More problems - Help! Maniac

cgrammie2 · July 11, 2010

Looks like MBAM has detected infection again (and took 7 hours!! to run full scan versus 2+ hours a couple days ago) - see most recent log below. Still getting some google redirects as well - Just spent WEEKS working with Maniac trying to get my computer cleaned up - he had me run what seems like every scan known to man - LOL!! (By the way I received excellent service from him.)

Where do I go from here?

--------------------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4300

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

7/10/2010 9:40:45 PM

mbam-log-2010-07-10 (21-40-45).txt

Scan type: Full scan (C:\|)

Objects scanned: 220938

Time elapsed: 7 hour(s), 8 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\MS Essentials (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Elise · July 11, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
GMER log

cgrammie2 · July 14, 2010

Hello ,
And My name is Elise and I'll be glad to help you with your computer problems.
I will be working on your malware issues, this may or may not solve other issues you may have with your machine.
Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.
-----------------------------------------------------------
If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.
If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.
If you have already posted a log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.
We need to see some information about what is happening in your machine. Please perform the following scan:
Please download OTL from one of the following mirrors:
This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the button.
[*]Two reports will open, copy and paste them in a reply here:
OTListIt.txt <-- Will be opened
Extra.txt <-- Will be minimized
Please download GMER from one of the following locations and save it to your desktop:
Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.
-------------------------------------------------------------
In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem
If you still need help, please include the following in your next reply
A detailed description of your problems
A new OTL log (don't forget extra.txt)
GMER log

Hello Elise - Thank you for your help - GMER log is posted below - OTL and Extras are attached:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-07-14 05:00:59

Windows 5.1.2600 Service Pack 3

Running: y9gonk8b.exe; Driver: C:\DOCUME~1\LINDAC~1\LOCALS~1\Temp\axldqpoc.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xEEB33CD2]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xEEB33B8E]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteKey [0xEEB34142]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xEEB3406C]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xEEB33764]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xEEB33C68]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xEEB336A4]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xEEB33708]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xEEB33D88]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRenameKey [0xEEB34210]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xEEB33D48]

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xEEB33EC8]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xEEB40B9C]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xEEB409C0]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xEEB40AFA]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE ntoskrnl.exe!ObInsertObject 8056503A 5 Bytes JMP EEB3DF6C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!NtCreateSection 805652B3 7 Bytes JMP EEB409C4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!ZwCreateProcessEx 8057FE4C 7 Bytes JMP EEB40BA0 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!ObMakeTemporaryObject 8059F8CA 5 Bytes JMP EEB3C5B4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

PAGE ntoskrnl.exe!ZwLoadDriver 805A3B73 7 Bytes JMP EEB40AFE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)

? C:\WINDOWS\system32\bfbe.sys The process cannot access the file because it is being used by another process.

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00390002

IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00390000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \FileSystem\Fastfat \Fat EDBADD20

AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- EOF - GMER 1.0.15 ----

Extras.Txt

OTL.Txt

Elise · July 14, 2010

Lets see what more we can find out. BTW, no need to quote my posts, just use the Add Reply button.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

cgrammie2 · July 16, 2010

Hi Elise -

Here's my combofix log - I received the following message while ComboFix was running: "PEV.cfxxe has encountered a problem and needs to close". I rec'd this same message while running ComboFix when Maniac instructed me to do so. Also FYI I never rec'd the prompt to install the Microsoft Windows Recovery Console - not sure if I already have this installed or not. And whenever I do a search for my comments in this forum the only thing that comes up is the closed comments from when Maniac was helping me to clean my computer.

Thanks for your help!

------------------------------------------------------------------

ComboFix 10-07-15.05 - Linda Cross 07/16/2010 11:14:32.7.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.518 [GMT -7:00]

Running from: c:\documents and settings\Linda Cross\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2010-06-16 to 2010-07-16 )))))))))))))))))))))))))))))))

.

