Browser redirect, random browser opening, slowpc

andybid · July 2, 2010

Hi, Help.

I had a slow and bizzare system and knew something was up

ran malware and found a dozen or so items from trojans to trackers.

\removed these but am still having some probs.

My pc had a skype page open on it this morning, I did not go there or leave browser open

I think it redirected me this morning when surfing.

The pc runs awfull slow at points and takes up to 30 seconds to clear a program window, slowly erasing it from top to bottom.

I do not think the pc is clean yet

Any help appreciated

thank you.

Also think JAVA is taking over my system, it was in my tray this morning, never been there before that I noticed.

GT500 · July 2, 2010

Please download ComboFix from this link, save it on your desktop, turn off your anti-virus software, and run the ComboFix download that you had saved on your desktop.

Combofix will ask you a few questions (such as whether or not you want to install the Windows Recovery Console), give you some general warnings about not using it without supervision, and it will give you some general information about the tool. Please note that the Windows Recovery Console is not required to run ComboFix, and that you do not need it if you have a Windows XP disk.

ComboFix usually takes about 10 minutes to run, unless your computer is heavily infected. It will run through about 50 different stages (listing them all on the blue window that popped up while it was running), and if it does not advance to the next stage after about 10 minutes then that is usually a sign that your anti-virus software is interfering with it.

Once ComboFix is done, it will remove anything that it knows is malicious, and restart your computer. If it didn't find anything malicious, then it will skip that step. The final step takes a few minutes, and when it is done it will open a log in Notepad. Please either copy and paste this log into a reply, or save it on your desktop as a Text Document and attach it to a reply. Please do not take screenshots of the log, or save it as a Word Document.

andybid · July 5, 2010

thanks, It found a bit I think. I uninstalled some Java bit the other day.

Here's the log.

ComboFix 10-07-04.01 - Administrator 04/07/2010 22:55:04.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.510.189 [GMT 1:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users.\documents\settings

c:\documents and settings\All Users.\documents\settings\cbss.dll

c:\documents and settings\All Users\Application Data\QC44k87A.exe

c:\documents and settings\All Users\Documents\Settings\cbss.dll

c:\windows\system\WINSPOOL.DRV

c:\windows\system32\winlogon.bak

c:\windows\Tasks\At100.job

Infected copy of c:\windows\system32\drivers\disk.sys was found and disinfected

Restored copy from - Kitty had a snack

c:\windows\system32\msgsvc.dll . . . is infected!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

((((((((((((((((((((((((( Files Created from 2010-06-04 to 2010-07-04 )))))))))))))))))))))))))))))))

.

2010-07-01 23:28 . 2010-07-01 23:28 -------- d-sh--w- c:\documents and settings\LocalService\PrivacIE

2010-07-01 17:12 . 2010-07-01 17:12 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Identities

2010-07-01 14:21 . 2010-07-01 14:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG9

2010-07-01 11:01 . 2010-07-01 11:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-07-01 11:00 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-01 11:00 . 2010-07-01 11:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-01 11:00 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-01 11:00 . 2010-07-01 11:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-30 17:32 . 2010-07-02 03:30 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-06-30 17:32 . 2010-06-30 18:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-06-30 01:26 . 2010-06-30 01:26 -------- d-----w- c:\windows\Sun

2010-06-30 00:00 . 2010-06-30 00:00 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2010-06-29 09:49 . 2010-06-29 09:49 -------- d-----w- c:\program files\MSECache

2010-06-29 09:14 . 2010-06-29 09:14 -------- d-----w- c:\program files\Microsoft Synchronization Services

2010-06-29 09:12 . 2010-06-29 09:12 -------- d-----w- c:\documents and settings\All Users\Microsoft

2010-06-29 09:12 . 2010-06-29 09:12 -------- d-----w- c:\program files\Microsoft Sync Framework

2010-06-29 09:12 . 2010-06-29 09:12 -------- d-----w- c:\program files\Microsoft.NET

2010-06-29 09:12 . 2010-06-29 09:12 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition

2010-06-29 09:07 . 2010-06-29 09:07 -------- d-----w- c:\program files\Microsoft Visual Studio 8

2010-06-29 09:01 . 2010-06-29 09:01 -------- d-----w- c:\program files\Microsoft Analysis Services

