Tough Virus, Malwarebytes didn't work

[havinabadday]

Hello,

I recently caught a nasty little bug while surfing the internet. Started off as your usual fake antivirus that hijacted my pc. So I tried malwarebytes, which usually never fails, which found several items which it said it quarentined and removed but it must have missed something.

I restarted my pc and now I can't connect to the internet unless I flip to safe mode w/ networking(which doesn't work everytime). Also windows(running XP) looks like an older version like 98, the tool bar is grey and "old" looking for lack of a better word. All of my windows also have that classic windows look.

I'm currently in safe mode. I was able to update Malwarebytes but the updates haven't helped, it continues to find zero infections. I was able to run defogger and dds however GMER runs for a while then my pc either freezes or restarts without warning. I zipped the attach.txt file along with the mbam logs from my inital run(that "caught" the infections), the run right after wards that was the last time anything was caught, and my most recent mbam log.

I would be very grateful for any help that you can provide.

DDS (Ver_10-03-17.01) - NTFSx86 NETWORK

Run by admin at 13:50:32.15 on Mon 05/31/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1490 [GMT -4:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\admin\Desktop\Defogger.exe

C:\Documents and Settings\admin\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0061229

uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=0061229

mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\2.0.301.7164\swg.dll

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [DellSupport] "c:\program files\dell support\DSAgnt.exe" /startup

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [CTHelper] CTHELPER.EXE

mRun: [CTxfiHlp] CTXFIHLP.EXE

mRun: [AudioDrvEmulator] "c:\program files\creative\shared files\module loader\dllml.exe" -1 audiodrvemulator "c:\program files\creative\shared files\module loader\audio emulator\AudDrvEm.dll"

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [DLCXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCXtime.dll,_RunDLLEntry@16

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\firepo~1.lnk - c:\program files\presonus\1394audiodriver_firepod\FIREPOD.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\npjpi150_06.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll

DPF: vzTCPConfig - hxxp://www2.verizon.net/help/fios_settings/include/vzTCPConfig.CAB

DPF: {20722C4E-9050-45C8-8D1A-816C4A06AD90} - hxxp://www.cvsphoto.com/upload/activex/v3_0_0_6/PhotoCenter_ActiveX_Control.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

mASetup: {CC42A8DC-4B7C-1456-8008-37653A19AE93} - c:\program files\winup_64\win_up.exe s

Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-5-31 217032]

S0 eoplkr;eoplkr;c:\windows\system32\drivers\nglv.sys --> c:\windows\system32\drivers\nglv.sys [?]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-5-31 164048]

S1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-28 11608]

S1 SABKUTIL;SABKUTIL;\??\c:\program files\superantispyware\sabkutil.sys --> c:\program files\superantispyware\SABKUTIL.sys [?]

S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-28 135336]

S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-28 267432]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-5-31 19024]

S2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-31 40384]

S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-28 60936]

S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-5-31 112592]

S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\McrdSvc.exe [2005-10-20 96256]

S3 AuviUDTV;AuviUDTV ATSC Capture Device;c:\windows\system32\drivers\AuviUDTV.sys [2009-5-7 754048]

S3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-31 40384]

S3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-5-31 40384]

S3 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-5-31 366840]

S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-5-31 1142224]

S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [2007-1-8 16896]

=============== Created Last 30 ================

2010-05-31 17:50:16 0 ----a-w- c:\documents and settings\admin\defogger_reenable

2010-05-31 15:55:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Alwil Software

2010-05-31 15:53:49 0 d-sh--w- c:\documents and settings\admin\PrivacIE

2010-05-31 15:50:35 882 ----a-w- c:\windows\RegSDImport.xml

2010-05-31 15:50:35 879 ----a-w- c:\windows\RegISSImport.xml

2010-05-31 15:50:35 767952 ----a-w- c:\windows\BDTSupport.dll

2010-05-31 15:50:35 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-05-31 15:50:35 131 ----a-w- c:\windows\IDB.zip

