST\HPCD.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingB3934"="command" [X]
"SpybotDeletingD1919"="del" [X]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-07-18 257440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-03 4595712]
"nwiz"="nwiz.exe" [2003-03-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-29 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Administrator.ERIC\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator.ERIC^Start Menu^Programs^Startup^AutoTBar.exe]
backup=c:\windows\pss\AutoTBar.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-06-22 14:27 69632 ----a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 03:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-18 00:42 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2003-04-10 06:36 151597 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\TurboIRC 7\\t7.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\lxdxcfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3298:TCP"= 3298:TCP:zirdij
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/5/2006 11:34 AM 717296]
S2 0040931234940054mcinstcleanup;McAfee Application Installer Cleanup (0040931234940054);c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [8/24/2009 10:59 PM 98984]
S2 mrtRate;mrtRate; [x]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/1/2008 3:13 AM 34064]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [9/12/2009 10:53 PM 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [9/12/2009 10:53 PM 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [9/12/2009 10:53 PM 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [9/12/2009 10:53 PM 121856]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2010-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
2010-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
.
.
------- Supplementary Scan -------
.
mSearch Bar = hxxp://srch-us8.hpwis.com/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Administrator.ERIC\Application Data\Mozilla\Firefox\Profiles\gu79w1pc.default\
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-03 13:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spjj.sys >>UNKNOWN [0x82A5B938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf84a3f28
\Driver\ACPI -> ACPI.sys @ 0xf82fecb8
\Driver\atapi -> atapi.sys @ 0xf82b9b40
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf818dbd4
PacketIndicateHandler -> NDIS.sys @ 0xf8199a21
SendHandler -> NDIS.sys @ 0xf818dd44
user & kernel MBR OK
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\program files\Softex\OmniPass\opxpgina.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Softex\OmniPass\OPXPApp.exe
.
**************************************************************************
.
Completion time: 2010-05-03 13:51:36 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-03 17:51
ComboFix2.txt 2010-05-03 00:43
ComboFix3.txt 2010-04-30 20:25
Pre-Run: 11,604,369,408 bytes free
Post-Run: 11,484,930,048 bytes free
- - End Of File - - 0A326659EB3110261A82E02F12EE3147

Maniac · May 3, 2010

Open Notepad and copy and paste the text in the code box below into it:

KillAll::

Driver::
zirdij

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3298:TCP"=-

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

diburning · May 3, 2010

Here is the log:

ComboFix 10-05-02.01 - Owner 05/03/2010 14:54:43.4.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.350 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.
((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
.
2010-05-03 18:50 . 2010-05-03 18:53 -------- d-----w- C:\Combo-Fix
2010-05-01 02:42 . 2010-05-02 23:15 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-30 22:16 . 2010-04-30 22:16 0 ----a-w- c:\documents and settings\Administrator.ERIC\jagex__preferences3.dat
2010-04-30 22:16 . 2010-04-30 22:53 75 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences2.dat
2010-04-30 22:15 . 2010-04-30 22:21 41 ----a-w- c:\documents and settings\Administrator.ERIC\jagex_runescape_preferences.dat
2010-04-30 20:06 . 2010-04-30 20:06 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-04-30 07:55 . 2010-04-30 07:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-30 07:55 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-30 07:42 . 2010-04-30 07:42 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2010-04-30 05:54 . 2010-04-30 05:54 -------- d-----w- c:\documents and settings\Administrator.ERIC\Application Data\acccore
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL OCP
2010-04-30 05:53 . 2010-04-30 05:53 -------- d-----w- c:\documents and settings\Administrator.ERIC\Local Settings\Application Data\AOL
2010-04-19 04:27 . 2010-04-19 04:27 -------- d-----w- C:\.jagex_cache_32
2010-04-19 00:35 . 2010-04-19 00:35 -------- d-----w- c:\program files\Unlocker
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-03 17:24 . 2009-05-04 03:38 -------- d-----w- c:\program files\TurboIRC 7
2010-05-02 12:14 . 2006-06-24 05:19 -------- d-----w- c:\program files\Java
2010-05-02 12:06 . 2006-07-27 02:31 -------- d-----w- c:\documents and settings\Owner\Application Data\Viewpoint
2010-05-02 12:06 . 2006-06-24 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-05-02 12:05 . 2007-07-01 05:10 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent
2010-04-30 04:32 . 2009-09-03 17:18 75 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences2.dat
2010-04-30 04:32 . 2008-07-01 16:42 41 ----a-w- c:\documents and settings\Owner\jagex_runescape_preferences.dat
2010-04-30 04:31 . 2010-03-29 18:10 41 ----a-w- c:\documents and settings\Owner\jagex__preferences3.dat
2010-04-17 07:17 . 2009-09-13 02:53 -------- d-----w- c:\documents and settings\Owner\Application Data\Samsung
2010-04-17 07:17 . 2009-09-13 02:51 -------- d-----w- c:\program files\Samsung
2010-04-17 07:16 . 2009-09-13 02:52 -------- d-----w- c:\program files\PC Connectivity Solution
2010-04-09 01:45 . 2009-10-19 09:21 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-03-23 04:26 . 2008-12-02 19:30 -------- d-----w- c:\documents and settings\Owner\Application Data\LimeWire
2010-03-17 00:51 . 2010-03-17 00:50 -------- d-----w- c:\program files\Google
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-02 23:52 . 2010-02-02 23:52 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{C05C78A4-31ED-4DE0-B925-D574790A11B2}\qsi.exe
2010-02-02 23:32 . 2010-02-02 23:32 766 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{AAB04084-D284-455F-B093-48F22C60EF3E}\qsi.exe
2003-09-09 05:30 . 2006-06-24 06:05 0 --sha-w- c:\windows\SMINST\HPCD.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-03-03 831557]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-07-02 133104]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-07-18 257440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-03-03 4595712]
"nwiz"="nwiz.exe" [2003-03-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2002-08-29 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2002-08-29 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2002-08-29 455168]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-06-13 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-06-13 16040]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Administrator.ERIC\Start Menu\Programs\Startup\
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoTBar.exe [2002-8-21 40960]
mod_sm.lnk - c:\hp\bin\cloaker.exe [1999-11-7 27136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 ----a-w- c:\program files\Softex\OmniPass\OPXPGina.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator.ERIC^Start Menu^Programs^Startup^AutoTBar.exe]
backup=c:\windows\pss\AutoTBar.exeStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamMonitor]
2002-06-22 14:27 69632 ----a-w- c:\program files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 03:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]
2002-04-18 00:42 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2003-04-10 06:36 151597 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\TurboIRC 7\\t7.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\lxdxcoms.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\lxdxmon.exe"=
"c:\\WINDOWS\\system32\\lxdxcfg.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdxjswx.exe"=
"c:\\Program Files\\Lexmark 3600-4600 Series\\frun.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3298:TCP"= 3298:TCP:zirdij
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/5/2006 11:34 AM 717296]
S2 0040931234940054mcinstcleanup;McAfee Application Installer Cleanup (0040931234940054);c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Owner\LOCALS~1\Temp\004093~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [8/24/2009 10:59 PM 98984]
S2 mrtRate;mrtRate; [x]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/1/2008 3:13 AM 34064]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [9/12/2009 10:53 PM 36608]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\drivers\ss_bbus.sys [9/12/2009 10:53 PM 90112]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\drivers\ss_bmdfl.sys [9/12/2009 10:53 PM 14976]
S3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\drivers\ss_bmdm.sys [9/12/2009 10:53 PM 121856]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
2010-04-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
2010-04-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
2010-04-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1769490771-839467298-1411185996-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-07-02 01:33]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uDefault_Search_URL = hxxp://srch-us8.hpwis.com/
mSearch Bar = hxxp://srch-us8.hpwis.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Administrator.ERIC\Application Data\Mozilla\Firefox\Profiles\gu79w1pc.default\
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-03 15:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spfu.sys >>UNKNOWN [0x82A5A938]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf84a3f28
\Driver\ACPI -> ACPI.sys @ 0xf82fecb8
\Driver\atapi -> atapi.sys @ 0xf82b9b40
IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf818dbd4
PacketIndicateHandler -> NDIS.sys @ 0xf8199a21
SendHandler -> NDIS.sys @ 0xf818dd44
user & kernel MBR OK
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(484)
c:\program files\Softex\OmniPass\opxpgina.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Softex\OmniPass\OPXPApp.exe
.
**************************************************************************
.
Completion time: 2010-05-03 15:10:30 - machine was rebooted
ComboFix-quarantined-files.txt 2010-05-03 19:10
ComboFix2.txt 2010-05-03 17:51
ComboFix3.txt 2010-05-03 00:43
ComboFix4.txt 2010-04-30 20:25
Pre-Run: 11,483,529,216 bytes free
Post-Run: 11,455,307,776 bytes free
- - End Of File - - C73018CC107326211CC0BEBC01F22EA9

Looking over the log, something caught my eye. The GMER sinowal detector. Before I started running MBAM and asked for help, I ran the Windows Malicious Software Removal Tool which after about 16 hours, removed a Trojan with Sinowal in the name. It didn't do anything to remove Fraud.Sysclean, but I thought I'd mention it here.

Maniac · May 3, 2010

Please read the following through carefully so that you understand what to do.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK. (If Vista, click on the Vista Orb and copy and paste the following into the Search field. (make sure you include the quotation marks) Then press Ctrl+Shift+Enter.)
"%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v
If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
It may ask you to reboot the computer to complete the process. Allow it to do so.
When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

diburning · May 4, 2010

Log:

23:35:44:468 1216 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
23:35:44:468 1216 ================================================================================
23:35:44:468 1216 SystemInfo:
23:35:44:468 1216 OS Version: 5.1.2600 ServicePack: 3.0
23:35:44:468 1216 Product type: Workstation
23:35:44:468 1216 ComputerName: ERIC
23:35:44:468 1216 UserName: Owner
23:35:44:468 1216 Windows directory: C:\WINDOWS
23:35:44:468 1216 Processor architecture: Intel x86
23:35:44:468 1216 Number of processors: 2
23:35:44:468 1216 Page size: 0x1000
23:35:44:468 1216 Boot type: Safe boot with network
23:35:44:468 1216 ================================================================================
23:35:44:468 1216 UnloadDriverW: NtUnloadDriver error 2
23:35:44:468 1216 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
23:35:44:484 1216 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
23:35:44:484 1216 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
23:35:44:484 1216 wfopen_ex: Trying to KLMD file open
23:35:44:484 1216 wfopen_ex: File opened ok (Flags 2)
23:35:44:484 1216 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
23:35:44:484 1216 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
23:35:44:484 1216 wfopen_ex: Trying to KLMD file open
23:35:44:484 1216 wfopen_ex: File opened ok (Flags 2)
23:35:44:484 1216 Initialize success
23:35:44:484 1216
23:35:44:484 1216 Scanning Services ...
23:35:45:000 1216 Raw services enum returned 344 services
23:35:45:015 1216
23:35:45:015 1216 Scanning Kernel memory ...
23:35:45:031 1216 Devices to scan: 11
23:35:45:031 1216
23:35:45:031 1216 Driver Name: Disk
23:35:45:031 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:031 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:031 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:031 1216 IRP_MJ_READ : F849FD1F
23:35:45:031 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:031 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:031 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:031 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:031 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:031 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:031 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:031 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:031 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:031 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:031 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:031 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:031 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:031 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:031 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:031 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:031 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:031 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:031 1216 IRP_MJ_POWER : F84A1C82
23:35:45:031 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:031 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:031 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:031 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:031 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:046 1216
23:35:45:046 1216 Driver Name: Disk
23:35:45:046 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:046 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:046 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:046 1216 IRP_MJ_READ : F849FD1F
23:35:45:046 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:046 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:046 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:046 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:046 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:046 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:046 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:046 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_POWER : F84A1C82
23:35:45:046 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:046 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:046 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:046 1216
23:35:45:046 1216 Driver Name: Disk
23:35:45:046 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:046 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:046 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:046 1216 IRP_MJ_READ : F849FD1F
23:35:45:046 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:046 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:046 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:046 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:046 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:046 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:046 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:046 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_POWER : F84A1C82
23:35:45:046 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:046 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:046 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:046 1216
23:35:45:046 1216 Driver Name: Disk
23:35:45:046 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:046 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:046 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:046 1216 IRP_MJ_READ : F849FD1F
23:35:45:046 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:046 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:046 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:046 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:046 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:046 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:046 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:046 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_POWER : F84A1C82
23:35:45:046 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:046 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:046 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:046 1216
23:35:45:046 1216 Driver Name: USBSTOR
23:35:45:046 1216 IRP_MJ_CREATE : 8280B1F8
23:35:45:046 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:046 1216 IRP_MJ_CLOSE : 8280B1F8
23:35:45:046 1216 IRP_MJ_READ : 8280B1F8
23:35:45:046 1216 IRP_MJ_WRITE : 8280B1F8
23:35:45:046 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:046 1216 IRP_MJ_FLUSH_BUFFERS : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:046 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_DEVICE_CONTROL : 8280B1F8
23:35:45:046 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8280B1F8
23:35:45:046 1216 IRP_MJ_SHUTDOWN : 804F9729
23:35:45:046 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:046 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:046 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:046 1216 IRP_MJ_POWER : 8280B1F8
23:35:45:046 1216 IRP_MJ_SYSTEM_CONTROL : 8280B1F8
23:35:45:046 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:046 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:046 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:062 1216 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
23:35:45:062 1216
23:35:45:062 1216 Driver Name: USBSTOR
23:35:45:062 1216 IRP_MJ_CREATE : 8280B1F8
23:35:45:062 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:062 1216 IRP_MJ_CLOSE : 8280B1F8
23:35:45:062 1216 IRP_MJ_READ : 8280B1F8
23:35:45:062 1216 IRP_MJ_WRITE : 8280B1F8
23:35:45:062 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:062 1216 IRP_MJ_FLUSH_BUFFERS : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_SHUTDOWN : 804F9729
23:35:45:062 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:062 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_POWER : 8280B1F8
23:35:45:062 1216 IRP_MJ_SYSTEM_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:062 1216 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
23:35:45:062 1216
23:35:45:062 1216 Driver Name: USBSTOR
23:35:45:062 1216 IRP_MJ_CREATE : 8280B1F8
23:35:45:062 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:062 1216 IRP_MJ_CLOSE : 8280B1F8
23:35:45:062 1216 IRP_MJ_READ : 8280B1F8
23:35:45:062 1216 IRP_MJ_WRITE : 8280B1F8
23:35:45:062 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:062 1216 IRP_MJ_FLUSH_BUFFERS : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_SHUTDOWN : 804F9729
23:35:45:062 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:062 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_POWER : 8280B1F8
23:35:45:062 1216 IRP_MJ_SYSTEM_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:062 1216 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
23:35:45:062 1216
23:35:45:062 1216 Driver Name: USBSTOR
23:35:45:062 1216 IRP_MJ_CREATE : 8280B1F8
23:35:45:062 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:062 1216 IRP_MJ_CLOSE : 8280B1F8
23:35:45:062 1216 IRP_MJ_READ : 8280B1F8
23:35:45:062 1216 IRP_MJ_WRITE : 8280B1F8
23:35:45:062 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:062 1216 IRP_MJ_FLUSH_BUFFERS : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_SHUTDOWN : 804F9729
23:35:45:062 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:062 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_POWER : 8280B1F8
23:35:45:062 1216 IRP_MJ_SYSTEM_CONTROL : 8280B1F8
23:35:45:062 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:062 1216 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1
23:35:45:062 1216
23:35:45:062 1216 Driver Name: Disk
23:35:45:062 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:062 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:062 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:062 1216 IRP_MJ_READ : F849FD1F
23:35:45:062 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:062 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:062 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:062 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:062 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:062 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:062 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:062 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:062 1216 IRP_MJ_POWER : F84A1C82
23:35:45:062 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:062 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:062 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:062 1216
23:35:45:062 1216 Driver Name: Disk
23:35:45:062 1216 IRP_MJ_CREATE : F84A5BB0
23:35:45:062 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:062 1216 IRP_MJ_CLOSE : F84A5BB0
23:35:45:062 1216 IRP_MJ_READ : F849FD1F
23:35:45:062 1216 IRP_MJ_WRITE : F849FD1F
23:35:45:062 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:062 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:062 1216 IRP_MJ_FLUSH_BUFFERS : F84A02E2
23:35:45:062 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:062 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_DEVICE_CONTROL : F84A03BB
23:35:45:062 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F84A3F28
23:35:45:062 1216 IRP_MJ_SHUTDOWN : F84A02E2
23:35:45:062 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:062 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:062 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:078 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:078 1216 IRP_MJ_POWER : F84A1C82
23:35:45:078 1216 IRP_MJ_SYSTEM_CONTROL : F84A699E
23:35:45:078 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:078 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:078 1216 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
23:35:45:078 1216
23:35:45:078 1216 Driver Name: atapi
23:35:45:078 1216 IRP_MJ_CREATE : F82B9B40
23:35:45:078 1216 IRP_MJ_CREATE_NAMED_PIPE : 804F9729
23:35:45:078 1216 IRP_MJ_CLOSE : F82B9B40
23:35:45:078 1216 IRP_MJ_READ : 804F9729
23:35:45:078 1216 IRP_MJ_WRITE : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_INFORMATION : 804F9729
23:35:45:078 1216 IRP_MJ_SET_INFORMATION : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_EA : 804F9729
23:35:45:078 1216 IRP_MJ_SET_EA : 804F9729
23:35:45:078 1216 IRP_MJ_FLUSH_BUFFERS : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F9729
23:35:45:078 1216 IRP_MJ_SET_VOLUME_INFORMATION : 804F9729
23:35:45:078 1216 IRP_MJ_DIRECTORY_CONTROL : 804F9729
23:35:45:078 1216 IRP_MJ_FILE_SYSTEM_CONTROL : 804F9729
23:35:45:078 1216 IRP_MJ_DEVICE_CONTROL : F82B9B40
23:35:45:078 1216 IRP_MJ_INTERNAL_DEVICE_CONTROL : F82B9B40
23:35:45:078 1216 IRP_MJ_SHUTDOWN : 804F9729
23:35:45:078 1216 IRP_MJ_LOCK_CONTROL : 804F9729
23:35:45:078 1216 IRP_MJ_CLEANUP : 804F9729
23:35:45:078 1216 IRP_MJ_CREATE_MAILSLOT : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_SECURITY : 804F9729
23:35:45:078 1216 IRP_MJ_SET_SECURITY : 804F9729
23:35:45:078 1216 IRP_MJ_POWER : F82B9B40
23:35:45:078 1216 IRP_MJ_SYSTEM_CONTROL : F82B9B40
23:35:45:078 1216 IRP_MJ_DEVICE_CHANGE : 804F9729
23:35:45:078 1216 IRP_MJ_QUERY_QUOTA : 804F9729
23:35:45:078 1216 IRP_MJ_SET_QUOTA : 804F9729
23:35:45:093 1216 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1
23:35:45:093 1216
23:35:45:093 1216 Completed
23:35:45:093 1216
23:35:45:093 1216 Results:
23:35:45:093 1216 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
23:35:45:093 1216 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
23:35:45:093 1216 File objects infected / cured / cured on reboot: 0 / 0 / 0
23:35:45:093 1216
23:35:45:093 1216 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
23:35:45:093 1216 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
23:35:45:109 1216 KLMD(ARK) unloaded successfully

Maniac · May 4, 2010

Please post a new fresh GMER log.

diburning · May 4, 2010

I am in safe mode. GMER won't detect anything not running in safe mode, but I'll run a scan now. Unless you would like me to try booting in normal mode again (If Fraud.Sysclean is still on the system, it will not allow me to run anything)

diburning · May 4, 2010

I left GMER running overnight and my computer restarted itself. Should I try again?

Maniac · May 4, 2010

Please download The Avenger2 by Swandog46 to your Desktop.

Right click on the Avenger.zip folder and select "Extract All..."
Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to disable:
zirdij

Drivers to delete:
zirdij

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

Right click on the window under Input script here:, and select Paste.
You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
Click on Execute
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

diburning · May 5, 2010

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////
Platform: Windows XP (build 2600, Service Pack 3)
Tue May 04 23:01:27 2010
//////////////////////////////////////////
Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Error: could not open driver "zirdij"
Disablement of driver "zirdij" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\zirdij" not found!
Deletion of driver "zirdij" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Completed script processing.
*******************
Finished! Terminate.

Multiple Infections, Assistance Please

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information