Jump to content

Continual blocking even when Browser is closed


Recommended Posts

DDS (Ver_10-03-17.01) - NTFSx86

Run by Collections at 14:02:17.93 on Tue 05/18/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1475 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Dell Network Assistant\hnm_svc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Collections\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uInternet Connection Wizard,ShellNext = iexplore

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Alcmtr] ALCMTR.EXE

mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {106E49CF-797A-11D2-81A2-00E02C015623} - hxxp://www.alternatiff.com/install-ie/alttiff.cab

DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://webcam.ci.schaumburg.il.us/activex/AxisCamControl.cab

DPF: {C9E2242D-DC05-4C54-9483-A5C90653F7BC} - hxxps://techinline.net/Client/TIClient.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

DPF: {F91AB7B8-EE67-42AF-A5AA-8E232C396A04} - hxxps://creditcommander.microbilt.com/cabs/htmlprint.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\collec~1\applic~1\mozilla\firefox\profiles\oz44qyov.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/|http://my.ventech.com/|http://www.bing.com/|http://www.google.com/|http://www.woot.com/|http://www.velonews.com/

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-18 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-18 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-18 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-18 60936]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-1-25 304464]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-1-11 24652]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-1-25 20952]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-23 133104]

S3 B-Service;B-Service;c:\documents and settings\collections\application data\mikogo\B-Service.exe [2009-12-3 185640]

=============== Created Last 30 ================

2010-05-18 17:56:29 0 ----a-w- c:\documents and settings\collections\defogger_reenable

2010-05-18 12:43:25 0 d-----w- c:\docume~1\collec~1\applic~1\Avira

2010-05-18 12:34:26 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-05-18 12:34:25 0 d-----w- c:\program files\Avira

2010-05-18 12:34:25 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-05-18 12:30:31 0 d-----w- C:\Avira antivirus

2010-05-17 18:17:48 8014 ----a-w- C:\DR. _6429.pdf

2010-05-17 18:15:57 0 d-----w- C:\Currports

2010-05-17 14:56:13 136192 ----a-w- c:\windows\system32\msihost.exe

2010-04-22 18:32:22 72418 ----a-w- C:\Keable Lien.pdf

2010-04-21 19:19:51 13846 ----a-w- C:\cashflow 11 months March 2010.xls

==================== Find3M ====================

2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll

2010-02-25 15:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-02-24 09:54:25 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-02-19 23:47:50 3604480 ----a-w- c:\windows\system32\GPhotos.scr

2008-11-10 14:28:12 53796 ----a-w- c:\program files\INSTALL.LOG

============= FINISH: 14:04:22.68 ===============

Malware LOG File:

