Ran MBAM, DDS, GMER - Please Advise

wholefoodsfool2 · June 5, 2010

Thanks for getting me to this step Firefox, what a learning experience this has been.

I started out here: http://forums.malwarebytes.org/index.php?showtopic=52834

Followed the directions, I hope - I stopped before "Re-Enable Defogger" step.

Once again, thanks; I can't wait to put this behind me.

Results:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Dan at 18:53:53.86 on Fri 06/04/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.97 [GMT -5:00]

FW: Trend Micro OfficeScan Enterprise Client Firewall *enabled* {1034070B-4EA4-4718-BC1F-D8D80E09FDE7}

============== Running Processes ===============

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\S24EvMon.exe

svchost.exe

C:\WINDOWS\system32\ZCfgSvc.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe

C:\WINDOWS\SMPClient.exe

C:\Program Files\Lexmark 9500 Series\lxdoamon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\palmOne\HOTSYNC.EXE

C:\Program Files\Apoint\Apntex.exe

svchost.exe

C:\WINDOWS\System32\basfipm.exe

C:\WINDOWS\system32\lxdocoms.exe

C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe

C:\WINDOWS\System32\RegSrvc.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

C:\WINDOWS\TEMP\WB4FA.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Dan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uDefault_Page_URL = hxxp://www.dell.com

uInternet Settings,ProxyServer = http=127.0.0.1:5555

uInternet Settings,ProxyOverride = <local>

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Tzeruje] rundll32.exe "c:\windows\suiclacr.dll",Startup

mRun: [Apoint] c:\program files\apoint\Apoint.exe

mRun: [ATIModeChange] Ati2mdxx.exe

mRun: [sunJavaUpdateSched] c:\program files\java\jre1.5.0_06\bin\jusched.exe

mRun: [PRONoMgr.exe] c:\program files\intel\prosetwireless\ncs\proset\PRONoMgr.exe

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [bascstray] BascsTray.exe

mRun: [DVDSentry] c:\windows\system32\DSentry.exe

mRun: [AdaptecDirectCD] "c:\program files\roxio\easy cd creator 5\directcd\DirectCD.exe"

mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow

mRun: [sMPClient] c:\windows\SMPClient.exe

mRun: [Client Access Service] "c:\program files\ibm\client access\cwbsvstr.exe"

mRun: [Client Access Help Update] "c:\program files\ibm\client access\cwbinhlp.exe"

mRun: [Client Access Check Version] "c:\program files\ibm\client access\cwbckver.exe" LOGIN

mRun: [Client Access Express Welcome] "c:\program files\ibm\client access\cwbwlwiz.exe"

mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

mRun: [lxdomon.exe] "c:\program files\lexmark 9500 series\lxdomon.exe"

mRun: [lxdoamon] "c:\program files\lexmark 9500 series\lxdoamon.exe"

mRun: [Lexmark 9500 Series Fax Server] "c:\program files\lexmark 9500 series\fm3032.exe" /s

mRun: [Hzumonorapule] rundll32.exe "c:\windows\oxerosuloro.dll",Startup

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"

StartupFolder: c:\docume~1\dan\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palmone\HOTSYNC.EXE

StartupFolder: c:\documents and settings\dan\start menu\programs\startup\PowerReg Scheduler.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: Sebring - c:\windows\system32\LgNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 192.168.100.2 skilmatch2

Hosts: 192.168.100.3 skilmatchp

Hosts: 192.168.100.4 skilmatche

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\7k16rbkb.default\

FF - plugin: c:\program files\java\jre1.5.0_06\bin\NPJPI150_06.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: XULRunner: {89892EBC-214E-459C-8AAB-784F19B9598C} - c:\documents and settings\dan\local settings\application data\{89892EBC-214E-459C-8AAB-784F19B9598C}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R2 lxdo_device;lxdo_device;c:\windows\system32\lxdocoms.exe -service --> c:\windows\system32\lxdocoms.exe -service [?]