2010-06-29 09:00 . 2010-06-29 09:17 -------- d-----w- c:\windows\SHELLNEW

2010-06-29 08:57 . 2010-06-29 08:57 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help

2010-06-29 08:56 . 2010-06-29 10:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-06-29 08:55 . 2010-06-29 08:55 -------- d-----r- C:\MSOCache

2010-06-29 08:52 . 2010-06-29 09:00 -------- d-----w- c:\windows\system32\NtmsData

2010-06-29 07:26 . 2010-06-29 07:26 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2010-06-29 05:09 . 2010-07-02 04:30 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-06-29 03:58 . 2010-06-29 04:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue

2010-06-29 03:58 . 2010-06-29 09:27 -------- d-----w- c:\program files\Uniblue

2010-06-28 20:08 . 2008-04-13 23:16 37888 -c--a-w- c:\windows\system32\dllcache\bthmodem.sys

2010-06-28 20:08 . 2008-04-13 23:16 37888 ----a-w- c:\windows\system32\drivers\bthmodem.sys

2010-06-26 20:27 . 2008-04-13 23:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2010-06-26 20:27 . 2008-04-13 23:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2010-06-26 20:16 . 2010-06-26 20:16 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ

2010-06-26 20:15 . 2007-04-16 04:00 69632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP8Z.DLL

2010-06-26 20:15 . 2007-04-16 04:00 27136 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD8Z.DLL

2010-06-26 20:15 . 2007-04-16 04:00 215040 ----a-w- c:\windows\system32\CNMLM8Z.DLL

2010-06-26 20:15 . 2010-06-26 20:15 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information

2010-06-26 20:15 . 2007-03-15 13:12 188416 ----a-w- c:\windows\system32\CNC310O.DLL

2010-06-26 20:15 . 2007-03-23 15:30 1400832 ----a-w- c:\windows\system32\CNC310C.DLL

2010-06-26 20:15 . 2007-03-23 15:29 98304 ----a-w- c:\windows\system32\CNC310I.DLL

2010-06-26 20:15 . 2007-03-19 09:39 200704 ----a-w- c:\windows\system32\CNC310L.DLL

2010-06-26 19:48 . 2008-04-13 23:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys

2010-06-26 19:48 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-06-25 17:04 . 2010-06-25 17:04 503808 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4babafb7-n\msvcp71.dll

2010-06-25 17:04 . 2010-06-25 17:04 499712 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4babafb7-n\jmc.dll

2010-06-25 17:04 . 2010-06-25 17:04 12800 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b4d23f2-n\decora-d3d.dll

2010-06-25 17:04 . 2010-06-25 17:04 61440 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-5b4d23f2-n\decora-sse.dll

2010-06-25 17:04 . 2010-06-25 17:04 348160 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4babafb7-n\msvcr71.dll

2010-06-25 17:02 . 2010-06-25 17:00 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-25 00:04 . 2010-06-30 17:36 -------- d-----w- c:\documents and settings\Administrator\Application Data\Lyaqy

2010-06-23 22:46 . 2010-06-25 16:59 -------- d-----w- c:\program files\Java

2010-06-23 22:45 . 2010-06-25 21:36 -------- d-----w- c:\program files\Common Files\Java

2010-06-23 21:58 . 2010-06-23 21:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-06-23 21:56 . 2010-06-23 21:57 -------- d-----w- c:\program files\Common Files\Adobe

2010-06-23 21:29 . 2010-06-23 21:29 -------- d-----w- c:\windows\system32\wbem\Repository

2010-06-23 14:31 . 2010-06-23 14:31 -------- d-----w- C:\$AVG

2010-06-23 14:28 . 2010-06-23 21:28 -------- d-----w- C:\Inetpub

2010-06-23 14:28 . 2010-06-23 14:28 -------- d-----w- c:\windows\system32\Logfiles

2010-06-23 04:08 . 2010-06-23 04:08 -------- d-----w- c:\documents and settings\Administrator\Application Data\dvdcss

2010-06-23 04:07 . 2010-07-01 14:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc

2010-06-23 04:04 . 2010-06-23 04:04 -------- d-----w- c:\program files\VideoLAN

2010-06-23 00:53 . 2010-06-30 10:01 -------- d-----w- C:\Torrentprivacy

2010-06-22 23:59 . 2010-06-29 03:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\BitTorrent