08:19:55 Collections MESSAGE Protection started successfully

08:19:59 Collections MESSAGE IP Protection started successfully

08:24:21 Collections IP-BLOCK 91.212.226.7

08:24:24 Collections IP-BLOCK 91.212.226.7

08:24:30 Collections IP-BLOCK 91.212.226.7

08:25:07 Collections IP-BLOCK 213.163.89.106

08:25:10 Collections IP-BLOCK 213.163.89.106

08:25:16 Collections IP-BLOCK 213.163.89.106

08:25:28 Collections IP-BLOCK 213.163.89.106

08:25:31 Collections IP-BLOCK 213.163.89.106

08:25:37 Collections IP-BLOCK 213.163.89.106

08:25:50 Collections IP-BLOCK 213.163.89.107

08:25:53 Collections IP-BLOCK 213.163.89.107

08:25:59 Collections IP-BLOCK 213.163.89.107

08:26:11 Collections IP-BLOCK 213.163.89.107

08:26:14 Collections IP-BLOCK 213.163.89.107

08:26:20 Collections IP-BLOCK 213.163.89.107

08:26:32 Collections IP-BLOCK 213.163.89.105

08:26:35 Collections IP-BLOCK 213.163.89.105

08:26:41 Collections IP-BLOCK 213.163.89.105

08:29:21 Collections IP-BLOCK 213.163.89.104

08:29:24 Collections IP-BLOCK 213.163.89.104

08:29:30 Collections IP-BLOCK 213.163.89.104

08:29:35 Collections IP-BLOCK 91.212.226.7

08:29:38 Collections IP-BLOCK 91.212.226.7

08:29:44 Collections IP-BLOCK 91.212.226.7

08:40:42 Collections IP-BLOCK 213.163.89.104

08:40:45 Collections IP-BLOCK 213.163.89.104

08:40:51 Collections IP-BLOCK 213.163.89.104

08:42:00 Collections IP-BLOCK 213.163.89.106

08:42:03 Collections IP-BLOCK 213.163.89.106

08:42:09 Collections IP-BLOCK 213.163.89.106

08:42:21 Collections IP-BLOCK 213.163.89.106

08:42:24 Collections IP-BLOCK 213.163.89.106

08:42:30 Collections IP-BLOCK 213.163.89.106

08:42:42 Collections IP-BLOCK 213.163.89.107

08:42:45 Collections IP-BLOCK 213.163.89.107

08:42:51 Collections IP-BLOCK 213.163.89.107

08:43:03 Collections IP-BLOCK 213.163.89.107

08:43:06 Collections IP-BLOCK 213.163.89.107

08:43:12 Collections IP-BLOCK 213.163.89.107

08:43:24 Collections IP-BLOCK 213.163.89.105

08:43:27 Collections IP-BLOCK 213.163.89.105

08:43:33 Collections IP-BLOCK 213.163.89.105

09:14:03 Collections IP-BLOCK 213.163.89.104

09:14:06 Collections IP-BLOCK 213.163.89.104

09:14:12 Collections IP-BLOCK 213.163.89.104

09:22:24 Collections IP-BLOCK 213.163.89.104

09:22:27 Collections IP-BLOCK 213.163.89.104

09:22:33 Collections IP-BLOCK 213.163.89.104

09:52:45 Collections IP-BLOCK 213.163.89.104

09:52:48 Collections IP-BLOCK 213.163.89.104

09:52:54 Collections IP-BLOCK 213.163.89.104

10:12:06 Collections IP-BLOCK 213.163.89.104

10:12:09 Collections IP-BLOCK 213.163.89.104

10:12:15 Collections IP-BLOCK 213.163.89.104

10:34:31 Collections IP-BLOCK 91.212.226.7

10:34:34 Collections IP-BLOCK 91.212.226.7

10:34:40 Collections IP-BLOCK 91.212.226.7

10:35:27 Collections IP-BLOCK 213.163.89.104

10:35:30 Collections IP-BLOCK 213.163.89.104

10:35:37 Collections IP-BLOCK 213.163.89.104

10:48:49 Collections IP-BLOCK 213.163.89.104

10:48:52 Collections IP-BLOCK 213.163.89.104

10:48:58 Collections IP-BLOCK 213.163.89.104

11:05:10 Collections IP-BLOCK 213.163.89.104

11:05:13 Collections IP-BLOCK 213.163.89.104

11:05:19 Collections IP-BLOCK 213.163.89.104

11:24:31 Collections IP-BLOCK 213.163.89.104

11:24:34 Collections IP-BLOCK 213.163.89.104

11:24:40 Collections IP-BLOCK 213.163.89.104

11:25:24 Collections IP-BLOCK 61.61.20.132

11:25:27 Collections IP-BLOCK 61.61.20.132

11:25:33 Collections IP-BLOCK 61.61.20.132

11:26:18 Collections IP-BLOCK 213.163.89.106

11:26:22 Collections IP-BLOCK 213.163.89.106

11:26:28 Collections IP-BLOCK 213.163.89.106

11:26:40 Collections IP-BLOCK 213.163.89.106

11:26:43 Collections IP-BLOCK 213.163.89.106

11:26:49 Collections IP-BLOCK 213.163.89.106

11:27:01 Collections IP-BLOCK 213.163.89.106

11:27:04 Collections IP-BLOCK 213.163.89.106

11:27:10 Collections IP-BLOCK 213.163.89.106

11:27:22 Collections IP-BLOCK 213.163.89.106

11:27:25 Collections IP-BLOCK 213.163.89.106

11:27:31 Collections IP-BLOCK 213.163.89.106

11:27:43 Collections IP-BLOCK 213.163.89.107

11:27:47 Collections IP-BLOCK 213.163.89.107

11:27:53 Collections IP-BLOCK 213.163.89.107

11:28:05 Collections IP-BLOCK 213.163.89.107

11:28:08 Collections IP-BLOCK 213.163.89.107

11:28:14 Collections IP-BLOCK 213.163.89.107

11:28:26 Collections IP-BLOCK 213.163.89.107

11:28:29 Collections IP-BLOCK 213.163.89.107

11:43:17 Collections IP-BLOCK 213.163.89.106

11:43:20 Collections IP-BLOCK 213.163.89.106

11:43:26 Collections IP-BLOCK 213.163.89.106

11:43:38 Collections IP-BLOCK 213.163.89.106

11:43:41 Collections IP-BLOCK 213.163.89.106

11:43:47 Collections IP-BLOCK 213.163.89.106

11:43:59 Collections IP-BLOCK 213.163.89.107

11:44:02 Collections IP-BLOCK 213.163.89.107

11:44:08 Collections IP-BLOCK 213.163.89.107

11:44:20 Collections IP-BLOCK 213.163.89.107

11:44:23 Collections IP-BLOCK 213.163.89.107

11:44:29 Collections IP-BLOCK 213.163.89.107

11:44:41 Collections IP-BLOCK 213.163.89.105

11:44:44 Collections IP-BLOCK 213.163.89.105

11:44:50 Collections IP-BLOCK 213.163.89.105

11:49:16 Collections IP-BLOCK 213.163.89.106

11:49:19 Collections IP-BLOCK 213.163.89.106

11:49:26 Collections IP-BLOCK 213.163.89.106

11:49:38 Collections IP-BLOCK 213.163.89.106

11:49:41 Collections IP-BLOCK 213.163.89.106

11:49:47 Collections IP-BLOCK 213.163.89.106

11:49:59 Collections IP-BLOCK 213.163.89.107

11:50:02 Collections IP-BLOCK 213.163.89.107

11:50:08 Collections IP-BLOCK 213.163.89.107

11:50:21 Collections IP-BLOCK 213.163.89.107

11:50:23 Collections IP-BLOCK 213.163.89.107

11:50:30 Collections IP-BLOCK 213.163.89.107

11:50:42 Collections IP-BLOCK 213.163.89.105

11:50:45 Collections IP-BLOCK 213.163.89.105

11:50:51 Collections IP-BLOCK 213.163.89.105

11:54:52 Collections IP-BLOCK 213.163.89.104

11:54:55 Collections IP-BLOCK 213.163.89.104

11:55:01 Collections IP-BLOCK 213.163.89.104

12:14:13 Collections IP-BLOCK 213.163.89.104

12:14:16 Collections IP-BLOCK 213.163.89.104

12:14:22 Collections IP-BLOCK 213.163.89.104

12:25:22 Collections IP-BLOCK 213.163.89.106

12:25:25 Collections IP-BLOCK 213.163.89.106

12:25:31 Collections IP-BLOCK 213.163.89.106

12:25:43 Collections IP-BLOCK 213.163.89.106

12:25:45 Collections IP-BLOCK 61.61.20.132

12:25:46 Collections IP-BLOCK 213.163.89.106

12:25:48 Collections IP-BLOCK 61.61.20.132

12:25:52 Collections IP-BLOCK 213.163.89.106

12:25:54 Collections IP-BLOCK 61.61.20.132

12:26:05 Collections IP-BLOCK 213.163.89.107

12:26:08 Collections IP-BLOCK 213.163.89.107

12:26:14 Collections IP-BLOCK 213.163.89.107

12:26:27 Collections IP-BLOCK 213.163.89.107

12:26:30 Collections IP-BLOCK 213.163.89.107

12:26:36 Collections IP-BLOCK 213.163.89.107