2010-05-31 15:50:34 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-05-31 15:50:34 1652688 ----a-w- c:\windows\PCTBDCore.dll

2010-05-31 15:50:34 1152444 ----a-w- c:\windows\UDB.zip

2010-05-31 15:49:18 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2010-05-31 15:49:18 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-05-31 15:49:15 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-05-31 15:49:15 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2010-05-31 15:49:15 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2010-05-31 15:49:15 217032 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-05-31 15:49:12 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat

2010-05-31 15:49:12 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-05-31 15:49:07 0 d-----w- c:\program files\common files\PC Tools

2010-05-31 15:49:06 0 d-----w- c:\program files\Spyware Doctor

2010-05-31 15:49:06 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools

2010-05-31 15:49:06 0 d-----w- c:\docume~1\admin\applic~1\PC Tools

2010-05-31 15:44:45 0 d-----w- c:\program files\Spybot - Search & Destroy

2010-05-31 15:44:45 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2010-05-31 15:41:24 0 d-----w- c:\program files\Trend Micro

2010-05-31 15:23:59 0 d-----w- c:\docume~1\admin\applic~1\Malwarebytes

2010-05-31 15:23:44 0 d-----w- c:\docume~1\admin\applic~1\Avira

2010-05-31 15:22:51 0 d-----w- c:\docume~1\admin\applic~1\SUPERAntiSpyware.com

2010-05-31 02:36:21 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-05-31 02:32:21 0 d-sh--w- c:\documents and settings\admin\IETldCache

2010-05-31 02:31:54 178 --sh--w- c:\documents and settings\admin\ntuser.ini

2010-05-31 02:05:04 0 d-s---w- C:\Combo123Fix

2010-05-31 01:23:40 98816 ----a-w- c:\windows\sed.exe

2010-05-31 01:23:40 77312 ----a-w- c:\windows\MBR.exe

2010-05-31 01:23:40 256512 ----a-w- c:\windows\PEV.exe

2010-05-31 01:23:40 161792 ----a-w- c:\windows\SWREG.exe

2010-05-28 14:22:57 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2010-05-28 14:22:56 0 d-----w- c:\program files\Avira

2010-05-28 14:22:56 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-05-27 23:23:58 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-05-27 23:23:57 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-05-27 23:23:57 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-27 02:26:15 0 d-----w- c:\program files\SUPERAntiSpyware

2010-05-17 23:29:06 0 d-----w- c:\program files\iPod

2010-05-17 23:24:50 0 d-----w- c:\program files\Bonjour

==================== Find3M ====================

2010-04-08 17:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-04-08 17:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll

2010-03-06 19:51:39 63284 ---ha-w- c:\windows\system32\mlfcache.dat

2010-03-06 16:10:42 5852 --sha-w- c:\windows\system32\KGyGaAvL.sys

2008-09-19 00:18:55 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091820080919\index.dat

============= FINISH: 13:52:05.60 ===============

Attach.zip

[Blade81]

Hi,

ComboFix shouldn't had been run without supervision. Post back contents of current (don't re-run) c:\ComboFix.txt file.

[havinabadday]

Hi,

ComboFix shouldn't had been run without supervision. Post back contents of current (don't re-run) c:\ComboFix.txt file.

Hi, sorry about that, I d/led as many things as possible while my internet was working in hopes of having it on hand, I let the frustration get the better of me and I realize I shouldn't have run combo fix. I don't have a c:\combofix.txt file unfortunately. There appears to be a folder on my c:\ drive named combo123fix(I renamed the program upon d/l) but it contains a copy of my existing folders. If I do need to rerun combofix please let me know if I need to take any other steps before hand(ie run defogger, I had run it for dds/gmer but don't see the window anymore btw).

Please let me know what you'd like me to do and I'll follow it to the letter. I am leaving for work soon but I will respond as soon as I can this evening.

thank you so much for your assistance.