2010-07-05 02:16 . 2010-07-05 02:16 -------- d-----w- c:\program files\Alwil Software

2010-07-05 02:16 . 2010-07-05 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-07-04 21:01 . 2010-07-16 18:04 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-07-02 12:25 . 2010-07-02 12:51 -------- d-----w- C:\Combo-Fix6515C

2010-06-29 14:24 . 2010-06-29 14:24 -------- d-----w- c:\windows\Sun

2010-06-29 14:22 . 2010-06-29 14:22 503808 ----a-w- c:\documents and settings\Linda Cross\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7bbc936b-n\msvcp71.dll

2010-06-29 14:22 . 2010-06-29 14:22 499712 ----a-w- c:\documents and settings\Linda Cross\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7bbc936b-n\jmc.dll

2010-06-29 14:22 . 2010-06-29 14:22 -------- d-----w- c:\program files\Common Files\Java

2010-06-29 14:22 . 2010-06-29 14:22 348160 ----a-w- c:\documents and settings\Linda Cross\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7bbc936b-n\msvcr71.dll

2010-06-29 14:22 . 2010-06-29 14:22 12800 ----a-w- c:\documents and settings\Linda Cross\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3acd0449-n\decora-d3d.dll

2010-06-29 14:22 . 2010-06-29 14:22 61440 ----a-w- c:\documents and settings\Linda Cross\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3acd0449-n\decora-sse.dll

2010-06-29 14:21 . 2010-06-29 14:20 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-29 14:20 . 2010-06-29 14:20 -------- d-----w- c:\program files\Java

2010-06-29 14:04 . 2010-06-29 14:04 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-06-29 14:02 . 2010-06-29 14:02 71680 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

2010-06-29 14:02 . 2010-06-29 14:12 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-06-29 13:48 . 2010-06-29 13:48 -------- d-----w- C:\Combo-Fix

2010-06-29 04:18 . 2010-06-29 05:28 -------- d-----w- c:\windows\SxsCaPendDel

2010-06-28 03:29 . 2010-07-16 18:14 -------- d-----w- c:\windows\system32\CatRoot2

2010-06-27 12:47 . 2006-11-01 13:06 162616 ----a-w- c:\windows\RegDelNull.exe

2010-06-24 14:06 . 2001-08-18 05:36 53760 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll

2010-06-24 14:05 . 2001-08-17 19:12 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys

2010-06-24 14:04 . 2001-08-18 05:36 12288 ----a-w- c:\windows\system32\dllcache\EXCH_smtpctrs.dll

2010-06-24 14:03 . 2001-08-17 19:50 75392 ----a-w- c:\windows\system32\dllcache\s3savmxm.sys

2010-06-24 14:02 . 2008-04-13 18:41 17664 ----a-w- c:\windows\system32\dllcache\ppa3.sys

2010-06-24 14:01 . 2001-08-17 19:50 198144 ----a-w- c:\windows\system32\dllcache\nv3.sys

2010-06-24 14:00 . 2001-08-18 05:36 7168 ----a-w- c:\windows\system32\dllcache\mxport.dll

2010-06-24 14:00 . 2001-08-17 20:49 19968 ----a-w- c:\windows\system32\dllcache\mxnic.sys

2010-06-24 14:00 . 2001-08-18 05:36 19968 ----a-w- c:\windows\system32\dllcache\mxicfg.dll

2010-06-24 14:00 . 2001-08-17 20:50 21888 ----a-w- c:\windows\system32\dllcache\mxcard.sys

2010-06-24 14:00 . 2002-08-29 10:00 229439 ----a-w- c:\windows\system32\dllcache\multibox.dll

2010-06-24 14:00 . 2001-08-17 19:50 103296 ----a-w- c:\windows\system32\dllcache\mtxvideo.sys

2010-06-24 14:00 . 2008-04-13 18:39 5504 ----a-w- c:\windows\system32\dllcache\mstee.sys

2010-06-24 14:00 . 2008-04-13 18:46 49024 ----a-w- c:\windows\system32\dllcache\mstape.sys

2010-06-24 14:00 . 2001-08-17 20:48 12416 ----a-w- c:\windows\system32\dllcache\msriffwv.sys

2010-06-24 14:00 . 2001-08-17 21:00 2944 ----a-w- c:\windows\system32\dllcache\msmpu401.sys

2010-06-24 14:00 . 2008-04-13 18:54 22016 ----a-w- c:\windows\system32\dllcache\msircomm.sys

2010-06-24 14:00 . 2002-08-29 10:00 98304 ----a-w- c:\windows\system32\dllcache\msir3jp.dll

2010-06-24 13:58 . 2001-08-18 05:36 58368 ----a-w- c:\windows\system32\dllcache\m3091dc.dll

2010-06-24 13:57 . 2001-08-17 19:12 45632 ----a-w- c:\windows\system32\dllcache\ip5515.sys

2010-06-24 13:56 . 2001-08-18 05:36 165888 ----a-w- c:\windows\system32\dllcache\hpgt53.dll

2010-06-24 13:55 . 2002-08-29 10:00 31744 ----a-w- c:\windows\system32\dllcache\esucmd.dll

2010-06-24 13:54 . 2001-08-17 19:13 91305 ----a-w- c:\windows\system32\dllcache\dimaint.sys

2010-06-24 13:53 . 2001-08-17 20:57 248064 ----a-w- c:\windows\system32\dllcache\cl546xm.sys

2010-06-24 13:52 . 2001-08-17 20:51 13824 ----a-w- c:\windows\system32\dllcache\bulltlp3.sys

2010-06-24 13:51 . 2001-08-17 19:49 26880 ----a-w- c:\windows\system32\dllcache\atirtsnd.sys

2010-06-24 13:50 . 2001-08-17 21:56 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll

2010-06-19 14:13 . 2010-06-19 15:06 -------- d-----w- c:\documents and settings\Linda Cross\DoctorWeb

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-16 18:10 . 2010-04-30 22:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-16 18:04 . 2007-12-09 18:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-07-10 16:55 . 2004-03-25 01:45 -------- d-----w- c:\program files\Lexmark X1100 Series

2010-07-05 02:32 . 2009-10-06 03:36 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2010-07-05 02:31 . 2003-04-30 15:31 -------- d-----w- c:\program files\McAfee.com

2010-07-04 13:58 . 2009-10-06 05:33 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore

2010-07-02 12:15 . 2007-10-02 20:17 -------- d-----w- c:\program files\My Kazaa Gold

2010-06-29 14:05 . 2003-05-28 23:31 -------- d-----w- c:\program files\Common Files\Adobe

2010-06-17 13:22 . 2009-10-20 21:09 -------- d-----w- c:\program files\Windows Defender

2010-06-14 14:31 . 2002-08-29 10:00 744448 ----a-w- c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe

2010-06-02 23:04 . 2010-04-29 03:23 -------- d-----w- c:\documents and settings\Linda Cross\Application Data\Malwarebytes

2010-06-02 23:04 . 2010-04-29 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-06-02 05:23 . 2010-06-01 07:14 7168 ----a-w- c:\windows\system32\drivers\utqxodiy.sys

2010-05-24 22:27 . 2010-05-24 22:27 4224 ----a-w- c:\windows\system32\drivers\RDPCDD.SYS

2010-05-21 21:14 . 2009-10-20 21:18 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-05-20 17:09 . 2010-05-15 19:13 -------- d-----w- c:\program files\RegWork

2010-05-20 13:28 . 2010-05-20 12:47 7304 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg

2010-05-20 01:55 . 2010-05-20 01:55 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard

2010-05-20 01:53 . 2010-05-20 01:53 -------- d-----w- c:\program files\Common Files\iS3

2010-05-12 05:27 . 2003-05-12 01:18 105656 -c--a-w- c:\documents and settings\Linda Cross\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-05-06 10:41 . 2004-08-24 03:32 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2002-08-29 10:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-25 23:39 . 2010-04-16 23:43 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-21 17:15 . 2010-04-21 17:15 75264 ----a-w- c:\windows\system32\bfbe.sys

2010-04-20 05:30 . 2002-08-29 10:00 285696 ----a-w- c:\windows\system32\atmfd.dll

.

((((((((((((((((((((((((((((( SnapShot@2010-07-02_12.46.33 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-07-16 14:44 . 2010-07-16 14:44 16384 c:\windows\Temp\Perflib_Perfdata_498.dat

+ 2002-09-03 07:08 . 2010-07-05 00:48 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT

- 2002-09-03 07:08 . 2010-07-02 10:46 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT

+ 2002-09-03 07:08 . 2010-07-05 00:48 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

- 2002-09-03 07:08 . 2010-07-02 10:46 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

+ 2010-07-02 15:01 . 2010-07-05 00:48 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat

- 2010-06-29 06:10 . 2010-07-02 10:46 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat

- 2006-06-30 13:35 . 2010-06-09 00:28 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe

- 2002-08-29 10:00 . 2008-04-14 00:12 744448 c:\windows\SYSTEM32\DLLCACHE\helpsvc.exe