12:26:48 Collections IP-BLOCK 213.163.89.105

12:26:51 Collections IP-BLOCK 213.163.89.105

12:26:57 Collections IP-BLOCK 213.163.89.105

12:34:31 Collections IP-BLOCK 91.212.226.7

12:34:34 Collections IP-BLOCK 91.212.226.7

12:34:38 Collections IP-BLOCK 91.212.226.7

12:34:39 Collections IP-BLOCK 91.212.226.7

12:34:40 Collections IP-BLOCK 91.212.226.7

12:34:41 Collections IP-BLOCK 91.212.226.7

12:41:34 Collections IP-BLOCK 213.163.89.104

12:41:37 Collections IP-BLOCK 213.163.89.104

12:41:43 Collections IP-BLOCK 213.163.89.104

12:43:58 Collections MESSAGE Protection started successfully

12:44:02 Collections MESSAGE IP Protection started successfully

12:48:14 Collections IP-BLOCK 91.212.226.7

12:48:17 Collections IP-BLOCK 91.212.226.7

12:48:23 Collections IP-BLOCK 91.212.226.7

12:53:14 Collections IP-BLOCK 213.163.89.104

12:53:17 Collections IP-BLOCK 213.163.89.104

12:53:23 Collections IP-BLOCK 213.163.89.104

13:08:35 Collections IP-BLOCK 213.163.89.104

13:08:38 Collections IP-BLOCK 213.163.89.104

13:08:44 Collections IP-BLOCK 213.163.89.104

13:42:56 Collections IP-BLOCK 213.163.89.104

13:42:59 Collections IP-BLOCK 213.163.89.104

13:43:05 Collections IP-BLOCK 213.163.89.104

13:46:04 Collections IP-BLOCK 91.212.226.7

13:46:07 Collections IP-BLOCK 91.212.226.7

13:46:13 Collections IP-BLOCK 91.212.226.7

13:58:53 Collections MESSAGE Protection started successfully

13:58:59 Collections MESSAGE IP Protection started successfully

14:03:10 Collections IP-BLOCK 91.212.226.7

14:03:13 Collections IP-BLOCK 91.212.226.7

14:03:19 Collections IP-BLOCK 91.212.226.7

14:08:10 Collections IP-BLOCK 213.163.89.104

14:08:13 Collections IP-BLOCK 213.163.89.104

14:08:19 Collections IP-BLOCK 213.163.89.104

14:33:35 Collections IP-BLOCK 213.163.89.104

14:33:38 Collections IP-BLOCK 213.163.89.104

14:33:44 Collections IP-BLOCK 213.163.89.104

14:40:57 Collections IP-BLOCK 213.163.89.104

14:41:00 Collections IP-BLOCK 213.163.89.104

14:41:06 Collections IP-BLOCK 213.163.89.104

14:47:19 Collections IP-BLOCK 213.163.89.104

14:47:22 Collections IP-BLOCK 213.163.89.104

14:47:28 Collections IP-BLOCK 213.163.89.104

15:20:40 Collections IP-BLOCK 213.163.89.104

15:20:43 Collections IP-BLOCK 213.163.89.104

15:20:49 Collections IP-BLOCK 213.163.89.104

15:50:01 Collections IP-BLOCK 213.163.89.104

15:50:05 Collections IP-BLOCK 213.163.89.104

15:50:11 Collections IP-BLOCK 213.163.89.104

16:06:10 Collections IP-BLOCK 91.212.226.7

16:06:13 Collections IP-BLOCK 91.212.226.7

16:06:19 Collections IP-BLOCK 91.212.226.7

16:14:24 Collections IP-BLOCK 213.163.89.104

16:14:27 Collections IP-BLOCK 213.163.89.104

16:14:33 Collections IP-BLOCK 213.163.89.104

16:27:46 Collections IP-BLOCK 213.163.89.104

16:27:49 Collections IP-BLOCK 213.163.89.104

16:27:55 Collections IP-BLOCK 213.163.89.104

16:58:48 Collections MESSAGE Protection started successfully

16:59:30 Collections MESSAGE IP Protection started successfully

17:03:10 Collections IP-BLOCK 91.212.226.7

17:03:13 Collections IP-BLOCK 91.212.226.7

17:03:19 Collections IP-BLOCK 91.212.226.7

17:08:06 Collections IP-BLOCK 213.163.89.104

17:08:09 Collections IP-BLOCK 213.163.89.104

17:08:15 Collections IP-BLOCK 213.163.89.104

17:19:28 Collections IP-BLOCK 213.163.89.104

17:19:31 Collections IP-BLOCK 213.163.89.104

17:19:37 Collections IP-BLOCK 213.163.89.104

17:51:51 Collections IP-BLOCK 213.163.89.104

17:51:54 Collections IP-BLOCK 213.163.89.104

17:52:00 Collections IP-BLOCK 213.163.89.104

18:15:14 Collections IP-BLOCK 213.163.89.104

18:15:17 Collections IP-BLOCK 213.163.89.104

18:15:23 Collections IP-BLOCK 213.163.89.104

18:40:39 Collections IP-BLOCK 213.163.89.104

18:40:42 Collections IP-BLOCK 213.163.89.104

18:40:48 Collections IP-BLOCK 213.163.89.104

18:55:02 Collections IP-BLOCK 213.163.89.104

18:55:05 Collections IP-BLOCK 213.163.89.104

18:55:11 Collections IP-BLOCK 213.163.89.104

19:21:24 Collections IP-BLOCK 213.163.89.104

19:21:27 Collections IP-BLOCK 213.163.89.104

19:21:33 Collections IP-BLOCK 213.163.89.104

19:41:46 Collections IP-BLOCK 213.163.89.104

19:41:49 Collections IP-BLOCK 213.163.89.104

19:41:55 Collections IP-BLOCK 213.163.89.104

19:58:10 Collections IP-BLOCK 213.163.89.104

19:58:13 Collections IP-BLOCK 213.163.89.104

19:58:19 Collections IP-BLOCK 213.163.89.104

20:04:20 Collections IP-BLOCK 61.61.20.132

20:04:23 Collections IP-BLOCK 61.61.20.132

20:04:29 Collections IP-BLOCK 61.61.20.132

20:20:32 Collections IP-BLOCK 213.163.89.104

20:20:35 Collections IP-BLOCK 213.163.89.104

20:20:42 Collections IP-BLOCK 213.163.89.104

20:47:57 Collections IP-BLOCK 213.163.89.104

20:48:00 Collections IP-BLOCK 213.163.89.104

20:48:06 Collections IP-BLOCK 213.163.89.104

21:04:43 Collections IP-BLOCK 61.61.20.132

21:04:46 Collections IP-BLOCK 61.61.20.132

21:04:52 Collections IP-BLOCK 61.61.20.132

21:14:18 Collections IP-BLOCK 213.163.89.104

21:14:21 Collections IP-BLOCK 213.163.89.104

21:14:27 Collections IP-BLOCK 213.163.89.104

21:32:44 Collections IP-BLOCK 213.163.89.104

21:32:47 Collections IP-BLOCK 213.163.89.104

21:32:53 Collections IP-BLOCK 213.163.89.104

22:05:07 Collections IP-BLOCK 91.212.226.6

22:05:10 Collections IP-BLOCK 91.212.226.6

22:05:16 Collections IP-BLOCK 91.212.226.6

22:05:29 Collections IP-BLOCK 213.163.89.104

22:05:31 Collections IP-BLOCK 213.163.89.104

22:05:37 Collections IP-BLOCK 213.163.89.104

22:33:50 Collections IP-BLOCK 213.163.89.104

22:33:53 Collections IP-BLOCK 213.163.89.104

22:33:59 Collections IP-BLOCK 213.163.89.104

22:42:15 Collections IP-BLOCK 213.163.89.104

22:42:18 Collections IP-BLOCK 213.163.89.104

22:42:24 Collections IP-BLOCK 213.163.89.104

23:00:37 Collections IP-BLOCK 213.163.89.104

23:00:40 Collections IP-BLOCK 213.163.89.104

23:00:46 Collections IP-BLOCK 213.163.89.104

23:05:31 Collections IP-BLOCK 91.212.226.7

23:05:34 Collections IP-BLOCK 91.212.226.7

23:05:40 Collections IP-BLOCK 91.212.226.7

23:23:01 Collections IP-BLOCK 213.163.89.104

23:23:04 Collections IP-BLOCK 213.163.89.104

23:23:10 Collections IP-BLOCK 213.163.89.104

23:53:26 Collections IP-BLOCK 213.163.89.104

23:53:29 Collections IP-BLOCK 213.163.89.104

23:53:35 Collections IP-BLOCK 213.163.89.104

ark.txt

Attach.zip

Link to post
Share on other sites

Hello Martymfla! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

  • The process of cleaning your system may take some time, so please be patient.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • If you don't know or can't understand something please ask.
  • Do not install or uninstall any software or hardware, while work on.