R2 OfcPfwSvc;OfficeScanNT Personal Firewall;c:\program files\trend micro\officescan client\OfcPfwSvc.exe [2006-3-22 233552]

R2 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [2007-12-3 78640]

R2 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\TmXPFlt.sys [2004-9-15 203024]

R2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\tmpreflt.sys [2004-9-15 36112]

S2 lxdoCATSCustConnectService;lxdoCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\\lxdoserv.exe --> c:\windows\system32\spool\drivers\w32x86\3\\lxdoserv.exe [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-5-18 38224]

S3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [2007-12-3 23180]

=============== Created Last 30 ================

2010-06-04 22:05:03 0 ----a-w- c:\documents and settings\dan\defogger_reenable

2010-05-27 11:46:10 0 d-sh--w- c:\documents and settings\dan\IECompatCache

2010-05-18 19:21:52 2534 ----a-w- c:\windows\ayoqanedevacuq.dll

2010-05-18 19:07:08 2534 ----a-w- c:\windows\idocuwus.dll

2010-05-18 16:26:26 0 d-----w- c:\docume~1\dan\applic~1\Malwarebytes

2010-05-18 16:26:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-05-18 16:26:11 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-05-18 16:26:11 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-18 16:26:11 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-05-18 16:08:11 2534 ----a-w- c:\windows\uvipavur.dll

2010-05-18 16:01:03 2534 ----a-w- c:\windows\uhahopir.dll

2010-05-12 05:42:35 120 ----a-w- c:\windows\Nkopefayo.dat

2010-05-12 05:42:35 0 ----a-w- c:\windows\Dfuhaxu.bin

2010-05-12 05:39:32 0 d-----w- c:\windows\system32\msapps

2010-05-08 23:55:11 0 d-----w- c:\program files\palmOne

==================== Find3M ====================

============= FINISH: 18:55:47.57 ===============

______________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4169

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/4/2010 3:23:04 PM

mbam-log-2010-06-04 (15-23-04).txt

Scan type: Full scan (C:\|)

Objects scanned: 190035

Time elapsed: 1 hour(s), 0 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

_________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4167

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/4/2010 1:52:45 PM

mbam-log-2010-06-04 (13-52-45).txt

Scan type: Full scan (D:\|E:\|)

Objects scanned: 141694

Time elapsed: 2 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mjvqqhxr (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mjvqqhxr (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Dan\Local Settings\Application Data\blxfeemyf\sptdnautssd.exe (Rogue.AntivirusSuite.Gen) -> Delete on reboot.

__________________________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4149

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/27/2010 6:50:51 PM

mbam-log-2010-05-27 (18-50-51).txt

Scan type: Full scan (C:\|)

Objects scanned: 192994

Time elapsed: 1 hour(s), 14 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Files Infected:

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP736\A0086168.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP736\A0086169.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

________________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4148

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

5/27/2010 12:31:54 PM

mbam-log-2010-05-27 (12-31-54).txt

Scan type: Full scan (C:\|)

Objects scanned: 216275

Time elapsed: 47 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Registry Keys Infected:

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eanfgkdo (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eanfgkdo (Trojan.Downloader) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Dan\Local Settings\Application Data\ismfshcjo\aqpwlattssd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\syssvc.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\8c8d163e.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\aAEV.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\tuunld.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

____________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4148

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/27/2010 9:29:41 AM

mbam-log-2010-05-27 (09-29-41).txt

Scan type: Full scan (C:\|)

Objects scanned: 192573

Time elapsed: 1 hour(s), 13 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Files Infected:

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP735\A0086150.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

____________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4141

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/25/2010 9:59:42 AM

mbam-log-2010-05-25 (09-59-42).txt

Scan type: Full scan (C:\|)

Objects scanned: 192964

Time elapsed: 1 hour(s), 56 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\postbootreminder (Backdoor.Losfondup) -> Quarantined and deleted successfully.