+ 2002-08-29 10:00 . 2010-06-14 14:31 744448 c:\windows\SYSTEM32\DLLCACHE\helpsvc.exe

+ 2009-10-06 09:27 . 2010-07-05 00:48 245760 c:\windows\SYSTEM32\CONFIG\systemprofile\IETldCache\index.dat

- 2009-10-06 09:27 . 2010-07-02 10:46 245760 c:\windows\SYSTEM32\CONFIG\systemprofile\IETldCache\index.dat

+ 2006-06-30 13:35 . 2010-07-14 05:05 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe

+ 2006-06-30 13:35 . 2010-07-14 05:05 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe

- 2006-06-30 13:35 . 2010-06-09 00:28 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe

+ 2010-05-25 18:45 . 2010-05-25 18:45 8445440 c:\windows\Installer\2254da8.msp

+ 2010-07-01 05:52 . 2010-07-01 05:52 5522944 c:\windows\Installer\2254d95.msp

+ 2005-05-11 20:37 . 2010-07-02 19:39 34045896 c:\windows\SYSTEM32\MRT.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=

"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=

"c:\\Program Files\\360Share\\Gui\\360Share.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=

R1 bfbe;bfbe;c:\windows\SYSTEM32\bfbe.sys [4/21/2010 10:15 AM 75264]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

S1 MpKsla3c22b50;MpKsla3c22b50;\??\c:\windows\system32\MpEngineStore\MpKsla3c22b50.sys --> c:\windows\system32\MpEngineStore\MpKsla3c22b50.sys [?]

S3 diskchk;diskchk;\??\c:\windows\system32\diskchk.sys --> c:\windows\system32\diskchk.sys [?]

S3 utqxodiy;AVZ Kernel Driver;c:\windows\SYSTEM32\DRIVERS\utqxodiy.sys [6/1/2010 12:14 AM 7168]

--- Other Services/Drivers In Memory ---

*Deregistered* - avast! Mail Scanner

.

Contents of the 'Scheduled Tasks' folder

2010-07-16 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20]

2010-07-15 c:\windows\Tasks\User_Feed_Synchronization-{0BF8426D-E159-4E88-8E75-FD433358A530}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://phoenix.cox.net/cci/home

uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

- - - - ORPHANS REMOVED - - - -

SafeBoot-mcmscsvc

SafeBoot-MCODS

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-16 11:21

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1241913026-665132261-2367862541-1006\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3036)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\mshtml.dll

c:\windows\system32\msls31.dll

c:\windows\IME\SPGRMR.DLL

c:\program files\Common Files\Microsoft Shared\Ink\SKCHUI.DLL

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-07-16 11:24:52

ComboFix-quarantined-files.txt 2010-07-16 18:24

ComboFix2.txt 2010-07-02 14:07

ComboFix3.txt 2010-07-02 12:51

ComboFix4.txt 2010-06-29 05:41

Pre-Run: 42,098,008,064 bytes free

Post-Run: 42,157,903,872 bytes free

- - End Of File - - B77EA0F0D2036F6FC710A2F075DCC6B4

Elise · July 16, 2010

I think I have found the culprit here. Please let me know how things run after the following fix. :angry:

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Driver::
bfbe
diskchk

File::
c:\windows\SYSTEM32\bfbe.sys
c:\windows\system32\diskchk.sys

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

cgrammie2 · July 16, 2010

Hi Elise -

Here's the newest combofix log.

thanks!

----------------------------------------------------------

ComboFix 10-07-15.05 - Linda Cross 07/16/2010 15:43:16.8.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.701 [GMT -7:00]

Running from: c:\documents and settings\Linda Cross\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Linda Cross\Desktop\CFScript.txt

FILE ::

"c:\windows\SYSTEM32\bfbe.sys"

"c:\windows\system32\diskchk.sys"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\SYSTEM32\bfbe.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_BFBE

-------\Legacy_DISKCHK

-------\Service_bfbe

-------\Service_diskchk

((((((((((((((((((((((((( Files Created from 2010-06-16 to 2010-07-16 )))))))))))))))))))))))))))))))

.

2010-07-05 02:16 . 2010-07-05 02:16 -------- d-----w- c:\program files\Alwil Software

2010-07-05 02:16 . 2010-07-05 02:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-07-04 21:01 . 2010-07-16 18:32 -------- d-----w- c:\program files\Spybot - Search & Destroy