Multiple Malware

jcole124 · June 10, 2010

Can't seem to get a handle on these. Every time I think they're gone they show up again on reboot. I've attached the dds. GMER has been scanning for a couple of hours. I'll attach attach.txt and ark.txt when gmer is done.

DDS.txt

screen317 · June 10, 2010

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log. We'll take it from there.

jcole124 · June 10, 2010

Here's my scan from yesterday. GMER is still scanning. I can stop the scan, but it's been running for nearly 3 hours.

mbam_log_2010_06_09__18_48_59_.txt

screen317 · June 10, 2010

Hi,

Stop GMER for now.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

jcole124 · June 10, 2010

ComboFix 10-06-10.03 - Owner 06/10/2010 14:09:46.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.497 [GMT -7:00]

Running from: f:\documents and settings\Owner\My Documents\Downloads\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\AVG.exe

c:\documents and settings\Owner\g2mdlhlpx.exe

c:\documents and settings\Owner\Local Settings\Application Data\syssvc.exe

c:\program files\Common Files\SLMSS

c:\winnt\box boat blue.ico

c:\winnt\Downloaded Program Files\popcaploader.inf

c:\winnt\patch.exe

c:\winnt\system32\404Fix.exe

c:\winnt\system32\ad020326.de

c:\winnt\system32\Agent.OMZ.Fix.exe

c:\winnt\system32\bilaowic.ini

c:\winnt\system32\Cache

c:\winnt\system32\Cache\buts.bin

c:\winnt\system32\Cache\msg.bin

c:\winnt\system32\Data

c:\winnt\system32\dumphive.exe

c:\winnt\system32\IEDFix.C.exe

c:\winnt\system32\IEDFix.exe

c:\winnt\system32\o4Patch.exe

c:\winnt\system32\office.exe

c:\winnt\system32\Process.exe

c:\winnt\system32\SrchSTS.exe

c:\winnt\system32\Thumbs.db

c:\winnt\system32\tmp.reg

c:\winnt\system32\trxcadqs.ini

c:\winnt\system32\update.txt

c:\winnt\system32\VACFix.exe

c:\winnt\system32\VCCLSID.exe

c:\winnt\system32\WS2Fix.exe

c:\winnt\Tasks\maspevog.job

F:\install.exe

Infected copy of c:\winnt\system32\drivers\imapi.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ZESOFT

((((((((((((((((((((((((( Files Created from 2010-05-10 to 2010-06-10 )))))))))))))))))))))))))))))))

.

2010-06-10 02:29 . 2010-03-01 17:05 124784 ----a-w- c:\winnt\system32\drivers\avipbb.sys

2010-06-10 02:29 . 2010-02-16 21:24 60936 ----a-w- c:\winnt\system32\drivers\avgntflt.sys

2010-06-10 02:29 . 2009-05-11 19:49 45416 ----a-w- c:\winnt\system32\drivers\avgntdd.sys

2010-06-10 02:29 . 2009-05-11 19:49 22360 ----a-w- c:\winnt\system32\drivers\avgntmgr.sys

2010-06-10 02:29 . 2010-06-10 02:29 -------- d-----w- c:\program files\Avira

2010-06-10 02:29 . 2010-06-10 02:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-06-10 01:07 . 2010-06-09 17:14 15880 ----a-w- c:\winnt\system32\lsdelete.exe

2010-06-09 17:15 . 2010-06-09 17:14 64288 ----a-w- c:\winnt\system32\drivers\Lbd.sys

2010-06-09 17:14 . 2010-06-09 17:14 95024 ----a-w- c:\winnt\system32\drivers\SBREDrv.sys

2010-06-09 17:03 . 2010-06-09 17:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}

2010-06-08 19:21 . 2010-06-10 21:05 951 ----a-w- c:\winnt\system32\nvshkllj.dat

2010-06-08 19:21 . 2010-06-10 21:05 2126 ----a-w- c:\winnt\system32\netcmgx.dat

2010-06-08 17:49 . 2010-06-10 20:56 0 ----a-w- c:\winnt\system32\mcione16.dat

2010-06-08 17:12 . 2010-06-08 17:12 -------- d-----w- C:\spoolerlogs

2010-06-08 16:57 . 2010-06-08 16:57 50981 ----a-w- c:\winnt\system32\oxszuablmrdwz.exe

