infection help

bigugly · July 16, 2010

hello- long time MB fan, purchased it to support what you do.

i have an infection that symantic cannot remove.

it continues to come up. i have tried to run GMER, but it runs for hours and hours, maxing my computer out @ 100%. i ended up for the last 3 nights trying to get it to run overnight, but when i wake up in the morning the computer has restarted it self. my explorer asked if i want to resume my last session- so im assuming its a forced shut down, not one that is/was requested by anything.

when i try to attach my hijackthis log, uploading file just sits there and sits there........ forum issue? i guess ill try later today? could i get some assistance in getting my computer back to good health?

i was able to run defogger, and have my DDS and attach txt's done as well if needed.

thank you! keep killing bugs!

bigugly · July 20, 2010

hello MB,

unable to get support still- been a few days. hopefully it hasnt been missed on accident!

i am getting a symantic norton corporate edition catching trojan.zefarch with a file name of onereveg.dll.

it is also bringing me another file name of overlay.xul

is this of any help?

thanks!

screen317 · July 20, 2010

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post the one that is not minimized.

bigugly · July 20, 2010

here is "Attach" from DDS, and (i hope this is ok) a full scan of MBAM

thanks for responding!

currently while browsing, i get random pop ups, and symantic is popping up with random "catches".

thanks

Attach.rar

mbam_log_2010_07_19__21_55_28_.rar

screen317 · July 20, 2010

Hi,

In the future please post all logs directly in your reply instead of attaching them.

Run DDS again and this time post DDS.txt

bigugly · July 20, 2010

Hi,
In the future please post all logs directly in your reply instead of attaching them.
Run DDS again and this time post DDS.txt

im unable to get the website to accept my reply

bigugly · July 20, 2010

im unable to get the website to accept my reply

i aplogise for the misunderstanding.

ill be out of town untill friday (leaving in a few hours)

thanks!

bigugly

DDS (Ver_10-03-17.01) - NTFSx86

Run by Alex at 10:14:05.32 on Tue 07/20/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.2814 [GMT -5:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: ActiveArmor Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\svchost.exe -k HPService

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\vptray.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Alex\Desktop\dds.scr

bigugly · July 20, 2010

im sorry i cant get the forum to accept any more of the DDS log

i dont know whats going on- keeps showing that i cant show the website (like connection is lost) when i hit "add reply".

i tried all sorts of things- you'll have to use the zipped file- as thats the only way to see it.

im about to wipe this computer out and just start fresh its aggrivating me so much!

bigugly · July 20, 2010

this is the only way i can get the forum to accept it. im sorry for making your life harder

dds.rar

screen317 · July 20, 2010

Hi,

No problem.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

bigugly · July 23, 2010

Hi,
No problem.
Please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.
-screen317

combo fix:

ComboFix 10-07-22.05 - Alex 07/23/2010 9:33.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.3040 [GMT -5:00]

Running from: c:\documents and settings\Alex\Desktop\ComboFix.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: ActiveArmor Firewall *enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Alex\Recent\Thumbs.db

c:\windows\onereveg.dll

c:\windows\xpsp1hfm.log

Infected copy of c:\windows\system32\drivers\termdd.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2010-06-23 to 2010-07-23 )))))))))))))))))))))))))))))))

.

2010-07-23 13:58 . 2010-07-23 13:58 -------- d-----w- C:\32788R22FWJFW

2010-07-23 13:38 . 2010-07-23 13:38 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{1126D8BF-4480-4E38-A7A2-CB6E18EE47AD}

2010-07-20 14:43 . 2010-07-20 14:43 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{10430322-8456-446F-9CDE-B56CC1A3D11E}

2010-07-20 01:41 . 2010-07-20 01:47 317943360 ----a-w- C:\Mary Kay - Your Can Do It! Auri's Formula.bin

2010-07-20 00:20 . 2010-07-20 00:20 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{76653D6D-9769-4558-A043-E42290E1858E}

2010-07-19 20:51 . 2010-07-19 20:51 -------- d-----w- c:\documents and settings\Alli\Local Settings\Application Data\{4044F069-5964-47EC-B47F-D9D4A5AF7236}

2010-07-18 21:22 . 2010-07-18 21:22 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{A1B8FBB4-CCDB-4DFD-A253-B4B4DBA8D132}

2010-07-16 21:04 . 2010-07-16 21:04 -------- d-----w- c:\documents and settings\Alli\Local Settings\Application Data\{730051B9-1188-408F-A8AF-694E9B3AA1E5}

2010-07-16 18:54 . 2010-07-16 18:54 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{10C543B8-07C8-436C-9C2B-A736417B04E6}

2010-07-16 11:01 . 2010-07-16 11:01 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{A26A6F59-7745-489A-9179-8BBFFDA6BD27}

2010-07-16 08:45 . 2010-07-16 08:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-07-16 00:34 . 2010-07-16 00:34 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{F0DD838C-AF0A-4CFB-BCA1-D89959A1C8C0}

2010-07-15 12:36 . 2010-07-15 12:36 -------- d-----w- c:\documents and settings\Alli\Local Settings\Application Data\{F86F1C4A-EC60-4322-A6A6-D1E54E74431A}

2010-07-15 02:20 . 2010-07-15 02:20 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{9C3E3513-900B-4409-A921-55943022A3B7}

2010-07-15 01:30 . 2010-07-15 01:30 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{31D4BC33-4D65-4D41-81ED-7F5FDA55AE1B}

2010-07-14 01:35 . 2010-07-14 01:35 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{368CA09E-9A2E-41DA-8949-AAEFAA8F4A12}

2010-07-13 21:16 . 2010-07-13 21:16 -------- d-----w- c:\documents and settings\Alli\Local Settings\Application Data\{FD2BCA66-0E35-47C6-88F6-84EDEA23D963}

2010-07-13 01:38 . 2010-07-13 01:38 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{01A7BF56-9FEF-474A-92FD-BD606DB4C259}

2010-07-12 23:24 . 2010-07-12 23:24 -------- d-----w- c:\documents and settings\Alli\Local Settings\Application Data\{5FA9B664-551E-4A84-B40E-21A2DCCB7A3C}

2010-07-12 01:40 . 2010-07-12 01:40 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{CD5C45A2-85DF-4EAA-A6F7-62AA8F41C4F0}

2010-07-11 22:28 . 2010-07-18 17:25 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-11 21:28 . 2010-07-11 21:28 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{10223AA0-7184-420B-BFF7-C6DA251FD68D}

2010-07-11 21:22 . 2010-07-11 21:22 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-07-11 21:10 . 2010-07-23 13:38 120 ----a-w- c:\windows\Iqiciqefameteqar.dat

2010-07-11 21:10 . 2010-07-23 13:38 0 ----a-w- c:\windows\Wlipimeq.bin

2010-07-11 21:10 . 2010-07-11 21:10 -------- d-----w- c:\documents and settings\Alex\Local Settings\Application Data\{186490D6-73FE-41BA-9C09-7A9C3C17E83E}

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-23 14:32 . 2008-03-05 01:59 -------- d-----w- c:\program files\Symantec AntiVirus

2010-07-20 17:04 . 2009-02-11 03:33 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-07-12 01:39 . 2009-01-02 01:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-02 23:42 . 2008-02-29 03:43 23272 ----a-w- c:\documents and settings\Alli\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-02 23:41 . 2010-05-23 18:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MyPoiWorld

2010-06-07 22:08 . 2010-06-07 22:08 -------- d-----w- c:\documents and settings\Alli\Application Data\ImgBurn

2010-06-07 21:35 . 2008-02-28 07:10 -------- d-----w- c:\program files\Microsoft Silverlight

2010-05-23 18:07 . 2008-02-28 06:18 23272 ----a-w- c:\documents and settings\Alex\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-05-06 10:41 . 2001-08-23 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2001-08-23 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 20:39 . 2010-03-26 02:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 20:39 . 2010-03-26 02:35 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.

------- Sigcheck -------

[-] 2010-01-09 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\TCPIP.SYS

[-] 2010-01-09 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\TCPIP.SYS

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys

[7] 2008-06-20 . 2A5554FC5B1E04E131230E3CE035C3F9 . 360320 . . [5.1.2600.3394] . . c:\windows\$NtServicePackUninstall$\tcpip.sys

[7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys

[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys

[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\TCPIP.SYS

[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtUninstallKB951748_0$\tcpip.sys

[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys

[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB941644$\tcpip.sys

[-] 2001-08-23 . E7774698BB0D14B0710A9A31E209F9B6 . 327168 . . [5.1.2600.0] . . c:\windows\SoftwareDistribution\Download\eb5ff0ae9fdaa24285c4924997a7aa90\backup\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-10-04 48752]

"vptray"="c:\progra~1\SYMANT~1\\vptray.exe" [2005-11-15 85744]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-06-17 40368]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-06-17 06:24 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AsusStartupHelp]

2006-11-14 06:25 363008 ----a-r- c:\program files\ASUS\AASP\1.00.17\AsRunHelp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-12 22:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]

2006-10-30 12:44 1953792 ------r- c:\windows\system32\JMRaidSetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]

2006-10-30 12:44 36864 ------r- c:\windows\JM\JMInsIDE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyPoi Monitor]

2010-03-26 21:10 2114808 ----a-w- c:\program files\Common Files\MyPoiWorld Shared\MyPoiMonitor\MyPoiMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw]

2006-02-17 17:40 270336 ----a-w- c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2009-05-01 05:30 13750272 ----a-w- c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2009-05-01 05:30 86016 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

2009-05-01 05:31 1657376 ----a-w- c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-11-11 05:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2006-11-14 09:21 16270848 ------r- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]

2006-05-16 10:04 2879488 ------r- c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-03-09 10:19 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"iPod Service"=3 (0x3)

"Apple Mobile Device"=2 (0x2)

"nSvcLog"=2 (0x2)

"nSvcIp"=2 (0x2)

"ForcewareWebInterface"=2 (0x2)

"ForceWare Intelligent Application Manager (IAM)"=2 (0x2)

"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Documents and Settings\\Alex\\Desktop\\ksd\\C1KSD\\C1KSD.exe"=

"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\MyPoi Manager\\MyPoiManager.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/25/2010 9:35 PM 304464]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/28/2010 8:36 PM 102448]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/25/2010 9:35 PM 20952]

S3 SaiH0464;SaiH0464;c:\windows\system32\drivers\SaiH0464.sys [11/3/2005 11:52 AM 136832]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [11/15/2005 2:27 PM 169200]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2010-05-05 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://pirate4x4.com/forum/usercp.php

uInternet Settings,ProxyServer = http=127.0.0.1:5555

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

TCP: {5CF3239D-C0CB-499F-A206-0DCAE33841B0} = 68.87.85.102,68.87.69.150

DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB

.

------- File Associations -------

.

.txt=

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-Oyeqowaqifih - c:\windows\onereveg.dll

MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe

MSConfigStartUp-hpqSRMon - c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe

MSConfigStartUp-MsnMsgr - c:\program files\Windows Live\Messenger\MsnMsgr.Exe

AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\Alex\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-23 09:43

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1220)

c:\windows\system32\nvappfilter.dll

.

Completion time: 2010-07-23 09:49:40

ComboFix-quarantined-files.txt 2010-07-23 14:49

ComboFix2.txt 2009-03-08 05:26

Pre-Run: 35,625,095,168 bytes free

Post-Run: 36,267,323,392 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 34C0BA7945B6D3ED7460698144DC22B8

-------------------------------

DDS log