Step 1:

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location and post it back when you reply
    Then look for the following Java folders and if found delete them.
    C:\Program Files\Java
    C:\Program Files\Common Files\Java
    C:\Windows\Sun
    C:\Documents and Settings\All Users\Application Data\Java
    C:\Documents and Settings\All Users\Application Data\Sun\Java
    C:\Documents and Settings\username\Application Data\Java
    C:\Documents and Settings\username\Application Data\Sun\Java

Step 2:

I also see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.


  • Viewpoint
  • Viewpoint Manager
  • Viewpoint Media Player

Step 3:

  • Launch Malwarebytes' Anti-Malware
  • Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  • Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

  1. JavaRa log
  2. MalwareBytes' Anti-Malware log
  3. a new fresh DDS log only

Link to post
Share on other sites

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed May 19 09:50:24 2010

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

------------------------------------

Finished reporting.

MalWarebyte's log: (Note: It removed Trojan Dropper & Trojan.Fraudpack to Quarantine)

00:02:48 Collections IP-BLOCK 213.163.89.104

00:02:51 Collections IP-BLOCK 213.163.89.104

00:02:57 Collections IP-BLOCK 213.163.89.104

00:19:11 Collections IP-BLOCK 213.163.89.104

00:19:14 Collections IP-BLOCK 213.163.89.104

00:19:20 Collections IP-BLOCK 213.163.89.104

00:34:35 Collections IP-BLOCK 213.163.89.104

00:34:38 Collections IP-BLOCK 213.163.89.104

00:34:44 Collections IP-BLOCK 213.163.89.104

00:45:56 Collections IP-BLOCK 213.163.89.104

00:46:00 Collections IP-BLOCK 213.163.89.104

00:46:06 Collections IP-BLOCK 213.163.89.104

00:56:18 Collections IP-BLOCK 213.163.89.104

00:56:21 Collections IP-BLOCK 213.163.89.104

00:56:27 Collections IP-BLOCK 213.163.89.104

01:05:53 Collections IP-BLOCK 91.212.226.7

01:05:56 Collections IP-BLOCK 91.212.226.7

01:06:02 Collections IP-BLOCK 91.212.226.7

01:16:40 Collections IP-BLOCK 213.163.89.104

01:16:43 Collections IP-BLOCK 213.163.89.104

01:16:49 Collections IP-BLOCK 213.163.89.104

01:39:03 Collections IP-BLOCK 213.163.89.104

01:39:06 Collections IP-BLOCK 213.163.89.104

01:39:12 Collections IP-BLOCK 213.163.89.104

01:51:28 Collections IP-BLOCK 213.163.89.104

01:51:31 Collections IP-BLOCK 213.163.89.104

01:51:37 Collections IP-BLOCK 213.163.89.104

02:13:51 Collections IP-BLOCK 213.163.89.104

02:13:54 Collections IP-BLOCK 213.163.89.104

02:14:00 Collections IP-BLOCK 213.163.89.104

02:34:17 Collections IP-BLOCK 213.163.89.104

02:34:20 Collections IP-BLOCK 213.163.89.104

02:34:26 Collections IP-BLOCK 213.163.89.104

02:51:40 Collections IP-BLOCK 213.163.89.104

02:51:43 Collections IP-BLOCK 213.163.89.104

02:51:49 Collections IP-BLOCK 213.163.89.104

03:15:04 Collections IP-BLOCK 213.163.89.104

03:15:07 Collections IP-BLOCK 213.163.89.104

03:15:13 Collections IP-BLOCK 213.163.89.104

03:30:26 Collections IP-BLOCK 213.163.89.104

03:30:29 Collections IP-BLOCK 213.163.89.104

03:30:35 Collections IP-BLOCK 213.163.89.104

03:49:49 Collections IP-BLOCK 213.163.89.104

03:49:52 Collections IP-BLOCK 213.163.89.104

03:49:58 Collections IP-BLOCK 213.163.89.104

04:07:05 Collections IP-BLOCK 61.61.20.132

04:07:08 Collections IP-BLOCK 61.61.20.132

04:07:14 Collections IP-BLOCK 61.61.20.132

04:12:11 Collections IP-BLOCK 213.163.89.104

04:12:14 Collections IP-BLOCK 213.163.89.104

04:12:20 Collections IP-BLOCK 213.163.89.104

04:45:35 Collections IP-BLOCK 213.163.89.104

04:45:38 Collections IP-BLOCK 213.163.89.104

04:45:44 Collections IP-BLOCK 213.163.89.104

04:50:57 Collections IP-BLOCK 213.163.89.104

04:50:59 Collections IP-BLOCK 213.163.89.104

04:51:05 Collections IP-BLOCK 213.163.89.104

05:04:19 Collections IP-BLOCK 213.163.89.104

05:04:22 Collections IP-BLOCK 213.163.89.104

05:04:28 Collections IP-BLOCK 213.163.89.104

05:07:27 Collections IP-BLOCK 61.61.20.132

05:07:30 Collections IP-BLOCK 61.61.20.132

05:07:36 Collections IP-BLOCK 61.61.20.132

05:25:42 Collections IP-BLOCK 213.163.89.104

05:25:45 Collections IP-BLOCK 213.163.89.104

05:25:51 Collections IP-BLOCK 213.163.89.104

05:36:05 Collections IP-BLOCK 213.163.89.104

05:36:08 Collections IP-BLOCK 213.163.89.104

05:36:14 Collections IP-BLOCK 213.163.89.104

05:57:30 Collections IP-BLOCK 213.163.89.104

05:57:33 Collections IP-BLOCK 213.163.89.104

05:57:39 Collections IP-BLOCK 213.163.89.104

06:07:52 Collections IP-BLOCK 91.212.226.6

06:07:55 Collections IP-BLOCK 91.212.226.6

06:08:01 Collections IP-BLOCK 91.212.226.6

06:15:52 Collections IP-BLOCK 213.163.89.104

06:15:55 Collections IP-BLOCK 213.163.89.104

06:16:01 Collections IP-BLOCK 213.163.89.104

06:30:15 Collections IP-BLOCK 213.163.89.104

06:30:18 Collections IP-BLOCK 213.163.89.104

06:30:24 Collections IP-BLOCK 213.163.89.104

06:41:36 Collections IP-BLOCK 213.163.89.104

06:41:39 Collections IP-BLOCK 213.163.89.104

06:41:45 Collections IP-BLOCK 213.163.89.104

06:49:59 Collections IP-BLOCK 213.163.89.104

06:50:02 Collections IP-BLOCK 213.163.89.104

06:50:08 Collections IP-BLOCK 213.163.89.104

07:04:22 Collections IP-BLOCK 213.163.89.104

07:04:25 Collections IP-BLOCK 213.163.89.104

07:04:31 Collections IP-BLOCK 213.163.89.104

07:08:15 Collections IP-BLOCK 91.212.226.7

07:08:18 Collections IP-BLOCK 91.212.226.7

07:08:24 Collections IP-BLOCK 91.212.226.7

07:18:44 Collections IP-BLOCK 213.163.89.104

07:18:47 Collections IP-BLOCK 213.163.89.104

07:18:53 Collections IP-BLOCK 213.163.89.104

07:51:07 Collections IP-BLOCK 213.163.89.104

07:51:10 Collections IP-BLOCK 213.163.89.104

07:51:16 Collections IP-BLOCK 213.163.89.104

08:19:30 Collections IP-BLOCK 213.163.89.104

08:19:32 Collections IP-BLOCK 213.163.89.104

08:19:39 Collections IP-BLOCK 213.163.89.104

08:32:15 Collections MESSAGE Protection started successfully

08:32:19 Collections MESSAGE IP Protection started successfully

08:35:12 Collections IP-BLOCK 91.212.226.7

08:35:15 Collections IP-BLOCK 91.212.226.7

08:35:21 Collections IP-BLOCK 91.212.226.7

08:40:12 Collections IP-BLOCK 213.163.89.104

08:40:15 Collections IP-BLOCK 213.163.89.104

08:40:21 Collections IP-BLOCK 213.163.89.104

08:42:33 Collections IP-BLOCK 91.212.226.7

08:42:36 Collections IP-BLOCK 91.212.226.7

08:42:42 Collections IP-BLOCK 91.212.226.7

08:44:52 Collections MESSAGE IP Protection stopped

08:45:13 Collections MESSAGE Database updated successfully

08:45:14 Collections MESSAGE IP Protection started successfully

08:50:46 Collections IP-BLOCK 213.163.89.106

08:50:49 Collections IP-BLOCK 213.163.89.106

08:50:55 Collections IP-BLOCK 213.163.89.106

08:51:07 Collections IP-BLOCK 213.163.89.106

08:51:10 Collections IP-BLOCK 213.163.89.106

08:51:16 Collections IP-BLOCK 213.163.89.106

08:51:30 Collections IP-BLOCK 213.163.89.107

08:51:33 Collections IP-BLOCK 213.163.89.107

08:51:39 Collections IP-BLOCK 213.163.89.107

08:51:52 Collections IP-BLOCK 213.163.89.107

08:51:55 Collections IP-BLOCK 213.163.89.107

08:52:01 Collections IP-BLOCK 213.163.89.107

08:52:13 Collections IP-BLOCK 213.163.89.105

08:52:16 Collections IP-BLOCK 213.163.89.105

08:52:23 Collections IP-BLOCK 213.163.89.105

08:55:12 Collections IP-BLOCK 213.163.89.106

08:55:15 Collections IP-BLOCK 213.163.89.106

08:55:21 Collections IP-BLOCK 213.163.89.106

08:55:33 Collections IP-BLOCK 213.163.89.106

08:55:37 Collections IP-BLOCK 213.163.89.106

08:55:43 Collections IP-BLOCK 213.163.89.106

08:55:55 Collections IP-BLOCK 213.163.89.107

08:55:58 Collections IP-BLOCK 213.163.89.107

08:56:04 Collections IP-BLOCK 213.163.89.107

08:56:16 Collections IP-BLOCK 213.163.89.107

08:56:19 Collections IP-BLOCK 213.163.89.107

08:56:25 Collections IP-BLOCK 213.163.89.107

08:56:37 Collections IP-BLOCK 213.163.89.105

08:56:40 Collections IP-BLOCK 213.163.89.105

08:56:46 Collections IP-BLOCK 213.163.89.105

08:58:50 Collections IP-BLOCK 213.163.89.106

08:58:54 Collections IP-BLOCK 213.163.89.106

08:59:00 Collections IP-BLOCK 213.163.89.106

08:59:12 Collections IP-BLOCK 213.163.89.106

08:59:15 Collections IP-BLOCK 213.163.89.106

08:59:21 Collections IP-BLOCK 213.163.89.106

08:59:33 Collections IP-BLOCK 213.163.89.107

08:59:36 Collections IP-BLOCK 213.163.89.107

08:59:42 Collections IP-BLOCK 213.163.89.107

08:59:54 Collections IP-BLOCK 213.163.89.107

08:59:57 Collections IP-BLOCK 213.163.89.107

09:00:03 Collections IP-BLOCK 213.163.89.107

09:00:15 Collections IP-BLOCK 213.163.89.105

09:00:18 Collections IP-BLOCK 213.163.89.105

09:00:24 Collections IP-BLOCK 213.163.89.105

09:11:33 Collections IP-BLOCK 213.163.89.104

09:11:36 Collections IP-BLOCK 213.163.89.104

09:11:42 Collections IP-BLOCK 213.163.89.104

09:13:46 Collections IP-BLOCK 213.163.89.106

09:13:49 Collections IP-BLOCK 213.163.89.106

09:13:55 Collections IP-BLOCK 213.163.89.106

09:14:07 Collections IP-BLOCK 213.163.89.106

09:14:10 Collections IP-BLOCK 213.163.89.106

09:14:16 Collections IP-BLOCK 213.163.89.106

09:14:28 Collections IP-BLOCK 213.163.89.106

09:14:31 Collections IP-BLOCK 213.163.89.106

09:14:37 Collections IP-BLOCK 213.163.89.106

09:14:49 Collections IP-BLOCK 213.163.89.106

09:14:52 Collections IP-BLOCK 213.163.89.106

09:14:58 Collections IP-BLOCK 213.163.89.106

09:15:10 Collections IP-BLOCK 213.163.89.107

09:15:14 Collections IP-BLOCK 213.163.89.107

09:15:20 Collections IP-BLOCK 213.163.89.107

09:15:32 Collections IP-BLOCK 213.163.89.107

09:15:35 Collections IP-BLOCK 213.163.89.107

09:15:41 Collections IP-BLOCK 213.163.89.107

09:15:54 Collections IP-BLOCK 213.163.89.107

09:15:57 Collections IP-BLOCK 213.163.89.107

09:16:03 Collections IP-BLOCK 213.163.89.107

09:16:15 Collections IP-BLOCK 213.163.89.107

09:16:18 Collections IP-BLOCK 213.163.89.107

09:16:24 Collections IP-BLOCK 213.163.89.107

09:16:36 Collections IP-BLOCK 213.163.89.105

09:16:39 Collections IP-BLOCK 213.163.89.105

09:16:45 Collections IP-BLOCK 213.163.89.105

09:16:57 Collections IP-BLOCK 213.163.89.105

09:17:00 Collections IP-BLOCK 213.163.89.105

09:17:06 Collections IP-BLOCK 213.163.89.105

09:18:50 Collections IP-BLOCK 213.163.89.106

09:18:53 Collections IP-BLOCK 213.163.89.106

09:19:00 Collections IP-BLOCK 213.163.89.106

09:19:12 Collections IP-BLOCK 213.163.89.106

09:19:14 Collections IP-BLOCK 213.163.89.106

09:19:21 Collections IP-BLOCK 213.163.89.106

09:19:33 Collections IP-BLOCK 213.163.89.107

09:19:36 Collections IP-BLOCK 213.163.89.107

09:19:42 Collections IP-BLOCK 213.163.89.107

09:19:54 Collections IP-BLOCK 213.163.89.107

09:19:57 Collections IP-BLOCK 213.163.89.107

09:20:03 Collections IP-BLOCK 213.163.89.107

09:20:06 Collections IP-BLOCK 213.163.89.106

09:20:09 Collections IP-BLOCK 213.163.89.106

09:20:15 Collections IP-BLOCK 213.163.89.106

09:20:15 Collections IP-BLOCK 213.163.89.105

09:20:18 Collections IP-BLOCK 213.163.89.105

09:20:24 Collections IP-BLOCK 213.163.89.105

09:20:27 Collections IP-BLOCK 213.163.89.106

09:20:30 Collections IP-BLOCK 213.163.89.106