2010-06-08 16:57 . 2010-06-08 16:57 -------- d-----w- c:\program files\$NtUninstallWTF1012$

2010-06-08 16:57 . 2010-06-08 19:28 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\WisePlay

2010-06-08 16:56 . 2010-06-10 21:31 951 ----a-w- c:\winnt\system32\loadpegf.dat

2010-06-08 16:56 . 2010-06-10 21:30 1407 ----a-w- c:\winnt\system32\eappgaui.dat

2010-06-08 16:56 . 2010-06-10 21:30 0 ----a-w- c:\winnt\system32\xvidcwre.dat

2010-06-08 16:56 . 2010-06-10 20:04 307 ----a-w- c:\winnt\system32\nvdisssr.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-06-10 17:56 . 2010-03-01 03:06 0 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\prvlcl.dat

2010-06-09 17:04 . 2003-08-23 01:43 -------- d-----w- c:\program files\Lavasoft

2010-06-09 04:50 . 2009-02-12 04:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-08 17:04 . 2010-02-21 17:11 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-06-05 08:18 . 2009-05-13 05:34 -------- d-----w- c:\program files\Microsoft Silverlight

2010-06-02 15:28 . 2009-03-31 14:53 242896 ----a-w- c:\winnt\system32\drivers\avgtdix.sys

2010-06-02 15:28 . 2007-02-20 04:39 29584 ----a-w- c:\winnt\system32\drivers\avgmfx86.sys

2010-06-02 03:45 . 2002-11-10 07:08 -------- d-----w- c:\program files\Microsoft Games

2010-05-30 04:40 . 2007-12-12 02:25 -------- d--h--w- c:\documents and settings\Owner\Application Data\BitTorrent

2010-05-24 00:09 . 2010-03-12 04:48 -------- d-----w- c:\program files\Farm Frenzy 3

2010-05-21 21:14 . 2009-10-03 01:08 221568 ------w- c:\winnt\system32\MpSigStub.exe

2010-05-02 21:11 . 2008-02-03 04:14 -------- d-----w- c:\program files\Yahoo! Games

2010-04-29 22:39 . 2009-02-12 04:50 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39 . 2009-02-12 04:50 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys

2010-04-28 06:45 . 2005-09-01 05:15 -------- d-----w- c:\documents and settings\All Users\Application Data\yahoo!

2010-04-28 06:45 . 2002-04-30 20:01 -------- d-----w- c:\program files\Yahoo!

2010-04-25 20:49 . 2009-12-21 18:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Electronic Arts

2010-04-13 02:37 . 2010-04-13 02:37 -------- d-----w- c:\documents and settings\All Users\Application Data\ShinyTales

2010-03-14 15:53 . 2010-03-14 15:53 12464 ----a-w- c:\winnt\system32\avgrsstx.dll

2010-03-14 15:52 . 2009-03-31 14:53 216200 ----a-w- c:\winnt\system32\drivers\avgldx86.sys

2008-05-25 02:40 . 2007-10-31 04:55 184 ----a-w- c:\program files\QAUDIO.INI

2007-10-31 04:54 . 2007-10-31 04:54 5384603 ----a-w- c:\program files\EasyMp3setup.exe

2007-09-03 16:34 . 2007-10-31 04:23 1593344 ----a-w- c:\program files\QAUDIO.EXE

2007-08-21 17:24 . 2007-10-31 04:23 47080 ----a-w- c:\program files\QuickAudio.chm

2007-08-14 18:58 . 2007-10-31 04:23 118878 ----a-w- c:\program files\soundstretch.exe

2004-12-21 02:44 . 2007-10-31 04:23 682085 ----a-w- c:\program files\sox.exe

2003-11-22 19:37 . 2007-10-31 04:23 74240 ----a-w- c:\program files\oggdec.exe

2003-11-22 19:36 . 2007-10-31 04:23 155136 ----a-w- c:\program files\oggenc.exe

2003-01-09 07:43 . 2007-10-31 04:23 569344 ----a-w- c:\program files\lame.exe

2000-01-28 02:19 . 2007-10-31 04:23 1048576 ----a-w- c:\program files\ROBOEX32.DLL

1999-01-28 23:44 . 2007-10-31 04:23 49152 ----a-w- c:\program files\INETWH32.DLL

1995-08-29 12:52 . 2007-10-31 04:23 49152 ----a-w- c:\program files\BIDS45F.DLL

1995-08-29 12:52 . 2007-10-31 04:23 176128 ----a-w- c:\program files\CW3215.DLL

1995-02-28 19:16 . 2007-10-31 04:23 211488 ----a-w- c:\program files\BWCC32.DLL

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{35627A0E-5D1E-45cd-AE24-C1D59CCCC18F}]

2010-06-08 16:57 88064 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\WisePlay\wiseplie.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\nvdisssr]

@="{BD9833DF-3341-7132-A234-BDFF3C341733}"

[HKEY_CLASSES_ROOT\CLSID\{BD9833DF-3341-7132-A234-BDFF3C341733}]

2008-05-16 18:31 135168 ----a-w- c:\winnt\system32\nvdisssr.ocx

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]

"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]

"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-05-26 2346192]

"wben"="c:\program files\Starfield\Desktop Notifier\wben.exe" [2009-06-25 338456]

"RCUI"="c:\program files\RingCentral\RingCentral Call Controller\RCUI.exe" [2009-05-04 479232]

"RCHotKey"="c:\program files\RingCentral\RingCentral Call Controller\RCHotKey.exe" [2009-05-04 32768]

"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-03 136176]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Shockwave Updater"="c:\winnt\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2008-05-16 13529088]

"nwiz"="nwiz.exe" [2008-05-16 1630208]

"Logitech Utility"="Logi_MwX.Exe" [2003-11-07 19968]

"Hot Key Kbd 9910 Daemon"="SK9910DM.EXE" [2001-01-03 66048]

"GWMDMMSG"="GWMDMMSG.exe" [2001-11-27 101615]

"AudioHQ"="c:\program files\Creative\SBLive\AudioHQ\AHQTB.EXE" [2001-08-18 180224]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-04 185896]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"NvMediaCenter"="c:\winnt\system32\NvMcTray.dll" [2008-05-16 86016]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-12 29984]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-12 46368]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-11-06 741376]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"AmazonGSDownloaderTray"="c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-03-14 15:53 12464 ----a-w- c:\winnt\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3.exe"=

"c:\\WINNT\\system32\\mmc.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"=

"c:\\Program Files\\Microsoft Games\\Rise Of Legends\\legends.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=

"c:\\WINNT\\system32\\dpvsetup.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\europa universalis iii - demo\\eu3demo.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Eidos Interactive\\Pyro Studios\\Praetorians\\Praetorians.exe"=

"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=

"c:\\Program Files\\RingCentral\\RingCentral Call Controller\\RCUI.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\torchlight\\Torchlight.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=

"c:\\WINNT\\system32\\spoolsv.exe"=

R0 Lbd;Lbd;c:\winnt\system32\drivers\Lbd.sys [6/9/2010 10:15 AM 64288]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [3/31/2009 7:53 AM 216200]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [3/31/2009 7:53 AM 242896]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/9/2010 7:29 PM 135336]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/14/2010 8:53 AM 308064]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2/4/2010 8:52 AM 1352320]

R2 npf;NetGroup Packet Filter Driver;c:\winnt\system32\drivers\npf.sys [3/15/2009 1:13 PM 34064]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/5/2009 4:17 PM 24652]

S0 ntcdrdrv;ntcdrdrv;c:\winnt\system32\DRIVERS\ntcdrdrv.sys --> c:\winnt\system32\DRIVERS\ntcdrdrv.sys [?]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 8:19 PM 13592]

S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [3/13/2010 2:25 PM 401920]

S3 bDMusicb;bDMusicb;\??\c:\docume~1\Owner\LOCALS~1\Temp\bDMusicb.sys --> c:\docume~1\Owner\LOCALS~1\Temp\bDMusicb.sys [?]

S3 FWL;FWL Packet Filter;\??\c:\program files\Software602\602LAN SUITE\fwl.sys --> c:\program files\Software602\602LAN SUITE\fwl.sys [?]

S3 IR500;IR500;c:\winnt\system32\drivers\IR500.sys [2/23/2002 4:31 PM 16768]

S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\Qctest\PCDoc\PCDRDRV.sys --> c:\atf\Qctest\PCDoc\PCDRDRV.sys [?]

S3 PortlUSB;PortlUSB;c:\winnt\system32\drivers\SiriusUSB.sys [2/20/2007 12:27 AM 7552]

S3 PortRst;PortRst;c:\winnt\system32\drivers\PortRst.sys [1/29/2002 6:33 PM 18560]

S4 sptd;sptd;c:\winnt\system32\drivers\sptd.sys [8/29/2007 11:19 PM 685816]

.

Contents of the 'Scheduled Tasks' folder

2010-06-10 c:\winnt\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-02-04 17:14]

2010-05-29 c:\winnt\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2010-06-10 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-1723214923-1685927933-429115175-1003Core.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-03 00:54]

2010-06-10 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-1723214923-1685927933-429115175-1003UA.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-03 00:54]

2010-06-07 c:\winnt\Tasks\User_Feed_Synchronization-{1B8A7C64-BB3E-48FF-B6EC-DAC27A4FFA43}.job

- c:\winnt\system32\msfeedssync.exe [2006-10-17 18:58]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://my.yahoo.com/

mLocal Page = c:\windows\system32\blank.htm

mWindow Title = Microsoft Internet Explorer

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = hxxp://www.gateway.net/

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

IE: &Viewpoint Search - c:\program files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML

IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000

IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm

IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm

IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm

DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab

DPF: {6781FF2E-7452-11D4-84D4-0040F60CE591} - hxxp://www.etniesskateparkoflakeforest.com/rvctl.cab

DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} - hxxp://64.75.174.5/push.cab

DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://ak.g.gametap.com/static/cab_headless/GameTapWebUpdater.cab

DPF: {ED6D016A-12F8-4871-BEDC-CE13AAAB4F0B} - hxxp://www.drivershq.com/members/DD_v4_Member.CAB

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\6hbsau6a.default\

FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 1066

FF - prefs.js: network.proxy.type - 4

FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\6hbsau6a.default\extensions\{D9879E90-DDA0-4f59-AC80-626D3DB93C63}\components\WisePlayFF.dll

FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\documents and settings\Owner\Local Settings\Application Data\RobloxVersions\version-b5dc796702a14251\nproblox.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\np32dsw.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npdeploytk.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npmozax.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npnul32.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\NPOFFICE.DLL

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\nppdf32.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\nppl3260.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin2.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin3.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin4.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin5.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin6.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npqtplugin7.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\nprjplug.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\nprpjplug.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\NPSFDMGR.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\NPUploader.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\progra~1\Mozilla Firefox\plugins\npyaxmpb.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPUploader.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll

FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winnt\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

.

- - - - ORPHANS REMOVED - - - -

BHO-{2B9D5AE4-2924-4F98-9823-F6C40FE1036B} - (no file)

WebBrowser-{00A5781C-9012-446D-AB21-EE5ECB6C55CA} - (no file)

WebBrowser-{BF3C4FAF-8B9A-4F1F-A2E7-D52B36979CD7} - (no file)

HKLM-Run-Keyboard Preload Check - c:\oemdrvrs\KEYB\Preload.exe

HKLM-Run-skb - idpyreob.dll

ShellExecuteHooks-{2E39BE38-5E63-4B86-A550-8396F58C2DF9} - (no file)

Notify-fccyvvwu - fccyvvwu.dll

Notify-xXPjkHAQ - xXPjkHAQ.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-06-10 14:33

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1723214923-1685927933-429115175-1003\Software\SecuROM\License information*]

"datasecu"=hex:51,b5,69,e7,68,f7,6c,1c,1b,c2,02,bd,4d,8f,b7,4d,7b,8b,26,ae,b4,

44,6a,1d,2f,80,e6,6e,6b,e4,ba,26,bf,d4,cf,c8,e5,f4,fa,77,20,67,70,2d,59,02,\

"rkeysecu"=hex:15,5d,12,b9,22,c0,86,bd,30,80,c3,d0,d8,26,3b,6c

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(4000)

c:\winnt\system32\WININET.dll

c:\program files\RingCentral\RingCentral Call Controller\RCHotKeyHook.dll

c:\winnt\system32\IEFRAME.dll

c:\winnt\system32\WPDShServiceObj.dll

c:\winnt\system32\PortableDeviceTypes.dll

c:\winnt\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\winnt\system32\devldr32.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\winnt\system32\nvsvc32.exe

c:\winnt\System32\MsPMSPSv.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\program files\Windows Media Player\WMPNetwk.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\winnt\Logi_MwX.Exe

c:\winnt\GWMDMMSG.exe

c:\winnt\system32\RUNDLL32.EXE

c:\winnt\System32\wbem\unsecapp.exe

c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

.

**************************************************************************

.

Completion time: 2010-06-10 14:48:27 - machine was rebooted

ComboFix-quarantined-files.txt 2010-06-10 21:48

Pre-Run: 14,891,307,008 bytes free

Post-Run: 15,006,191,616 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINNT

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4

- - End Of File - - 8D16E35013CF0F8359FC527B3CF004BA

DDS (Ver_10-03-17.01) - NTFSx86

Run by Owner at 14:49:12.04 on Thu 06/10/2010

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_15

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.381 [GMT -7:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch

svchost.exe

C:\WINNT\System32\svchost.exe -k netsvcs

C:\WINNT\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINNT\system32\devldr32.exe

C:\WINNT\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\WINNT\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINNT\system32\nvsvc32.exe

C:\WINNT\System32\svchost.exe -k imgsvc

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINNT\System32\MsPMSPSv.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINNT\Logi_MwX.Exe

C:\WINNT\GWMDMMSG.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINNT\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Starfield\Desktop Notifier\wben.exe

C:\Program Files\RingCentral\RingCentral Call Controller\RCHotKey.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\WINNT\explorer.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://my.yahoo.com/

mLocal Page = c:\windows\system32\blank.htm

mWindow Title = Microsoft Internet Explorer

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = hxxp://www.gateway.net/

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: wiseHelper Class: {35627a0e-5d1e-45cd-ae24-c1d59cccc18f} - c:\documents and settings\owner\local settings\application data\wiseplay\wiseplie.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll

BHO: {a7327c09-b521-4edb-8509-7d2660c9ec98} - Viewpoint Toolbar BHO

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll

TB: Viewpoint Toolbar: {f8ad5aa5-d966-4667-9daf-2561d68b2012} -

TB: {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - No File

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\progra~1\yahoo!\common\yhexbmesus.dll

uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp

uRun: [MoneyAgent] "c:\program files\microsoft money\system\Money Express.exe"

uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup

uRun: [wben] "c:\program files\starfield\desktop notifier\wben.exe"

uRun: [RCUI] "c:\program files\ringcentral\ringcentral call controller\RCUI.exe"

uRun: [RCHotKey] "c:\program files\ringcentral\ringcentral call controller\RCHotKey.exe"

uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c

uRunOnce: [shockwave Updater] c:\winnt\system32\adobe\shockwave 11\SwHelper_1150595.exe -Update -1150595 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" -"http://games.king.com/first_play.jsp?game=candyrail"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\winnt\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [Logitech Utility] Logi_MwX.Exe

mRun: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE

mRun: [GWMDMMSG] GWMDMMSG.exe

mRun: [AudioHQ] c:\program files\creative\sblive\audiohq\AHQTB.EXE

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [NvMediaCenter] RUNDLL32.EXE c:\winnt\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [sSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot

mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"

mRun: [indexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"

mRun: [PPort11reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\11\config\ereg\Ereg.ini"

mRun: [brMfcWnd] c:\program files\brother\brmfcmon\BrMfcWnd.exe /AUTORUN

mRun: [ControlCenter3] c:\program files\brother\controlcenter3\brctrcen.exe /autorun

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AmazonGSDownloaderTray] c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderTray.exe

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)

IE: &Viewpoint Search - c:\program files\viewpoint\viewpoint toolbar\ViewBar.dll/CXTSEARCH.HTML

IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office10\EXCEL.EXE/3000

IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm

IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm

IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

IE: {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - c:\program files\yahoo!\search protection\ysp.dll

IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll

DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab

DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - hxxp://www.drivershq.com/DD_v4.CAB