2010-06-22 23:59 . 2010-06-23 05:19 -------- d-----w- c:\program files\BitTorrent

2010-06-22 23:53 . 2010-06-22 23:53 501936 ----a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb6C.tmp.exe

2010-06-22 22:27 . 2008-04-13 23:21 101120 -c--a-w- c:\windows\system32\dllcache\bthpan.sys

2010-06-22 22:27 . 2008-04-13 23:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys

2010-06-22 22:26 . 2008-04-13 23:16 59136 -c--a-w- c:\windows\system32\dllcache\rfcomm.sys

2010-06-22 22:26 . 2008-04-13 23:16 59136 ----a-w- c:\windows\system32\drivers\rfcomm.sys

2010-06-22 22:26 . 2008-04-14 04:42 151552 -c--a-w- c:\windows\system32\dllcache\irftp.exe

2010-06-22 22:26 . 2008-04-14 04:42 151552 ----a-w- c:\windows\system32\irftp.exe

2010-06-22 22:26 . 2008-04-14 04:42 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll

2010-06-22 22:26 . 2008-04-14 04:42 8192 ----a-w- c:\windows\system32\wshirda.dll

2010-06-22 22:26 . 2008-04-14 04:41 28160 -c--a-w- c:\windows\system32\dllcache\irmon.dll

2010-06-22 22:26 . 2008-04-14 04:41 28160 ----a-w- c:\windows\system32\irmon.dll

2010-06-22 22:26 . 2008-04-13 23:16 17024 -c--a-w- c:\windows\system32\dllcache\bthenum.sys

2010-06-22 22:26 . 2008-04-13 23:16 17024 ----a-w- c:\windows\system32\drivers\BthEnum.sys

2010-06-22 22:26 . 2008-04-13 23:16 18944 -c--a-w- c:\windows\system32\dllcache\bthusb.sys

2010-06-22 22:26 . 2008-04-13 23:16 18944 ----a-w- c:\windows\system32\drivers\BTHUSB.SYS

2010-06-22 19:24 . 2010-06-22 19:24 -------- d-----w- c:\program files\MSXML 4.0

2010-06-22 18:54 . 2002-12-31 12:00 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll

2010-06-22 03:04 . 2010-06-22 03:04 -------- d-----w- C:\pnp

2010-06-22 01:40 . 2010-06-22 01:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\WildPackets

2010-06-22 01:38 . 2009-12-16 16:34 348160 ----a-w- c:\windows\system32\msvcr71.dll

2010-06-22 01:38 . 2009-12-16 16:34 1060864 ----a-w- c:\windows\system32\mfc71.dll

2010-06-22 01:37 . 2010-06-22 01:37 -------- d-----w- c:\program files\WildPackets

2010-06-22 00:52 . 2010-06-22 00:52 1078 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{8160FD56-151C-440B-B2CD-21C3D3E97EB7}\_F0057AD7FA525342B85622.exe

2010-06-22 00:52 . 2010-06-22 00:52 -------- d-----w- c:\program files\Clarisoft

2010-06-21 21:52 . 2010-06-21 21:52 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\cache

2010-06-21 19:29 . 2010-06-21 19:29 -------- d-----w- c:\windows\system32\XPSViewer

2010-06-21 19:29 . 2010-06-29 09:16 -------- d-----w- c:\program files\MSBuild

2010-06-21 19:29 . 2010-06-21 19:29 -------- d-----w- c:\program files\Reference Assemblies

2010-06-21 19:28 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll

2010-06-21 19:28 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2010-06-21 19:28 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2010-06-21 19:28 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2010-06-21 19:28 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2010-06-21 19:28 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2010-06-21 19:28 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2010-06-21 19:28 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2010-06-21 19:28 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2010-06-21 19:28 . 2010-06-21 19:28 -------- d-----w- C:\94c12bb0934f9f354ff792d06b

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Deskshare

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\windows\XSxS

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\program files\Xenocode

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Xenocode

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\program files\Common Files\Deskshare Shared

2010-06-21 19:18 . 2010-06-21 19:18 -------- d-----w- c:\program files\Deskshare

2010-06-21 09:02 . 2010-06-21 09:02 29512 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys

2010-06-21 09:02 . 2010-06-21 09:02 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys

2010-06-21 02:20 . 2010-06-21 02:20 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-06-21 01:57 . 2010-06-21 01:57 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2010-06-21 01:56 . 2010-06-21 01:56 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-06-21 01:49 . 2010-06-21 01:49 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-06-21 01:42 . 2010-05-06 10:41 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2010-06-21 01:42 . 2010-05-06 10:41 599040 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-21 01:42 . 2010-05-06 10:41 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-21 01:42 . 2010-05-06 10:41 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-21 01:42 . 2010-05-06 10:41 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll

2010-06-21 01:42 . 2010-05-06 10:41 11076096 -c----w- c:\windows\system32\dllcache\ieframe.dll

2010-06-21 01:42 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-21 01:41 . 2010-06-21 01:41 -------- d-----w- c:\windows\ie8updates

2010-06-21 01:41 . 2010-04-16 11:43 41984 -c----w- c:\windows\system32\dllcache\iecompat.dll

2010-06-21 01:40 . 2010-06-21 01:41 -------- dc-h--w- c:\windows\ie8

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-02 06:24 . 2010-06-29 23:21 112 ----a-w- c:\documents and settings\All Users\Application Data\hgTGm6Gd.dat

2010-06-29 09:32 . 2010-06-20 22:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-06-26 20:14 . 2010-06-26 20:14 -------- d--h--w- c:\program files\CanonBJ

2010-06-21 17:13 . 2010-06-20 17:02 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-06-20 23:36 . 2002-12-31 12:00 507904 ----a-w- c:\windows\system32\winlogon.exe

2010-06-20 22:38 . 2010-06-20 22:38 -------- d-----w- c:\program files\Analog Devices

2010-06-20 22:38 . 2010-06-20 22:38 -------- d-----w- c:\program files\Common Files\InstallShield

2010-06-20 17:03 . 2010-06-20 17:03 -------- d-----w- c:\program files\microsoft frontpage

2010-06-20 16:58 . 2010-06-20 16:58 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2010-06-09 08:06 . 2010-06-09 08:06 976832 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\8.2\ARM\22609\AdobeARM.exe

2010-06-09 08:06 . 2010-06-09 08:06 70584 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\8.2\ARM\22609\AdobeExtractFiles.dll

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\8.2\ARM\22609\ReaderUpdater.exe

2010-06-09 08:06 . 2010-06-09 08:06 331176 ----a-w- c:\documents and settings\All Users\Application Data\Adobe\Reader\8.2\ARM\22609\AcrobatUpdater.exe

2010-05-06 10:41 . 2002-12-31 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2002-12-31 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-20 05:30 . 2002-12-31 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll

.

<pre>
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Belkin\F5D7050v3\Belkinwcui .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
c:\program files\Microsoft Office\Office14\BCSSync .exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
</pre>

------- Sigcheck -------

[-] 2010-06-20 . 679A7259741F6A09994F02CE261B5F2E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2010-04-19 09:25 2117704 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

2010-02-28 01:20 561552 ----a-w- c:\progra~1\MICROS~2\Office14\URLREDIR.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2010-04-19 2117704]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"F5D7050v3"="c:\program files\Belkin\F5D7050v3\Belkinwcui.exe" [N/A]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [N/A]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Full Tilt Poker.lnk - c:\program files\Full Tilt Poker\FullTiltPoker.exe [2010-5-28 7626752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-06-21 01:22 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"{23FCA088-F67F-9278-AAFC-6E9F6CE0B7BA}"="c:\documents and settings\Administrator\Application Data\Xari\kohye.exe"

"CTFMON.EXE"=c:\windows\system32\ctfmon.exe

"QNB2EB90WX"=c:\docume~1\ADMINI~1\LOCALS~1\Temp\Phg.exe

"RZDVL2F27W"=c:\windows\Pziwea.exe

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"BCMSMMSG"=BCMSMMSG.exe

"BigDogPath"=c:\windows\VM_STI.EXE Philips SPC 200NC PC Camera

"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

"HotKeysCmds"=c:\windows\system32\hkcmd.exe

"IgfxTray"=c:\windows\system32\igfxtray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Torrentprivacy\\Torrent\\utorrent.exe"=

"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=

"c:\\Torrentprivacy\\SSHTunel.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [21/06/2010 02:20 216200]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [21/06/2010 02:22 242896]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [21/06/2010 02:19 916760]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [21/06/2010 02:19 308064]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [21/06/2010 00:47 136176]

S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [21/06/2010 02:21 430152]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [25/03/2010 10:25 30969208]

S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [09/01/2010 21:37 4640000]

.