[havinabadday]

Hi,

ComboFix shouldn't had been run without supervision. Post back contents of current (don't re-run) c:\ComboFix.txt file.

Hi, sorry about that, I d/led as many things as possible while my internet was working in hopes of having it on hand, I let the frustration get the better of me and I realize I shouldn't have run combo fix. I don't have a c:\combofix.txt file unfortunately. There appears to be a folder on my c:\ drive named combo123fix(I renamed the program upon d/l) but it contains a copy of my existing folders. If I do need to rerun combofix please let me know if I need to take any other steps before hand(ie run defogger, I had run it for dds/gmer but don't see the window anymore btw).

Please let me know what you'd like me to do and I'll follow it to the letter. I am leaving for work soon but I will respond as soon as I can this evening.

thank you so much for your assistance.

[Blade81]

Hi,

Uninstall Antivir or Avast first (it's recommended to have one antivirus product installed and running only). Then disable all installed protection software before running fresh version of ComboFix again. Post back its report & fresh dds log.

[havinabadday]

Hi,

Uninstall Antivir or Avast first (it's recommended to have one antivirus product installed and running only). Then disable all installed protection software before running fresh version of ComboFix again. Post back its report & fresh dds log.

I uninstalled Avast, but then Combofix said Antivir was running even though I had disabled it so I uninstalled that as well for the meantime.

I ran Combofix which seemed to help, my pc started up normally and the task bar and windows look like XP again. As far as I can tell it is operating normally, but I'll wait to hear what you have to say before I let myself get excited.

I have zipped and attached the logfiles to my post.

Thank so much for taking the time to help me with my computer. I really appreciate that there are nice people like yourself out there to help people like me who got themselves into trouble. Its reasuring to know there are good people to help fight malware creaters.

Let me know what I should do next.

ComboFix.zip

[Blade81]

Hi again,

It looks better but let's still take some further steps.

Uninstall old Adobe Reader versions and get the latest one (both 9.3 and update 9.3.2) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 20.
  
• Click the
  Download
  button to the right.
  
• Select Windows on platform combobox and check the box that says:
  Accept License Agreement. Click continue.
  
• The page will refresh.
  
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.
  

Download ATF (Atribune Temp File) Cleaner

[havinabadday]

Hi again,

It looks better but let's still take some further steps.

Uninstall old Adobe Reader versions and get the latest one (both 9.3 and update 9.3.2) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 20.
  
• Click the
  Download
  button to the right.
  
• Select Windows on platform combobox and check the box that says:
  Accept License Agreement. Click continue.
  
• The page will refresh.
  
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.
  

Download ATF (Atribune Temp File) Cleaner

kas1.zip

[Blade81]

Hi,

Please use -button while replying

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Devin O'Brien\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Show.class-4d3b8bcc-2a60de02.class
C:\Documents and Settings\Devin O'Brien\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\logo.jar-7652dcc0-7ada78d9.zip
DDS::
mASetup: {CC42A8DC-4B7C-1456-8008-37653A19AE93} - c:\program files\winup_64\win_up.exe s
Folder::
c:\program files\winup_64

Save this as

CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe

Then post the resultant log. Any issues left?

[havinabadday]

Ok I did as instructed and my pc seems fine, although it acted normally before running Combofix with the script so I doubt I would know for sure.

It appears that my sound card was uninstalled at some point in the process. When I view it in "Sounds and Audio Devices Properties" it's listed as "Multimedia Audio Controller" and not creative soundblaster(or whatever it was before). Windows is currently using my firepod(firewire 8 track music recorder) as a soundcard, which works for the purpose but isn't ideal. I believe I can figure out reinstalling the sound card though.

Let me know if there are any other steps I should take.

Thanks for all your help

Combofix1.txt

[Blade81]

Hi,

Yes, reinstall should fix the sound issue.

We need one more run with ComboFix.

Open notepad and copy/paste the text in the quotebox below into it:

Driver::
eoplkr
File::
c:\windows\system32\drivers\nglv.sys
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CC42A8DC-4B7C-1456-8008-37653A19AE93}]

Save this as

CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe

Then post the resultant log.

[havinabadday]

Hey Blade81,

I created the script file by copying the text you provided and dragging it onto the Combofix icon. I ran Combofix which went as normal, however after it restarted my pc and created the log file, I received the following error from from windows:

Received Error Window:

"PEV.cfxxe - Application Error"

"The exception unknown software exception (0x40000015) occurred in the application at location 0x0044c2f9."

"Click OK to terminate the program"

"Click on CANCEL to debug the program"

"Ok / Cancel"

I have copied the message exactly, I have not taken any action at this time. I will also attach the Combofix log file to this reply. I added comments to the combofix log at the end so I wouldn't loose them incase I lost the error message somehow. If you need me to remove them let me know.

as always I appreciate your help and am awaiting further instructions.

Combofix2.txt

[havinabadday]

I should also mention my pc is running normally aside from the error message.

[Blade81]

Hi,

Does the error message (click ok on that) appear on each reboot?

[havinabadday]

I haven't done anything yet incase the error message is important. I haven't rebooted. Should I hit ok or cancel, or does it not really matter?

Let me know what I should try.

thanks

[Blade81]

You can click ok on the message.

[havinabadday]

I restarted and there was no error message. Also my sound card has reappeared and seems back to normal. Is there anything else you can suggest I do?

[Blade81]

Good. Some final steps next

THESE STEPS ARE VERY IMPORTANT

Let's reset system restore

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.

On the Desktop, right-click My Computer.

Click Properties.

Click the System Restore tab.

Check Turn off System Restore.

Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.

On the Desktop, right-click My Computer.

Click Properties.

Click the System Restore tab.

UN-Check *Turn off System Restore*.

Click Apply, and then click OK.

NOTE: only do this ONCE,NOT on a regular basis

Now lets uninstall ComboFix:

• Click START then RUN
  
• Now copy-paste Combofix /uninstall in the runbox and click OK
  

Next we remove all used tools.

Please download OTC and save it to desktop.

• Double-click OTC.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the
  Begin cleanup Process?
  prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it by yourself.
  

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Make your Internet Explorer more secure

This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab

Click once on the Internet icon so it becomes highlighted.

Click once on the Custom Level button.

Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

• hosts file:
  
  • Every version of windows has a hosts file as part of them.
    
  • In a very basic sense, they are used to locate webpages.
    
  • We can customize a hosts file so that it blocks certain webpages.
    
  • However, it can slow down certain computers.
    
  • This is why using a hosts file is optional!!
    

  Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here

  If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:

  1. 
     
     
  2. Click the start button (at the lower left hand corner of your screen)
     
  3. Click run
     
  4. In the dialog box, type services.msc
     
  5. hit enter, then locate dns client
     
  6. Highlight it, then double-click it.
     
  7. On the dropdown box, change the setting from automatic to manual.
     
  8. Click ok
     

  [*]Run Secunia vulnerability check here and fix its findings.

  [*]Get Anti Virus Software and keep it updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. Good free antivirus programs are:

  Antivir

  Avast!

  Good commercial ones are from:

  Kaspersky and

  ESET

  [*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.

  If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.

Just a final reminder for you. I am trying to stress these two points.

UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.

Make sure all of your security programs are up to date.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,

Blade

[havinabadday]

Hey Blade,

I followed your steps below except hosts file. I'll read up on that when I have some free time. I will make sure to keep my programs up to date from now on. I really appreciate all the help you've provided. I was ready to kick my pc to the curb before you gave me a hand. Thank you so much!! You've been very helpful. I hope I don't have to request help from the support forums again, but its good to know there are people like you who can help.

Thanks!!!!

[Blade81]

You're welcome. Glad I could help