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab

DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/su/ocx/15030/CTSUEng.cab

DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/F/D/9/FD9E437D-5BC8-4264-A093-DFA2C39D197E/LegitCheckControl.cab

DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} - hxxp://protect.microsoft.com/security/protect/WSA/shared/cab/x86/MSSecAdv.cab?1064931314358

DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - hxxps://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab

DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {2DFF31F9-7893-4922-AF66-C9A1EB4EBB31} - hxxp://forms.real.com/real/player/download.html?f=windows/mrkt/rhapx/RhapsodyPlayerEngine_Inst_Win.cab

DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6781FF2E-7452-11D4-84D4-0040F60CE591} - hxxp://www.etniesskateparkoflakeforest.com/rvctl.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144129482859

DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} - hcp://system/RunExeActiveX.CAB

DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - hxxp://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab

DPF: {785EA525-5066-495F-ADF6-3B8316515DEF} - hxxp://mirror.worldwinner.com/games/v44/collapse/collapse.cab

DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} - hxxp://secure2.comned.com/signuptemplates/securelogin-devel.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} - hxxp://web1.shutterfly.com/downloads/Uploader.cab

DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} - hcp://system/StartFirstControl.CAB

DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} - hxxp://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB

DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} - hxxp://mirror.worldwinner.com/games/v50/swapit/swapit.cab

DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://download.yahoo.com/dl/mail/autocomplete.cab

DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} - hxxp://64.75.174.5/push.cab

DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security1.norton.com/SSC/SharedContent/sc/bin/cabsa.cab

DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} - hxxp://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe

DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://ak.g.gametap.com/static/cab_headless/GameTapWebUpdater.cab

DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - hxxps://www-secure.symantec.com/techsupp/asa/SymAData.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - hxxp://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab

DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} - hxxp://dgl.microsoft.com/downloads/outc.cab

DPF: {ED6D016A-12F8-4871-BEDC-CE13AAAB4F0B} - hxxp://www.drivershq.com/members/DD_v4_Member.CAB

DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} - hxxp://www.gamespot.com/KDX/zd/kdx.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su/ocx/15030/CTPID.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\6hbsau6a.default\

FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 1066

FF - prefs.js: network.proxy.type - 4

FF - component: c:\documents and settings\owner\application data\mozilla\firefox\profiles\6hbsau6a.default\extensions\{d9879e90-dda0-4f59-ac80-626d3db93c63}\components\WisePlayFF.dll

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\winnt\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\winnt\system32\drivers\Lbd.sys [2010-6-9 64288]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-6-9 11608]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [2009-3-31 216200]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\winnt\system32\drivers\avgmfx86.sys [2007-2-19 29584]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [2009-3-31 242896]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-6-9 135336]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-6-9 267432]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-3-14 308064]

R2 avgntflt;avgntflt;c:\winnt\system32\drivers\avgntflt.sys [2010-6-9 60936]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1352320]

R2 npf;NetGroup Packet Filter Driver;c:\winnt\system32\drivers\npf.sys [2009-3-15 34064]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-10-5 24652]

S0 ntcdrdrv;ntcdrdrv;c:\winnt\system32\drivers\ntcdrdrv.sys --> c:\winnt\system32\drivers\ntcdrdrv.sys [?]

S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

S3 Amazon Download Agent;Amazon Download Agent;c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderService.exe [2010-3-13 401920]

S3 bDMusicb;bDMusicb;\??\c:\docume~1\owner\locals~1\temp\bdmusicb.sys --> c:\docume~1\owner\locals~1\temp\bDMusicb.sys [?]

S3 FWL;FWL Packet Filter;\??\c:\program files\software602\602lan suite\fwl.sys --> c:\program files\software602\602lan suite\fwl.sys [?]

S3 IR500;IR500;c:\winnt\system32\drivers\IR500.sys [2002-2-23 16768]

S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\qctest\pcdoc\pcdrdrv.sys --> c:\atf\qctest\pcdoc\PCDRDRV.sys [?]

S3 PortlUSB;PortlUSB;c:\winnt\system32\drivers\SiriusUSB.sys [2007-2-20 7552]

S3 PortRst;PortRst;c:\winnt\system32\drivers\PortRst.sys [2002-1-29 18560]

=============== Created Last 30 ================

2010-06-10 20:56:48 0 d-sha-r- C:\cmdcons

2010-06-10 20:52:01 98816 ----a-w- c:\winnt\sed.exe

2010-06-10 20:52:01 77312 ----a-w- c:\winnt\MBR.exe

2010-06-10 20:52:01 256512 ----a-w- c:\winnt\PEV.exe

2010-06-10 20:52:01 161792 ----a-w- c:\winnt\SWREG.exe

2010-06-10 15:49:18 20 ----a-w- c:\documents and settings\owner\defogger_reenable

2010-06-10 02:29:42 60936 ----a-w- c:\winnt\system32\drivers\avgntflt.sys

2010-06-10 02:29:41 0 d-----w- c:\program files\Avira

2010-06-10 02:29:41 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira

2010-06-10 01:07:33 15880 ----a-w- c:\winnt\system32\lsdelete.exe

2010-06-09 17:15:52 64288 ----a-w- c:\winnt\system32\drivers\Lbd.sys

2010-06-09 17:14:54 95024 ----a-w- c:\winnt\system32\drivers\SBREDrv.sys

2010-06-09 17:03:31 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}

2010-06-08 19:21:27 951 ----a-w- c:\winnt\system32\nvshkllj.dat

2010-06-08 19:21:27 2126 ----a-w- c:\winnt\system32\netcmgx.dat

2010-06-08 17:49:12 0 ----a-w- c:\winnt\system32\mcione16.dat

2010-06-08 17:12:10 0 d-----w- C:\spoolerlogs

2010-06-08 16:57:51 50981 ----a-w- c:\winnt\system32\oxszuablmrdwz.exe

2010-06-08 16:56:15 1464 ----a-w- c:\winnt\system32\eappgaui.dat

2010-06-08 16:56:15 1008 ----a-w- c:\winnt\system32\loadpegf.dat

2010-06-08 16:56:14 307 ----a-w- c:\winnt\system32\nvdisssr.dat

2010-06-08 16:56:14 0 ----a-w- c:\winnt\system32\xvidcwre.dat

==================== Find3M ====================

2010-06-02 15:28:47 242896 ----a-w- c:\winnt\system32\drivers\avgtdix.sys

2010-05-21 21:14:28 221568 ------w- c:\winnt\system32\MpSigStub.exe

2010-04-29 22:39:38 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39:26 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys

2010-03-14 15:53:23 12464 ----a-w- c:\winnt\system32\avgrsstx.dll

2008-05-25 02:40:31 184 ----a-w- c:\program files\QAUDIO.INI

2007-10-31 04:54:50 5384603 ----a-w- c:\program files\EasyMp3setup.exe

2007-09-03 16:34:08 1593344 ----a-w- c:\program files\QAUDIO.EXE

2007-08-21 17:24:22 47080 ----a-w- c:\program files\QuickAudio.chm

2007-08-14 18:58:54 118878 ----a-w- c:\program files\soundstretch.exe

2004-12-21 02:44:48 682085 ----a-w- c:\program files\sox.exe

2003-11-22 19:37:02 74240 ----a-w- c:\program files\oggdec.exe

2003-11-22 19:36:52 155136 ----a-w- c:\program files\oggenc.exe

2003-01-09 07:43:18 569344 ----a-w- c:\program files\lame.exe

2000-01-28 02:19:04 1048576 ----a-w- c:\program files\ROBOEX32.DLL

1999-01-28 23:44:20 49152 ----a-w- c:\program files\INETWH32.DLL

1995-08-29 12:52:00 49152 ----a-w- c:\program files\BIDS45F.DLL

1995-08-29 12:52:00 176128 ----a-w- c:\program files\CW3215.DLL

1995-02-28 19:16:20 211488 ----a-w- c:\program files\BWCC32.DLL

2008-08-26 06:05:14 32768 --sha-w- c:\winnt\system32\config\systemprofile\local settings\history\history.ie5\mshist012008082520080826\index.dat

============= FINISH: 14:50:22.68 ===============

jcole124 · June 11, 2010

What's next? Avira keeps finding this worm:

Virus or unwanted program 'WORM/Pinit.FG.6 [worm]'

detected in file 'C:\System Volume Information\_restore{0193FC1C-0A70-478B-8107-B531B8E70CAB}\RP1453\A0453627.dll.

Action performed: Deny access

Also, I continue to get this rundll error on startup:

Error loading idpyreob.dll

The specified module could not be found

jcole124 · June 14, 2010

It's been 4 days since I got a response from screen317. Can an admin/mod/expert tell me what the protocol is? Do I continue to wait? Try messaging a mod that's online?

screen317 · June 15, 2010

jcole124,

My apologies for the delay. I did not receive a notification of your reply.

In the future, please send me a PM if you've been waiting too long for a reply, and I will be notified immediately.

I will have a reply for you shortly.

screen317 · June 15, 2010

Hi,

Again my apologies for the delay.

First, please update MBAM, run a Quick Scan, and post its log.

Next, please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.

Next, please open Notepad. Copy and paste the text in the Code box below into Notepad:

http://forums.malwarebytes.org/index.php?showtopic=53521
Collect::
c:\winnt\system32\oxszuablmrdwz.exe
c:\winnt\system32\eappgaui.dat
c:\winnt\system32\loadpegf.dat
c:\winnt\system32\nvdisssr.dat
c:\winnt\system32\xvidcwre.dat
c:\winnt\system32\nvshkllj.dat
c:\winnt\system32\netcmgx.dat
c:\winnt\system32\mcione16.dat
Suspect::
c:\winnt\system32\drivers\IR500.sys
c:\program files\sox.exe
c:\program files\oggdec.exe
c:\program files\oggenc.exe
c:\program files\lame.exe
c:\documents and settings\Owner\Local Settings\Application Data\WisePlay\wiseplie.dll
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\nvdisssr]

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Next, please go to VirusTotal, and upload the following file for analysis:

c:\winnt\system32\drivers\IR500.sys

c:\program files\sox.exe

c:\program files\oggdec.exe

c:\program files\oggenc.exe

c:\program files\lame.exe

c:\documents and settings\Owner\Local Settings\Application Data\WisePlay\wiseplie.dll

Post the results in your reply.

jcole124 · June 15, 2010

Hi Chris.

No worries on the delayed response. For future reference, how long should I wait before sending you a PM?

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4198

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.11

6/14/2010 6:44:44 PM

mbam-log-2010-06-14 (18-44-44).txt

Scan type: Quick scan

Objects scanned: 131794

Time elapsed: 20 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\oxszuablmrdwz (Adware.Adrotator) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINNT\system32\oxszuablmrdwz.exe (Adware.Adrotator) -> Quarantined and deleted successfully.

screen317 · June 15, 2010

If it has been longer than 24 hours (it wont be longer than that, but if it is), please do not hesitate to PM me.

jcole124 · June 15, 2010

ComboFix 10-06-14.02 - Owner 06/14/2010 19:15:52.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.299 [GMT -7:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

file zipped: c:\winnt\system32\eappgaui.dat

file zipped: c:\winnt\system32\loadpegf.dat

file zipped: c:\winnt\system32\mcione16.dat

file zipped: c:\winnt\system32\netcmgx.dat

file zipped: c:\winnt\system32\nvdisssr.dat

file zipped: c:\winnt\system32\nvshkllj.dat

file zipped: c:\winnt\system32\xvidcwre.dat

file zipped: c:\documents and settings\Owner\Local Settings\Application Data\WisePlay\wiseplie.dll

file zipped: c:\program files\lame.exe

file zipped: c:\program files\oggdec.exe

file zipped: c:\program files\oggenc.exe

file zipped: c:\program files\sox.exe

file zipped: c:\winnt\system32\drivers\IR500.sys

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\winnt\system32\eappgaui.dat

c:\winnt\system32\loadpegf.dat

c:\winnt\system32\mcione16.dat

c:\winnt\system32\netcmgx.dat

c:\winnt\system32\nvdisssr.dat

c:\winnt\system32\nvshkllj.dat

c:\winnt\system32\xvidcwre.dat

.

((((((((((((((((((((((((( Files Created from 2010-05-15 to 2010-06-15 )))))))))))))))))))))))))))))))

.

2010-06-13 00:09 . 2010-06-13 00:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Facebook

2010-06-11 05:36 . 2010-06-11 05:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Avira