Files Infected:

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP735\A0086149.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

C:\windows\system32\etar32dll.dll (Backdoor.Losfondup) -> Delete on reboot.

__________________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4134

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

5/24/2010 11:46:07 PM

mbam-log-2010-05-24 (23-46-07).txt

Scan type: Full scan (C:\|)

Objects scanned: 219832

Time elapsed: 52 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 2

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxqiidfg (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxqiidfg (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Dan\Local Settings\Application Data\syssvc.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\jvgwydunn\tybalrktssd.exe (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted successfully.

__________________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4133

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/23/2010 3:05:53 PM

mbam-log-2010-05-23 (15-05-53).txt

Scan type: Full scan (C:\|)

Objects scanned: 192434

Time elapsed: 1 hour(s), 15 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Files Infected:

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP730\A0083131.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.

_________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4113

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/18/2010 4:57:57 PM

mbam-log-2010-05-18 (16-57-57).txt

Scan type: Full scan (C:\|)

Objects scanned: 191304

Time elapsed: 1 hour(s), 10 minute(s), 29 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Files Infected:

C:\System Volume Information\_restore{9B539E66-D85A-41E7-ACFD-AE0F6CD9DCE9}\RP730\A0083128.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

___________________________

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4113

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

5/18/2010 3:14:22 PM

mbam-log-2010-05-18 (15-14-22).txt

Scan type: Quick scan

Objects scanned: 171561

Time elapsed: 30 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 5

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 8

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ridaqovq (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ridaqovq (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\comserver (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asam (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asam (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CLASSES_ROOT\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32\(default) (Hijack.Tray) -> Bad: (C:\DOCUME~1\Dan\LOCALS~1\Temp\7848113787.dll) Good: (stobject.dll) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Dan\Local Settings\Application Data\ekhmtawrq\lkbsgmptssd.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\4244749680.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\wlavqa.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\ywbhtj.exe (Worm.AutoRun) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Temp\comsrvr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\windows\system32\msapps\comsrvr.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\windows\herjek.config (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\asam.exe (Trojan.Agent) -> Quarantined and deleted successfully.

ark.zip

Maniac · June 5, 2010

Hello wholefoodsfool2! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.

Step 1

Please, uninstall the following applications:

Adobe Reader 7.1.0

You can read, how to this here:

Step 2

The current version of MBAM database is 4170 and we'll use Normal mode for the following action:

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

MalwareBytes' Anti-Malware log
a new fresh DDS log only

wholefoodsfool2 · June 5, 2010

Hey there Borislav; I'm glad you're here.

Removed Adobe. Ran ops per instructions.

MBAM & DDS results are below. Should I have attached the zipped "Attachment" results as well?

I look forward to your thoughts.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4170

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/5/2010 2:18:00 PM

mbam-log-2010-06-05 (14-18-00).txt

Scan type: Quick scan

Objects scanned: 171130

Time elapsed: 30 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86

Run by Dan at 14:43:34.25 on Sat 06/05/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.115 [GMT -5:00]

FW: Trend Micro OfficeScan Enterprise Client Firewall *enabled* {1034070B-4EA4-4718-BC1F-D8D80E09FDE7}

============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\S24EvMon.exe

svchost.exe

C:\WINDOWS\system32\ZCfgSvc.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\basfipm.exe

C:\WINDOWS\system32\lxdocoms.exe

C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe

C:\WINDOWS\System32\RegSrvc.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe

C:\WINDOWS\SMPClient.exe

C:\Program Files\Lexmark 9500 Series\lxdoamon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

C:\Program Files\palmOne\HOTSYNC.EXE

C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

C:\Program Files\Apoint\Apntex.exe

C:\WINDOWS\TEMP\CKCDE0.EXE

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\MDM.EXE

C:\WINDOWS\system32\MsiExec.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe