Malwarebytes' Anti-Malware log file and DDS/GMER log files

bugsrbad · June 28, 2010

I got a nasty bug last week and managed to clean it off, I think. I ran Hijack this and hope some of you can give it a look and say if I've missed anything (ie. is 'wormradar' bad?). Also, if it didn't get fixed by using AVG, SUPERAntiSpyware or Malawarebytes' (run off thumbdrive), will hijack this fix/kill it or do is there more for me to do here?

Thanks much! Here's the log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:48:37 AM, on 6/28/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

G:\Documents\Downloads\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe

G:\Documents\Downloads\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5577

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [blackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [MSN Toolbar] "C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe"

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] G:\Documents\Downloads\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1253678822008

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://attwm.webex.com/client/T25L10NSP41E...bex/ieatgpc.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

--

End of file - 5938 bytes

Maniac · June 28, 2010

Hello bugsrbad! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

Please follow the instructions and post all logs if you can:

http://forums.malwarebytes.org/index.php?showtopic=9573

bugsrbad · June 28, 2010

Ok, I've tried to follow the 'I'm infected' instructions to the tee . . . . DeFogger didn't prompt to reboot machine so I did a resart.

I've attached all (I think)

-plus the original Malawarebytes log of the infected items removed last week

-plus the Hijack this log that shows the creepy-named files I don't understand

Thanks . . . awaiting further instruction.

ark.zip

Attach.zip

DDS.txt

mbam_log_2010_06_24__13_55_48_.txt

mbam_log_2010_06_28__08_47_39_.txt

hijackthis.txt

bugsrbad · June 29, 2010

I followed instructions and posted as new topic yesteday. Was I supposed to reply to this thread? Here's a copy of the my results:

Malwarebytes' Anti-Malware log file and DDS/GMER log files, how will i know when i'm clean? Options Track this topic

Group: Members

Posts: 2

Joined: Yesterday, 04:09 PM

Member No.: 45,206

Ok, I've tried to follow the 'I'm infected' instructions to the tee . . . . DeFogger didn't prompt to reboot machine so I did a resart.

I've attached all (I think)

-plus the original Malawarebytes log of the infected items removed last week

-plus the Hijack this log that shows the creepy-named files I don't understand

Thanks . . . awaiting further instruction.

Attached File(s)

ark.zip ( 415bytes ) Number of downloads: 1

Attach.zip ( 3.39K ) Number of downloads: 0

DDS.txt ( 9.06K ) Number of downloads: 1

mbam_log_2010_06_24__13_55_48_.txt ( 1.36K ) Number of downloads: 0

mbam_log_2010_06_28__08_47_39_.txt ( 910bytes ) Number of downloads: 0

hijackthis.txt ( 7.74K ) Number of downloads: 0

Maniac · July 1, 2010

Step 1

Please, uninstall the following applications:

Adobe Reader 9.1

You can read, how to this here:

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 3

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

JavaRa log
MalwareBytes' Anti-Malware log
a new fresh DDS log only

bugsrbad · July 1, 2010

Step 1
Please, uninstall the following applications:
Adobe Reader 9.1
You can read, how to this here:
Windows XP
Windows Vista
Windows 7
Step 2
Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA
Then run this tool to help cleanup any left over Java
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please download JavaRa and unzip it to your desktop.
***Please close any instances of Internet Explorer (or other web browser) before continuing!***
Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java
Step 3
Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
In your next reply, please include these log(s):
JavaRa log
MalwareBytes' Anti-Malware log
a new fresh DDS log only

Okay, the JavaRA Log sez:

JavaRa 1.15 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Thu Jul 01 16:20:19 2010

------------------------------------

Finished reporting.

The other 2 logs are attached. I'll check in again tomorrow. Thank you!

DDS_2.txt

mbam_log_2010_07_01__16_31_11_.txt

Maniac · July 2, 2010

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

bugsrbad · July 2, 2010

Here's the log:

ComboFix 10-07-01.02 - HS Director 07/02/2010 10:52:35.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.570 [GMT -7:00]

Running from: c:\documents and settings\Red Cross User\Desktop\Combo-Fix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((( Files Created from 2010-06-02 to 2010-07-02 )))))))))))))))))))))))))))))))

.

2010-06-28 19:16 . 2010-06-28 19:16 388096 ----a-r- c:\documents and settings\Red Cross User\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2010-06-28 19:16 . 2010-06-28 19:16 -------- d-----w- c:\program files\TrendMicro

2010-06-28 19:13 . 2010-06-28 19:13 -------- d-----w- c:\documents and settings\Red Cross User\Application Data\Yahoo!

2010-06-28 19:13 . 2010-06-28 21:20 -------- d-----w- c:\program files\Yahoo!

2010-06-28 19:13 . 2010-06-28 19:13 -------- d-----w- c:\program files\CCleaner

2010-06-28 18:05 . 2010-06-28 18:05 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2010-06-28 18:04 . 2010-06-28 18:04 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-06-25 15:53 . 2010-06-25 15:53 0 ----a-w- c:\windows\nsreg.dat

2010-06-25 15:52 . 2010-06-25 15:52 -------- d-----w- c:\documents and settings\Red Cross User\Local Settings\Application Data\Mozilla

2010-06-24 20:30 . 2010-06-24 20:30 -------- d-----w- c:\documents and settings\Red Cross User\Application Data\Malwarebytes

2010-06-24 20:29 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-06-24 20:29 . 2010-06-24 20:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-24 20:29 . 2010-06-24 20:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-06-24 20:29 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-06-24 15:51 . 2010-06-24 15:51 -------- d-----w- c:\documents and settings\Red Cross User\Application Data\SUPERAntiSpyware.com

2010-06-24 15:47 . 2010-06-24 15:47 -------- d-----w- c:\program files\Alwil Software

2010-06-24 15:33 . 2010-06-25 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-06-24 15:31 . 2010-06-24 00:04 52566928 ----a-w- c:\program files\setup_av_free.exe

2010-06-23 22:02 . 2010-06-24 16:20 -------- d-----w- c:\documents and settings\Red Cross User\Local Settings\Application Data\jcdpqtise

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-02 16:05 . 2010-03-26 20:14 -------- d-----w- c:\program files\LogMeIn

2010-07-01 23:11 . 2010-03-16 20:41 -------- d-----w- c:\program files\Research In Motion

2010-07-01 23:11 . 2010-03-16 20:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion

2010-07-01 23:08 . 2009-09-23 05:37 -------- d-----w- c:\program files\Common Files\Adobe

2010-06-28 18:01 . 2009-09-23 03:52 -------- d-----w- c:\documents and settings\Red Cross User\Application Data\U3

2010-06-23 18:30 . 2010-05-07 15:06 -------- d-----w- c:\documents and settings\Red Cross User\Application Data\webex

2010-06-21 21:55 . 2010-03-16 20:45 256 ----a-w- c:\windows\system32\pool.bin

2010-06-02 15:06 . 2010-03-15 18:25 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-06-02 15:06 . 2010-03-15 18:25 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-06-01 21:21 . 2010-06-01 21:21 -------- d-----w- c:\program files\DemoForge

2010-06-01 21:20 . 2010-06-01 21:20 -------- d--h--w- c:\program files\Zero G Registry

2010-05-28 21:59 . 2010-05-28 21:59 503808 ----a-w- c:\documents and settings\Red Cross User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-21e91365-n\msvcp71.dll

2010-05-28 21:59 . 2010-05-28 21:59 499712 ----a-w- c:\documents and settings\Red Cross User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-21e91365-n\jmc.dll

2010-05-28 21:59 . 2010-05-28 21:59 348160 ----a-w- c:\documents and settings\Red Cross User\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-21e91365-n\msvcr71.dll

2010-05-28 21:59 . 2010-05-28 21:59 61440 ----a-w- c:\documents and settings\Red Cross User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-56daddb2-n\decora-sse.dll

2010-05-28 21:59 . 2010-05-28 21:59 12800 ----a-w- c:\documents and settings\Red Cross User\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-56daddb2-n\decora-d3d.dll

2010-05-07 15:06 . 2010-05-07 15:06 51304 ----a-w- c:\windows\system32\drivers\atnt40k.sys

2010-05-07 15:05 . 2010-05-07 15:05 202832 ----a-w- c:\windows\system32\atasnt40.dll

2010-05-04 17:20 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 17:20 . 2009-09-23 05:26 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-05-04 17:20 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-05-02 05:22 . 2004-08-04 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-20 05:30 . 2004-08-04 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-06-02 2065248]

"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-11-20 623960]

"MSN Toolbar"="c:\program files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe" [2009-12-09 240992]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-03-17 15:44 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2009-09-29 02:34 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [3/15/2010 11:25 AM 216200]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [3/15/2010 11:25 AM 242896]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 11:25 AM 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 11:41 AM 67656]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [3/17/2010 8:43 AM 916760]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [3/17/2010 8:44 AM 308064]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 12:41 PM 12856]

R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [11/25/2005 5:43 PM 31896]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyServer = http=127.0.0.1:5577

uInternet Settings,ProxyOverride = <local>

.

- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - g:\documents\Downloads\HijackThis\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-02 10:56

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

c:\windows\system32\LMIinit.dll

c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(3160)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

.

Completion time: 2010-07-02 10:58:33

ComboFix-quarantined-files.txt 2010-07-02 17:58

Pre-Run: 14,166,474,752 bytes free

Post-Run: 14,276,231,168 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 270C3B7B580143BCB3288C9C5112C9A7

Maniac · July 2, 2010

Open Notepad and copy and paste the text in the code box below into it:

KillAll::

Folder::
c:\documents and settings\Red Cross User\Local Settings\Application Data\jcdpqtise
c:\program files\Alwil Software
c:\documents and settings\All Users\Application Data\Alwil Software

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride = <local>

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

bugsrbad · July 2, 2010

ComboFix 10-07-01.02 - HS Director 07/02/2010 11:57:42.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.518 [GMT -7:00]

Running from: c:\documents and settings\Red Cross User\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\Red Cross User\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Alwil Software

c:\documents and settings\Red Cross User\Local Settings\Application Data\jcdpqtise

c:\program files\Alwil Software

c:\program files\Alwil Software\Avast5\Setup\setup.ini

.

((((((((((((((((((((((((( Files Created from 2010-06-02 to 2010-07-02 )))))))))))))))))))))))))))))))

.

2010-07-02 18:46 . 2010-07-02 18:46 71680 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe