AV Security Suite

jreinan01 · June 17, 2010

Help.....I have contracted the AV security suite malware and it is taking my computer hostage. I cannot connect to the internet at all anymore, the only way I can get files on to the computer is by burning them to cd on another machine and every time I try to install/run/uninstall or do ANYTHING with MBAM the malware takes it hostage and blows up the process. I am losing my patience with this and I would like to avoid dire solutions. Seems like it will be difficult to get these "logs" to assist you guys as I have not figured out a way to get files .txt or otherwise off of the machine. I am a rookie at this virus/malware stuff but am relatively computer savvy. Thanks in advance for the help.

John

screen317 · June 17, 2010

Hi and welcome to Malwarebytes.

Download DDS from another computer, transfer it, and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

jreinan01 · June 18, 2010

DDS (Ver_10-03-17.01) - NTFSx86 NETWORK

Run by person at 22:35:53.35 on Thu 06/17/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

============== Running Processes ===============

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\WINDOWS\Explorer.EXE

I:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.in.honda.com/RRAAApps/RRAASec/Asp/rraalog.asp

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:1038

mURLSearchHooks: H - No File

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [PivotSoftware] "c:\program files\portrait displays\pivot software\wpctrl.exe"

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [iSTray] "c:\program files\spyware doctor\pctsTray.exe"

mRun: [DT GWY] c:\program files\common files\portrait displays\shared\DT_startup.exe -GWY

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [Alcmtr] ALCMTR.EXE

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

IE: {88EB38EF-4D2C-436D-ABD3-56B232674062} - c:\program files\icq7.0\ICQ.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll

DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} - hxxp://www.in.honda.com/rraaapps/rraasec/codebase/rraainax/RYXAINAX_LandscapePrintingActiveX.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} - hxxp://powerview.jdpa.com/download/CfxIEAx.cab

DPF: {297DE2B6-509A-4B36-93C5-A65276606900} - hxxp://www.in.honda.com/rraaapps/rraasec/codebase/RRAAINAX/RraainAX.CAB

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193852344826

DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\person\applic~1\mozilla\firefox\profiles\igwpdhkb.default\

FF - prefs.js: network.proxy.type - 4

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\documents and settings\person\application data\move networks\plugins\npqmp071500000347.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - plugin: c:\windows\system32\c2mp\npdivx32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R? avg9emc;AVG Free E-mail Scanner

R? avg9wd;AVG Free WatchDog

R? AvgLdx86;AVG Free AVI Loader Driver x86

R? AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86

R? Browser Defender Update Service;Browser Defender Update Service

R? MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX7000 Filter Driver

R? PdiService;Portrait Displays SDK Service

R? SABKUTIL;SABKUTIL

R? SASDIFSV;SASDIFSV

R? SASKUTIL;SASKUTIL

R? sdAuxService;PC Tools Auxiliary Service

R? sdCoreService;PC Tools Security Service

R? Viewpoint Manager Service;Viewpoint Manager Service

S? AvgTdiX;AVG Free Network Redirector

S? PCTCore;PCTools KDS

=============== Created Last 30 ================

2010-06-16 21:16:06 0 d-----w- c:\program files\Winlogon

2010-06-15 04:29:48 0 d-----w- c:\program files\John Rules

2010-06-15 04:24:04 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-15 00:48:40 0 d-----w- c:\program files\Free Window Registry Repair

2010-06-11 07:05:46 0 dc----w- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

2010-06-11 06:49:28 0 d-----w- C:\ComboFix

2010-06-11 06:25:07 98816 ----a-w- c:\windows\sed.exe

2010-06-11 06:25:07 77312 ----a-w- c:\windows\MBR.exe

2010-06-11 06:25:07 256512 ----a-w- c:\windows\PEV.exe

2010-06-11 06:25:07 161792 ----a-w- c:\windows\SWREG.exe

2010-06-10 19:16:33 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-06-10 04:32:36 882 ----a-w- c:\windows\RegSDImport.xml

2010-06-10 04:32:36 879 ----a-w- c:\windows\RegISSImport.xml

2010-06-10 04:32:36 767952 ----a-w- c:\windows\BDTSupport.dll.old

2010-06-10 04:32:36 763832 ----a-w- c:\windows\BDTSupport.dll

2010-06-10 04:32:36 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-06-10 04:32:36 131 ----a-w- c:\windows\IDB.zip

2010-06-10 04:32:36 1152444 ----a-w- c:\windows\UDB.zip

2010-06-10 04:32:35 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-06-10 04:32:35 1652688 ----a-w- c:\windows\PCTBDCore.dll.old

2010-06-10 04:32:35 1652664 ----a-w- c:\windows\PCTBDCore.dll

2010-06-10 04:28:33 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2010-06-10 04:28:33 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-06-10 04:28:29 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-06-10 04:28:29 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2010-06-10 04:28:29 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2010-06-10 04:28:29 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-06-10 04:28:22 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat

2010-06-10 04:28:22 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-06-10 04:28:16 0 d-----w- c:\program files\Spyware Doctor

2010-06-10 04:28:16 0 d-----w- c:\program files\common files\PC Tools

2010-06-10 04:28:16 0 d-----w- c:\docume~1\person\applic~1\PC Tools

2010-06-10 04:28:16 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools

2010-06-10 04:24:24 0 d-----w- c:\windows\pss

2010-06-08 23:05:11 0 d-----w- c:\docume~1\person\applic~1\SUPERAntiSpyware.com

2010-06-08 23:05:11 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-06-08 23:05:04 0 d-----w- c:\program files\SUPERAntiSpyware

2010-06-08 03:52:00 0 d--h--w- C:\$AVG

2010-06-08 03:51:37 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-08 03:51:30 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-06-08 03:51:11 0 d-----w- c:\windows\system32\drivers\Avg

2010-06-08 03:50:40 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

==================== Find3M ====================

2010-04-29 20:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 20:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 02:38:26 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-04-05 00:33:44 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-04-05 00:33:44 348160 ----a-w- c:\windows\system32\msvcr71.dll

2010-04-04 18:32:11 4096 ----a-w- c:\windows\d3dx.dat

2008-12-20 17:44:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008122020081221\index.dat

============= FINISH: 22:36:25.21 ===============

jreinan01 · June 18, 2010

There that is, Thanks again....

John

screen317 · June 18, 2010

Hi John,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

jreinan01 · June 18, 2010

Combofix.txt

ComboFix 10-06-17.03 - person 06/18/2010 15:40:15.2.2 - x86 NETWORK

Running from: I:\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\win.com

I:\winlogon.exe

.

---- Previous Run -------

.

c:\docume~1\person\LOCALS~1\Temp\tmp2.tmp

-- Previous Run --

c:\windows\system32\eventlog.dll . . . is infected!!

--------

c:\windows\system32\eventlog.dll . . . is infected!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2010-05-18 to 2010-06-18 )))))))))))))))))))))))))))))))

.

2010-06-16 21:16 . 2010-06-16 21:16 -------- d-----w- c:\program files\Winlogon

2010-06-15 04:29 . 2010-06-15 04:29 -------- d-----w- c:\program files\John Rules

2010-06-15 04:24 . 2010-06-15 04:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-15 00:48 . 2010-06-15 00:53 -------- d-----w- c:\program files\Free Window Registry Repair

2010-06-11 07:05 . 2010-06-11 07:05 -------- dc----w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}

2010-06-10 19:16 . 2010-06-10 19:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll

2010-06-10 04:59 . 2010-06-10 04:59 -------- d-----w- c:\documents and settings\person\Local Settings\Application Data\Threat Expert

2010-06-10 04:32 . 2010-06-08 02:16 763832 ----a-w- c:\windows\BDTSupport.dll

2010-06-10 04:32 . 2010-01-22 13:56 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-06-10 04:32 . 2009-10-28 05:36 1152444 ----a-w- c:\windows\UDB.zip

2010-06-10 04:32 . 2008-11-26 16:08 131 ----a-w- c:\windows\IDB.zip

2010-06-10 04:32 . 2010-06-08 00:21 1652664 ----a-w- c:\windows\PCTBDCore.dll

2010-06-10 04:32 . 2010-01-22 13:56 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-06-10 04:28 . 2010-02-05 14:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-06-10 04:28 . 2010-03-29 15:06 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-06-10 04:28 . 2009-11-23 18:54 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-06-10 04:28 . 2010-04-08 19:29 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-06-10 04:28 . 2010-06-10 04:36 -------- d-----w- c:\program files\Spyware Doctor

2010-06-10 04:28 . 2010-06-10 04:33 -------- d-----w- c:\program files\Common Files\PC Tools

2010-06-10 04:28 . 2010-06-10 04:28 -------- d-----w- c:\documents and settings\person\Application Data\PC Tools

2010-06-10 04:28 . 2010-06-10 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-06-08 23:05 . 2010-06-08 23:05 -------- d-----w- c:\documents and settings\person\Application Data\SUPERAntiSpyware.com

2010-06-08 23:05 . 2010-06-08 23:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2010-06-08 23:05 . 2010-06-11 06:48 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-06-08 03:52 . 2010-06-11 04:05 -------- d-----w- C:\$AVG

2010-06-08 03:51 . 2010-06-10 19:17 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-08 03:51 . 2010-06-10 18:55 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-06-08 03:51 . 2010-06-10 19:16 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-06-08 03:51 . 2010-06-10 19:19 -------- d-----w- c:\windows\system32\drivers\Avg

2010-06-08 03:50 . 2010-06-08 03:50 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-06-18 20:54 . 2008-12-28 00:44 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-06-11 07:01 . 2007-12-30 16:11 -------- d-----w- c:\documents and settings\person\Application Data\Apple Computer

2010-06-11 06:39 . 2009-10-30 03:35 0 ----a-r- c:\windows\win32k.sys

2010-06-05 04:59 . 2010-03-05 05:37 -------- d-----w- c:\program files\Microsoft Silverlight

2010-05-21 16:57 . 2008-04-29 03:19 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-05-17 01:43 . 2007-12-13 01:11 -------- d-----w- c:\program files\Burn4Free

2010-04-30 07:35 . 2010-03-10 04:47 -------- d-----w- c:\documents and settings\person\Application Data\ICQ

2010-04-29 20:39 . 2009-07-18 02:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 20:39 . 2009-07-18 02:38 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 02:41 . 2007-11-14 23:38 -------- d-----w- c:\program files\Common Files\Java

2010-04-29 02:38 . 2010-04-29 02:38 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-04-28 23:06 . 2010-03-10 04:46 -------- d-----w- c:\program files\ICQ7.0

2010-04-05 00:33 . 2007-10-31 18:06 499712 ----a-w- c:\windows\system32\msvcp71.dll

2010-04-05 00:33 . 2007-10-31 18:06 348160 ----a-w- c:\windows\system32\msvcr71.dll

2010-04-04 18:32 . 2010-04-04 18:32 4096 ----a-w- c:\windows\d3dx.dat

.

------- Sigcheck -------

Cryptography Services Error !!

c:\windows\System32\ctfmon.exe ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-05-18 2397424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-04-05 202256]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]

"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]

"nwiz"="nwiz.exe" [2006-05-09 1519616]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-09 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2008-08-04 160800]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-16 141608]

"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2010-05-11 1287120]

"DT GWY"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-04-08 81920]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-10 2065248]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-06-10 19:16 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"%windir%\\system32\\drivers\\svchost.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\AIM7\\aim.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\ooVoo\\ooVoo.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\ICQ7.0\\ICQ.exe"=

"c:\\Program Files\\ICQ7.0\\aolload.exe"=

"c:\\Documents and Settings\\person\\Desktop\\snipersim\\snipersim.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"18937:TCP"= 18937:TCP:BitComet 18937 TCP

"18937:UDP"= 18937:UDP:BitComet 18937 UDP

"443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443

"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443

"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674

"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674

"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675

R1 SABKUTIL;SABKUTIL;c:\program files\SUPERAntiSpyware\SABKUTIL.sys [x]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-06-10 916760]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [2010-01-22 112592]

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2010-03-11 366840]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]

R3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX7000 Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2008-08-04 33808]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-03-29 218592]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-06-10 216200]

S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-06-10 242896]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-06-10 308064]

S2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-04-08 90112]

.

Contents of the 'Scheduled Tasks' folder

2010-06-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:34]

2010-06-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-854245398-790525478-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

2010-06-07 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-854245398-790525478-725345543-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 03:09]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.in.honda.com/RRAAApps/RRAASec/Asp/rraalog.asp

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:1038

LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

DPF: {297DE2B6-509A-4B36-93C5-A65276606900} - hxxp://www.in.honda.com/rraaapps/rraasec/codebase/RRAAINAX/RraainAX.CAB

FF - ProfilePath - c:\documents and settings\person\Application Data\Mozilla\Firefox\Profiles\igwpdhkb.default\

FF - prefs.js: network.proxy.type - 4

FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: c:\documents and settings\person\Application Data\Move Networks\plugins\npqmp071500000347.dll

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - plugin: c:\windows\system32\C2MP\npdivx32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-06-18 15:54

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F13\3&2411e6fe&0\LogConf]

@DACL=(02 0000)

"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,

00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\

"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,

00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(752)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2284)

c:\windows\system32\WININET.dll

c:\program files\Portrait Displays\Pivot Software\winphook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\RTHDCPL.EXE

c:\program files\real\realplayer\RealPlay.exe

c:\program files\Portrait Displays\Pivot Software\floater.exe

c:\program files\Gateway\EzTune\DTHtml.exe

c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe

c:\program files\AVG\AVG9\avgupd.exe

c:\program files\AVG\AVG9\avgscanx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

.

**************************************************************************

.

Completion time: 2010-06-18 16:07:44 - machine was rebooted

ComboFix-quarantined-files.txt 2010-06-18 21:07

Pre-Run: 27,826,765,824 bytes free

Post-Run: 27,811,512,320 bytes free

- - End Of File - - FB6CD56C3BF8A598041067D10ACEA860

DDS #2

DDS (Ver_10-03-17.01) - NTFSx86

Run by person at 17:05:04.73 on Fri 06/18/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

============== Running Processes ===============

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\Program Files\Portrait Displays\Pivot Software\floater.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

C:\Program Files\Gateway\EzTune\DTHtml.exe

C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe

C:\Program Files\AVG\AVG9\avgupd.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\SyncServer.exe