09:20:36 Collections IP-BLOCK 213.163.89.106

09:20:48 Collections IP-BLOCK 213.163.89.106

09:20:51 Collections IP-BLOCK 213.163.89.106

09:20:57 Collections IP-BLOCK 213.163.89.106

09:21:09 Collections IP-BLOCK 213.163.89.106

09:21:12 Collections IP-BLOCK 213.163.89.106

09:21:18 Collections IP-BLOCK 213.163.89.106

09:21:30 Collections IP-BLOCK 213.163.89.106

09:21:33 Collections IP-BLOCK 213.163.89.106

09:21:39 Collections IP-BLOCK 213.163.89.106

09:21:51 Collections IP-BLOCK 213.163.89.106

09:21:54 Collections IP-BLOCK 213.163.89.106

09:22:01 Collections IP-BLOCK 213.163.89.106

09:22:13 Collections IP-BLOCK 213.163.89.106

09:22:16 Collections IP-BLOCK 213.163.89.106

09:22:22 Collections IP-BLOCK 213.163.89.106

09:22:34 Collections IP-BLOCK 213.163.89.107

09:22:37 Collections IP-BLOCK 213.163.89.107

09:22:43 Collections IP-BLOCK 213.163.89.107

09:22:55 Collections IP-BLOCK 213.163.89.106

09:22:58 Collections IP-BLOCK 213.163.89.106

09:23:04 Collections IP-BLOCK 213.163.89.106

09:23:16 Collections IP-BLOCK 213.163.89.107

09:23:19 Collections IP-BLOCK 213.163.89.107

09:23:25 Collections IP-BLOCK 213.163.89.107

09:23:37 Collections IP-BLOCK 213.163.89.107

09:23:40 Collections IP-BLOCK 213.163.89.107

09:23:46 Collections IP-BLOCK 213.163.89.107

09:23:58 Collections IP-BLOCK 213.163.89.107

09:24:01 Collections IP-BLOCK 213.163.89.107

09:24:07 Collections IP-BLOCK 213.163.89.107

09:24:20 Collections IP-BLOCK 213.163.89.107

09:24:23 Collections IP-BLOCK 213.163.89.107

09:24:29 Collections IP-BLOCK 213.163.89.107

09:24:41 Collections IP-BLOCK 213.163.89.107

09:24:44 Collections IP-BLOCK 213.163.89.107

09:24:50 Collections IP-BLOCK 213.163.89.107

09:24:54 Collections IP-BLOCK 213.163.89.104

09:24:57 Collections IP-BLOCK 213.163.89.104

09:25:02 Collections IP-BLOCK 213.163.89.107

09:25:03 Collections IP-BLOCK 213.163.89.104

09:25:05 Collections IP-BLOCK 213.163.89.107

09:25:11 Collections IP-BLOCK 213.163.89.107

09:25:23 Collections IP-BLOCK 213.163.89.105

09:25:26 Collections IP-BLOCK 213.163.89.105

09:25:32 Collections IP-BLOCK 213.163.89.105

09:25:44 Collections IP-BLOCK 213.163.89.107

09:25:47 Collections IP-BLOCK 213.163.89.107

09:25:54 Collections IP-BLOCK 213.163.89.107

09:26:06 Collections IP-BLOCK 213.163.89.105

09:26:09 Collections IP-BLOCK 213.163.89.105

09:26:15 Collections IP-BLOCK 213.163.89.105

09:26:27 Collections IP-BLOCK 213.163.89.105

09:26:30 Collections IP-BLOCK 213.163.89.105

09:26:36 Collections IP-BLOCK 213.163.89.105

09:26:48 Collections IP-BLOCK 213.163.89.105

09:26:51 Collections IP-BLOCK 213.163.89.105

09:26:57 Collections IP-BLOCK 213.163.89.105

09:55:36 Collections MESSAGE IP Protection stopped

09:55:57 Collections MESSAGE Database updated successfully

09:55:59 Collections MESSAGE IP Protection started successfully

09:58:15 Collections IP-BLOCK 213.163.89.104

09:58:18 Collections IP-BLOCK 213.163.89.104

09:58:24 Collections IP-BLOCK 213.163.89.104

10:10:36 Collections IP-BLOCK 213.163.89.104

10:10:39 Collections IP-BLOCK 213.163.89.104

10:10:45 Collections IP-BLOCK 213.163.89.104

10:15:29 Collections MESSAGE Protection started successfully

10:15:41 Collections MESSAGE IP Protection started successfully

10:19:51 Collections IP-BLOCK 91.212.226.7

10:19:54 Collections IP-BLOCK 91.212.226.7

10:20:00 Collections IP-BLOCK 91.212.226.7

New DDS Log follows:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Collections at 10:16:05.50 on Wed 05/19/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1483 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Dell Support Center\gs_agent\dsc.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Dell Network Assistant\hnm_svc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Documents and Settings\Collections\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uInternet Connection Wizard,ShellNext = iexplore

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

TB: AT&&T Toolbar: {4e7bd74f-2b8d-469e-94be-fd60bb9aae29} - c:\progra~1\atttoo~1\ATTTOO~1.DLL

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Alcmtr] ALCMTR.EXE

mRun: [dellsupportcenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P dellsupportcenter

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {E59EB121-F339-4851-A3BA-FE49C35617C2} - c:\program files\icq6.5\ICQ.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {106E49CF-797A-11D2-81A2-00E02C015623} - hxxp://www.alternatiff.com/install-ie/alttiff.cab

DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://webcam.ci.schaumburg.il.us/activex/AxisCamControl.cab

DPF: {C9E2242D-DC05-4C54-9483-A5C90653F7BC} - hxxps://techinline.net/Client/TIClient.cab

DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

DPF: {F91AB7B8-EE67-42AF-A5AA-8E232C396A04} - hxxps://creditcommander.microbilt.com/cabs/htmlprint.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\collec~1\applic~1\mozilla\firefox\profiles\oz44qyov.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/|http://my.ventech.com/|http://www.bing.com/|http://www.google.com/|http://www.woot.com/|http://www.velonews.com/

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-18 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-18 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-18 267432]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-18 60936]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-1-25 304464]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-1-25 20952]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-23 133104]

S3 B-Service;B-Service;c:\documents and settings\collections\application data\mikogo\B-Service.exe [2009-12-3 185640]

=============== Created Last 30 ================

2010-05-18 17:56:29 0 ----a-w- c:\documents and settings\collections\defogger_reenable

2010-05-18 12:43:25 0 d-----w- c:\docume~1\collec~1\applic~1\Avira

2010-05-18 12:34:26 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-05-18 12:34:25 0 d-----w- c:\program files\Avira

2010-05-18 12:34:25 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-05-18 12:30:31 0 d-----w- C:\Avira antivirus

2010-05-17 18:17:48 8014 ----a-w- C:\DR. _6429.pdf

2010-05-17 18:15:57 0 d-----w- C:\Currports

2010-04-22 18:32:22 72418 ----a-w- C:\Keable Lien.pdf

2010-04-21 19:19:51 13846 ----a-w- C:\cashflow 11 months March 2010.xls

==================== Find3M ====================

2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll

2010-02-25 15:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-02-24 09:54:25 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-02-19 23:47:50 3604480 ----a-w- c:\windows\system32\GPhotos.scr

2008-11-10 14:28:12 53796 ----a-w- c:\program files\INSTALL.LOG

============= FINISH: 10:18:38.39 ===============

Thanks

Link to post
Share on other sites

Sorry about that. Was looking for the log, didn't realize there were two.

Thanks you.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4117

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/19/2010 10:12:53 AM

mbam-log-2010-05-19 (10-12-53).txt

Scan type: Quick scan

Objects scanned: 200159

Time elapsed: 10 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\msihost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Collections\Local Settings\Temp\Dwx.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Link to post
Share on other sites

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  1. If you are using Firefox, make sure that your download settings are as follows:
    • Open Tools -> Options -> Main tab
    • Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

CF_download_FF.gif

CF_download_rename.gif

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    -----------------------------------------------------------


  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Link to post
Share on other sites

Some things were found:

Virus scan

Avira AntiVir Personal

Report file date: Wednesday, May 19, 2010 13:32

Scanning for 2136678 virus strains and unwanted programs.

The program is running as an unrestricted full version.

Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : DHS1D7F1

Version information:

BUILD.DAT : 10.0.0.567 32097 Bytes 4/19/2010 15:07:00

AVSCAN.EXE : 10.0.3.0 433832 Bytes 4/1/2010 17:37:38

AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2010 17:57:04

LUKE.DLL : 10.0.2.3 104296 Bytes 3/7/2010 23:33:04

LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49

VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36

VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 00:27:49

VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 22:37:42

VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 21:37:42

VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 16:29:03

VBASE005.VDF : 7.10.6.82 2494464 Bytes 4/15/2010 12:37:54

VBASE006.VDF : 7.10.6.83 2048 Bytes 4/15/2010 12:37:54

VBASE007.VDF : 7.10.6.84 2048 Bytes 4/15/2010 12:37:54

VBASE008.VDF : 7.10.6.85 2048 Bytes 4/15/2010 12:37:54

VBASE009.VDF : 7.10.6.86 2048 Bytes 4/15/2010 12:37:55

VBASE010.VDF : 7.10.6.87 2048 Bytes 4/15/2010 12:37:55

VBASE011.VDF : 7.10.6.88 2048 Bytes 4/15/2010 12:37:55

VBASE012.VDF : 7.10.6.89 2048 Bytes 4/15/2010 12:37:55

VBASE013.VDF : 7.10.6.90 2048 Bytes 4/15/2010 12:37:55

VBASE014.VDF : 7.10.6.123 126464 Bytes 4/19/2010 12:37:56

VBASE015.VDF : 7.10.6.152 123392 Bytes 4/21/2010 12:37:57

VBASE016.VDF : 7.10.6.178 122880 Bytes 4/22/2010 12:37:58

VBASE017.VDF : 7.10.6.206 120320 Bytes 4/26/2010 12:37:59

VBASE018.VDF : 7.10.6.232 99328 Bytes 4/28/2010 12:38:00

VBASE019.VDF : 7.10.7.2 155648 Bytes 4/30/2010 12:38:02

VBASE020.VDF : 7.10.7.26 119808 Bytes 5/4/2010 12:38:03

VBASE021.VDF : 7.10.7.51 118272 Bytes 5/6/2010 12:38:04

VBASE022.VDF : 7.10.7.75 404992 Bytes 5/10/2010 12:38:08

VBASE023.VDF : 7.10.7.100 125440 Bytes 5/13/2010 12:38:09

VBASE024.VDF : 7.10.7.119 177664 Bytes 5/17/2010 12:38:10

VBASE025.VDF : 7.10.7.120 2048 Bytes 5/17/2010 12:38:10

VBASE026.VDF : 7.10.7.121 2048 Bytes 5/17/2010 12:38:11

VBASE027.VDF : 7.10.7.122 2048 Bytes 5/17/2010 12:38:11

VBASE028.VDF : 7.10.7.123 2048 Bytes 5/17/2010 12:38:11

VBASE029.VDF : 7.10.7.124 2048 Bytes 5/17/2010 12:38:11

VBASE030.VDF : 7.10.7.125 2048 Bytes 5/17/2010 12:38:12

VBASE031.VDF : 7.10.7.135 123392 Bytes 5/19/2010 17:31:30

Engineversion : 8.2.1.242

AEVDF.DLL : 8.1.2.0 106868 Bytes 5/18/2010 12:38:32

AESCRIPT.DLL : 8.1.3.29 1343866 Bytes 5/18/2010 12:38:31

AESCN.DLL : 8.1.6.1 127347 Bytes 5/18/2010 12:38:29

AESBX.DLL : 8.1.3.1 254324 Bytes 5/18/2010 12:38:33

AERDL.DLL : 8.1.4.6 541043 Bytes 5/18/2010 12:38:28

AEPACK.DLL : 8.2.1.1 426358 Bytes 3/19/2010 17:34:51

AEOFFICE.DLL : 8.1.1.0 201081 Bytes 5/18/2010 12:38:27

AEHEUR.DLL : 8.1.1.27 2670967 Bytes 5/18/2010 12:38:26

AEHELP.DLL : 8.1.11.3 242039 Bytes 4/1/2010 21:05:25

AEGEN.DLL : 8.1.3.9 377203 Bytes 5/18/2010 12:38:18

AEEMU.DLL : 8.1.2.0 393588 Bytes 5/18/2010 12:38:16

AECORE.DLL : 8.1.15.3 192886 Bytes 5/18/2010 12:38:15

AEBB.DLL : 8.1.1.0 53618 Bytes 5/18/2010 12:38:14

AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 17:03:38

AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 17:03:35

AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 21:47:40

AVREG.DLL : 10.0.3.0 53096 Bytes 4/1/2010 17:35:46

AVSCPLR.DLL : 10.0.3.0 83816 Bytes 4/1/2010 17:39:51

AVARKT.DLL : 10.0.0.14 227176 Bytes 4/1/2010 17:22:13

AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 14:53:30

SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 17:57:58

AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 20:38:56

NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 19:41:00

RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 18:10:20

RCTEXT.DLL : 10.0.53.0 97128 Bytes 4/9/2010 19:14:29

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Extended process scan...............: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: Wednesday, May 19, 2010 13:32

Starting search for hidden objects.

HKEY_USERS\S-1-5-21-460463297-704316826-2195380584-1005\Software\Microsoft\Office\12.0\Outlook\Catalog\c:\documents and settings\collections\local settings\application data\microsoft\outlook\outlook.pst

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\RNG\seed

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Search\Gather\Windows\SystemIndex\notificationlogcheckpoint

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\main

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\modules

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\start

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\type

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\group

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\geyekrcofrtofb\group

\systemroot\system32\drivers\geyekrjyxlioak.sys

C:\WINDOWS\system32\drivers\geyekrjyxlioak.sys

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UACd.sys\modules

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UACd.sys\start

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UACd.sys\type

[NOTE] The registry entry is invisible.

\systemroot\system32\drivers\UACrfshxduptxvmlkbik.sys

C:\WINDOWS\system32\drivers\UACrfshxduptxvmlkbik.sys

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet003\Services\NtmsSvc\Config\Standalone\drivelist

[NOTE] The registry entry is invisible.

The scan of running processes will be started

Scan process 'rsmsink.exe' - '31' Module(s) have been scanned

Scan process 'OUTLOOK.EXE' - '117' Module(s) have been scanned

Scan process 'msdtc.exe' - '42' Module(s) have been scanned

Scan process 'dllhost.exe' - '61' Module(s) have been scanned

Scan process 'dllhost.exe' - '47' Module(s) have been scanned

Scan process 'vssvc.exe' - '50' Module(s) have been scanned

Scan process 'avscan.exe' - '72' Module(s) have been scanned

Scan process 'avcenter.exe' - '63' Module(s) have been scanned

Scan process 'mbam.exe' - '48' Module(s) have been scanned

Scan process 'mbamgui.exe' - '26' Module(s) have been scanned

Scan process 'GoogleToolbarNotifier.exe' - '57' Module(s) have been scanned

Scan process 'ctfmon.exe' - '27' Module(s) have been scanned

Scan process 'explorer.exe' - '135' Module(s) have been scanned

Scan process 'alg.exe' - '35' Module(s) have been scanned

Scan process 'SearchIndexer.exe' - '57' Module(s) have been scanned

Scan process 'sprtsvc.exe' - '60' Module(s) have been scanned

Scan process 'McciCMService.exe' - '27' Module(s) have been scanned

Scan process 'mbamservice.exe' - '41' Module(s) have been scanned

Scan process 'avshadow.exe' - '26' Module(s) have been scanned

Scan process 'hnm_svc.exe' - '57' Module(s) have been scanned

Scan process 'avguard.exe' - '53' Module(s) have been scanned

Scan process 'svchost.exe' - '36' Module(s) have been scanned

Scan process 'sched.exe' - '48' Module(s) have been scanned

Scan process 'spoolsv.exe' - '82' Module(s) have been scanned

Scan process 'svchost.exe' - '41' Module(s) have been scanned

Scan process 'svchost.exe' - '34' Module(s) have been scanned

Scan process 'svchost.exe' - '168' Module(s) have been scanned

Scan process 'svchost.exe' - '41' Module(s) have been scanned

Scan process 'svchost.exe' - '55' Module(s) have been scanned

Scan process 'lsass.exe' - '65' Module(s) have been scanned

Scan process 'services.exe' - '27' Module(s) have been scanned

Scan process 'winlogon.exe' - '76' Module(s) have been scanned

Scan process 'csrss.exe' - '14' Module(s) have been scanned

Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '1174' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\Program Files\BellSouth\HelpCenter\ATT_SST_Installer.exe

[0] Archive type: NSIS

--> ProgramFilesDir/MotiveClient.exe

[WARNING] The file could not be written!

C:\Qoobox\Quarantine\C\Documents and Settings\Collections\ATT_SST_Installer.exe.vir

[0] Archive type: NSIS

--> ProgramFilesDir/PreCheck.html

[WARNING] The file could not be written!

[WARNING] The file could not be written!

C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\ws2ifsl.sys.vir

[DETECTION] Is the TR/Patched.Gen Trojan

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061736.exe

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061758.sys

[DETECTION] Is the TR/Patched.Gen Trojan

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061811.exe

[0] Archive type: NSIS

--> ProgramFilesDir/PreCheck.html

[WARNING] The file could not be written!

[WARNING] The file could not be written!

Beginning disinfection:

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061758.sys

[DETECTION] Is the TR/Patched.Gen Trojan

[NOTE] The file was moved to the quarantine directory under the name '470ce7bc.qua'.

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061736.exe

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to the quarantine directory under the name '5f9bc81c.qua'.

C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\ws2ifsl.sys.vir

[DETECTION] Is the TR/Patched.Gen Trojan

[NOTE] The file was moved to the quarantine directory under the name '0dc692b7.qua'.

End of the scan: Wednesday, May 19, 2010 15:58

Used time: 2:25:48 Hour(s)

The scan has been done completely.

11662 Scanned directories

290052 Files were scanned

3 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

3 Files were moved to quarantine

0 Files were renamed

0 Files cannot be scanned

290049 Files not concerned

4695 Archives were scanned

5 Warnings

3 Notes

494673 Objects were scanned with rootkit scan

15 Hidden objects were found

Malware Found 1:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4117

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/19/2010 4:07:19 PM

mbam-log-2010-05-19 (16-07-19).txt

Scan type: Full scan (C:\|)

Objects scanned: 283110

Time elapsed: 2 hour(s), 38 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP517\A0061736.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Good work! :)

Last steps:

Step 1:

* Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Step 2:

Please manually delete DDS, GMER and JavaRa.

Step 3:

Please download and install the latest version of Java from:

www.java.com/en

Step 4:

Some malware preventions:

http://miekiemoes.blogspot.com/2008/02/how...nt-malware.html

Safe surfing! :)

Link to post
Share on other sites

Yes, please enable it:

To enable CD Emulation programs using DeFogger please perform these steps:

  1. Please download DeFogger to your desktop.
  2. Once downloaded, double-click on the DeFogger icon to start the tool.
  3. The application window will now appear. You should now click on the Enable button to enable your CD Emulation drivers
  4. When it prompts you whether or not you want to continue, please click on the Yes button to continue
  5. When the program has completed you will see a Finished! message. Click on the OK button to exit the program.
  6. If CD Emulation programs are present and have been enabled, DeFogger will now ask you to reboot the machine. Please allow it to do so by clicking on the OK button.

Different variants of malware - TDL3, UAcd and so on.

http://www.bleepingcomputer.com/virus-remo...sing-tdsskiller

http://www.myantispyware.com/2009/01/24/ho...uacdsys-trojan/

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.