Contents of the 'Scheduled Tasks' folder

2010-07-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-20 23:47]

2010-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-20 23:47]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.uk/

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

DPF: {79A0299B-199F-48BA-9CBE-7E1E60860F5D} - hxxp://www.trackthisout.com/Export.CAB

DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} - file:///H:/system/IntraLaunch.CAB

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-04 23:05

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,de,87,bd,9a,a5,3b,4b,83,c8,02,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,de,87,bd,9a,a5,3b,4b,83,c8,02,\

[HKEY_USERS\S-1-5-21-2052111302-1229272821-299502267-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4d,4e,a9,d4,e6,99,4e,4f,84,3e,db,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4d,4e,a9,d4,e6,99,4e,4f,84,3e,db,\

[HKEY_USERS\S-1-5-21-2052111302-1229272821-299502267-500\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2944)

c:\windows\system32\WININET.dll

c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf

c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2010-07-04 23:10:11 - machine was rebooted

ComboFix-quarantined-files.txt 2010-07-04 22:10

Pre-Run: 3,205,976,064 bytes free

Post-Run: 3,165,782,016 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

g:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

multi(0)disk(0)rdisk(0)partition(5)\WINDOWS="Microsoft WinXP (on Volume 4)" /fastdetect

- - End Of File - - 56AF908D6D7CBF1794244695A61B8EFE

andybid · July 5, 2010

it started going crazy again so i re ran combofix heres the result - again

ComboFix 10-07-04.04 - Administrator 05/07/2010 17:12:43.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.510.185 [GMT 1:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Application Data\a2c49f25.exe

c:\windows\Pziwea.exe

c:\windows\system32\ernel32.dll

c:\windows\system32\spool\prtprocs\w32x86\AA9kUO.dll

c:\windows\system32\spool\prtprocs\w32x86\c5sK5.dll

c:\windows\system32\spool\prtprocs\w32x86\IQ317o3.dll

c:\windows\system32\spool\prtprocs\w32x86\q7wS1e.dll

c:\windows\system32\spool\prtprocs\w32x86\w1uOCE7a.dll

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Infected copy of c:\windows\system32\msgsvc.dll was found and disinfected

Restored copy from - c:\windows\ERDNT\cache\msgsvc.dll

.

((((((((((((((((((((((((( Files Created from 2010-06-05 to 2010-07-05 )))))))))))))))))))))))))))))))

.

2010-07-05 11:39 . 2010-07-05 11:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Opera

2010-07-05 11:38 . 2010-07-05 11:38 -------- d-----w- c:\program files\Opera

2010-07-05 10:37 . 2010-07-05 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Bluetooth

2010-07-05 10:32 . 2008-04-14 04:42 53760 ----a-w- c:\windows\system32\drivers\vfwwdm32.dll

2010-07-05 10:12 . 2010-07-05 10:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia

2010-07-05 10:08 . 2010-07-05 10:08 -------- d-----w- c:\program files\DIFX

2010-07-05 10:08 . 2008-08-26 09:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys

2010-07-05 10:08 . 2010-07-05 10:08 -------- d-----w- c:\program files\PC Connectivity Solution

2010-07-05 10:08 . 2010-02-26 13:32 92672 ----a-w- c:\windows\system32\nmwcdcls.dll

2010-07-05 10:06 . 2010-07-05 10:08 -------- d-----w- c:\program files\Nokia

2010-07-05 10:06 . 2010-07-05 10:06 -------- d-----w- c:\program files\Common Files\Nokia

2010-07-05 10:06 . 2010-07-05 10:03 35607992 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\NokiaSoftwareUpdaterSetup_en.exe

2010-07-05 10:05 . 2010-07-05 10:05 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\Sleep.exe

2010-07-05 10:05 . 2010-07-05 10:05 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\msxml6Exec.exe

2010-07-05 10:05 . 2010-07-05 10:05 3203453 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{09C468CA-2940-466A-AAE8-DCC0C6E9323C}\Installer\CommonCustomActions\vcredistExec.exe

2010-07-05 10:03 . 2010-07-05 10:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations

2010-07-05 07:29 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-07-05 07:29 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll