Antimalware Doctor, IP Blocks, Redirects

MBAB_Saved_My_A · July 17, 2010

Hello,

Thanks in advance for you assistance.

I think I cleaned up most of the mess, but I'm still getting malicious website IP blocks. I followed the instructions in the "I'm infected - What do I do now?" thread. I could get everything to work, except when GMER was done scanning, and I tried to save the log, everything freezes, so I cannot provide the ark.txt file.

I also found a file in C:\WINDOWS\SYSTEM32\DRIVERS called fbjgfu.sys that was preventing my system from booting up. I renamed it "fu.bak" just to be able to boot up. Also, I can see all those hxxp redirects in the dds.txt file.

I kept the attach.txt file as txt, and not zip, since I don't have the art.txt file.

Here are my scan logs:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Hands at 12:35:23.56 on Sat 07/17/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1337 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

C:\WINDOWS\System32\wltrysvc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\WLTRAY.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Documents and Settings\Hands\Local Settings\Application Data\Google\Update\1.2.183.23\GoogleCrashHandler.exe

C:\Documents and Settings\Hands\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Hands\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyServer = http=127.0.0.1:5643

uInternet Settings,ProxyOverride = <local>

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

mRun: [Motorola Wireless Manager UI] c:\windows\system32\WLTRAY

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [Logitech Utility] Logi_MwX.Exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: c:\progra~1\whalec~1\client~1\31265d~1.0\WhlLSP.dll

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264708318826

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265950103521

DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} - hxxps://portal.battelle.org/InternalSite/WhlCompMgr.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [2010-5-16 11448]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-1-29 216400]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-1-29 29584]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-1-29 243024]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-16 308136]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-7-15 304464]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-7-15 20952]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-5-14 2106880]

S0 fbjgfu;fbjgfu; [x]

S3 DMService;Whale Component Manager;c:\windows\downlo~1\DMService.exe [2010-2-3 423576]

S3 naecd;naecd;\??\c:\docume~1\hands\locals~1\temp\naecd.sys --> c:\docume~1\hands\locals~1\temp\naecd.sys [?]

=============== Created Last 30 ================

2010-07-17 02:50:34 176 ----a-w- c:\documents and settings\hands\defogger_reenable

2010-07-17 02:25:09 1048576 ----a-w- c:\windows\M4A77TD-ASUS-2007.ROM

2010-07-17 02:24:54 650134 ----a-w- c:\windows\M4A77TD-ASUS-2007.zip

2010-07-16 23:56:12 0 d-----w- c:\docume~1\alluse~1\applic~1\F-Secure

2010-07-16 22:08:12 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-07-16 22:08:12 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-16 12:25:32 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-15 04:41:45 0 d-----w- c:\docume~1\hands\applic~1\Malwarebytes

2010-07-15 04:41:37 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-15 04:41:36 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-15 04:41:36 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-15 04:41:36 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-07-15 01:33:45 2556 ----a-w- c:\windows\lsrslt.ini

2010-07-15 01:26:03 0 ----a-w- c:\windows\system32\drivers\fu.bak

2010-07-04 20:16:26 0 d-----w- c:\program files\common files\DivX Shared

2010-07-04 20:15:59 0 d-----w- c:\program files\DivX

2010-07-04 20:15:19 0 d-----w- c:\docume~1\alluse~1\applic~1\DivX

2010-06-29 04:53:01 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2010-06-18 22:25:45 0 d-----w- c:\program files\MSECache

==================== Find3M ====================

2010-07-16 23:58:17 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-16 12:25:33 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-16 12:25:03 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-06-28 21:30:26 23496 ----a-w- c:\docume~1\hands\applic~1\GDIPFONTCACHEV1.DAT

2010-06-17 06:21:34 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2010-06-17 04:54:32 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-06-03 02:41:44 3600384 ----a-w- c:\windows\system32\GPhotos.scr

============= FINISH: 12:37:06.56 ===============

Attach.txt

mbam_log_2010_07_17__19_15_17_.txt

RPMcMurphy · July 18, 2010

Hello and welcome to Malwarebytes. Please follow these guidelines while we work on your PC:

[*]Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I

MBAB_Saved_My_A · July 18, 2010

I tried to run RKUnhooker.exe, however it failed. When it started the Code Hooks scan, I received an error message (attached).

RPMcMurphy · July 18, 2010

Thanks for trying. Please run this now:

Download ComboFix from one of the following locations:

Link 1

Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:

ComboFix log

MBAB_Saved_My_A · July 18, 2010

ComboFix 10-07-16.02 - Hands 07/18/2010 12:31:37.1.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1601 [GMT -4:00]

Running from: c:\documents and settings\Hands\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *On-access scanning enabled* (Outdated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\NetworkService\Local Settings\Application Data\Windows Server

c:\windows\system32\_000003_.tmp.dll

c:\windows\system32\_000005_.tmp.dll

c:\windows\system32\_000006_.tmp.dll

c:\windows\system32\_000007_.tmp.dll

c:\windows\system32\_000008_.tmp.dll

c:\windows\system32\_000009_.tmp.dll

c:\windows\system32\_000010_.tmp.dll

c:\windows\system32\_000012_.tmp.dll

Infected copy of c:\windows\system32\drivers\wmiacpi.sys was found and disinfected

Restored copy from - Kitty had a snack :lol:

.

((((((((((((((((((((((((( Files Created from 2010-06-18 to 2010-07-18 )))))))))))))))))))))))))))))))

.

2010-07-18 06:21 . 2010-07-18 06:21 -------- d-----w- c:\program files\Microsoft Security Essentials

2010-07-18 06:14 . 2010-07-18 06:17 -------- d-----w- C:\22987e4bcb09d00e9fa6fd

2010-07-17 23:03 . 2010-07-17 23:03 -------- d-----w- c:\documents and settings\LocalService\Application Data\Malwarebytes

2010-07-17 02:24 . 2010-07-17 02:25 650134 ----a-w- c:\windows\M4A77TD-ASUS-2007.zip

2010-07-16 23:56 . 2010-07-16 23:56 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure

2010-07-16 22:08 . 2010-07-16 22:08 -------- d-----w- c:\program files\Common Files\Java

2010-07-16 22:08 . 2010-07-16 22:08 503808 ----a-w- c:\documents and settings\Hands\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4004c7ed-n\msvcp71.dll

2010-07-16 22:08 . 2010-07-16 22:08 499712 ----a-w- c:\documents and settings\Hands\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4004c7ed-n\jmc.dll

2010-07-16 22:08 . 2010-07-16 22:08 348160 ----a-w- c:\documents and settings\Hands\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-4004c7ed-n\msvcr71.dll

2010-07-16 22:08 . 2010-07-16 22:08 61440 ----a-w- c:\documents and settings\Hands\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-484598ff-n\decora-sse.dll

2010-07-16 22:08 . 2010-07-16 22:08 12800 ----a-w- c:\documents and settings\Hands\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-484598ff-n\decora-d3d.dll

2010-07-16 22:08 . 2010-07-16 22:07 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-15 21:16 . 2010-07-15 21:16 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2010-07-15 13:23 . 2010-07-15 21:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\ydujvjitr

2010-07-15 04:41 . 2010-07-15 04:41 -------- d-----w- c:\documents and settings\Hands\Application Data\Malwarebytes

2010-07-15 04:41 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-15 04:41 . 2010-07-15 21:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-15 04:41 . 2010-07-15 04:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-15 04:41 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-15 02:55 . 2010-07-15 02:55 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-07-15 02:05 . 2010-07-15 02:05 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-07-15 01:37 . 2010-07-15 01:37 -------- d-----w- c:\documents and settings\LocalService\Application Data\XCRYSoft

2010-07-15 01:26 . 2010-07-15 01:26 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2010-07-14 00:10 . 2010-07-14 00:10 -------- d-----w- c:\documents and settings\Hands\Application Data\DivX

2010-07-04 20:17 . 2010-07-04 20:17 56765 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-07-04 20:17 . 2010-07-04 20:17 56997 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-07-04 20:15 . 2010-07-04 20:17 -------- d-----w- c:\program files\DivX

2010-07-04 20:15 . 2010-07-04 20:17 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe

2010-07-04 20:15 . 2010-07-04 20:17 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX

2010-06-29 04:53 . 2010-06-30 22:28 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2010-06-18 22:25 . 2010-06-18 22:25 -------- d-----w- c:\program files\MSECache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-17 03:59 . 2010-07-15 01:26 0 ----a-w- c:\windows\system32\drivers\fu.bak

2010-07-16 23:58 . 2010-05-16 06:49 1984 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-16 22:06 . 2010-01-28 21:43 -------- d-----w- c:\program files\Common Files\Adobe

2010-07-15 03:09 . 2010-05-29 14:05 932344 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2010-07-15 02:34 . 2010-05-17 02:44 -------- d-----w- c:\program files\TweakNow RegCleaner

2010-07-15 02:32 . 2010-06-16 00:39 -------- d-----w- c:\documents and settings\Hands\Application Data\uTorrent

2010-07-15 02:31 . 2010-04-20 00:02 -------- d-----w- c:\documents and settings\Hands\Application Data\BitTorrent

2010-07-12 04:43 . 2010-01-29 07:56 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files

2010-07-04 20:17 . 2010-07-04 20:16 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-07-04 20:17 . 2010-07-04 20:16 1062184 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll

2010-07-04 20:16 . 2010-07-04 20:16 53600 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 57532 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 57054 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 54166 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 56458 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 54174 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 57409 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ControlPanel\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 52963 ----a-w- c:\documents and settings\All Users\Application Data\DivX\MSVC80CRTRedist\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 54073 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Qt4.5\Uninstaller.exe

2010-07-04 20:16 . 2010-07-04 20:16 -------- d-----w- c:\program files\Common Files\DivX Shared

2010-07-04 20:16 . 2010-07-04 20:16 56969 ----a-w- c:\documents and settings\All Users\Application Data\DivX\ASPEncoder\Uninstaller.exe

2010-07-04 20:15 . 2010-07-04 20:16 895256 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe

2010-06-28 01:37 . 2010-01-28 21:37 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-06-20 05:16 . 2010-01-28 19:48 23496 ----a-w- c:\documents and settings\Hands\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-17 06:21 . 2010-06-17 06:21 -------- d--h--r- c:\documents and settings\Hands\Application Data\SecuROM

2010-06-17 06:21 . 2010-06-17 06:21 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2010-06-17 05:01 . 2010-06-17 04:53 -------- d-----w- c:\documents and settings\Hands\Application Data\DAEMON Tools Lite

2010-06-17 04:57 . 2010-06-17 04:54 -------- d-----w- c:\program files\DAEMON Tools Lite

2010-06-17 04:54 . 2010-06-17 04:54 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-06-17 04:54 . 2010-06-17 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite

2010-06-16 00:40 . 2010-06-16 00:40 -------- d-----w- c:\program files\uTorrent

2010-06-12 06:11 . 2010-02-20 05:29 -------- d-----w- c:\documents and settings\Hands\Application Data\AdventureTools

2010-06-04 20:30 . 2010-02-08 00:33 -------- d-----w- c:\program files\Microsoft Silverlight

2010-06-03 02:41 . 2010-06-03 02:41 3600384 ----a-w- c:\windows\system32\GPhotos.scr

2010-05-26 01:35 . 2010-05-26 01:35 -------- d-----w- c:\documents and settings\Hands\Application Data\Apple Computer

2010-05-26 01:35 . 2010-05-26 01:34 -------- d-----w- c:\program files\QuickTime

2010-05-26 01:34 . 2010-05-26 01:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-05-26 01:34 . 2010-05-26 01:34 -------- d-----w- c:\program files\Common Files\Apple

2010-05-26 01:34 . 2010-05-26 01:34 -------- d-----w- c:\program files\Apple Software Update

2010-05-26 01:34 . 2010-05-26 01:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-05-16 05:25 . 2010-04-24 02:06 537 ----a-w- c:\documents and settings\Hands\Application Data\Splitscreen Studios\Pirate Galaxy\updates\update.bat

2010-05-16 05:25 . 2010-03-10 10:42 320928 ----a-w- c:\documents and settings\Hands\Application Data\Splitscreen Studios\Pirate Galaxy\Launcher.exe

2010-05-03 18:30 . 2010-05-03 18:30 1078 ----a-r- c:\documents and settings\Hands\Application Data\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\DocumentationShortcu_EDEA8AB776834ED2AA19E6C078064C0D.exe

2010-05-03 18:30 . 2010-05-03 18:30 10134 ----a-r- c:\documents and settings\Hands\Application Data\Microsoft\Installer\{EDEA8AB7-7683-4ED2-AA19-E6C078064C0D}\ARPPRODUCTICON.exe

2010-04-24 02:05 . 2010-04-24 02:05 60600 ----a-w- c:\documents and settings\Hands\Application Data\Splitscreen Studios\Pirate Galaxy\uninstall.exe

2010-04-24 01:34 . 2010-04-24 01:34 29184 ----a-w- c:\documents and settings\Hands\Application Data\PirateGalaxy\putenv.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Motorola Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]

"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2010-01-18 33714176]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-04-03 110696]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-03 13670504]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]

"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-06-09 08:06 976832 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HDAudDeck]

2010-01-18 14:49 33714176 ----a-w- c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2010-04-03 23:23 110696 ----a-w- c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 15:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"UPS"=3 (0x3)

"srservice"=2 (0x2)

"SCardSvr"=3 (0x3)

"seclogon"=2 (0x2)

"FastUserSwitchingCompatibility"=3 (0x3)

"WMPNetworkSvc"=3 (0x3)

"idsvc"=3 (0x3)

"mnmsrvc"=3 (0x3)

"JavaQuickStarterService"=2 (0x2)

"gusvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"e:\\Games\\Turbine\\The Lord of the Rings Online\\lotroclient.exe"=

"e:\\Games\\Turbine\\DDO Unlimited\\dndclient.exe"=

"c:\\Program Files\\Whale Communications\\Client Components\\3.1.0\\WhlClnt3.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"e:\\Games\\Steam\\Steam.exe"=

"c:\\WINDOWS\\system32\\dxdiag.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"e:\\Games\\Neverwinter Nights 2\\nwn2main.exe"=

"e:\\Games\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=

"e:\\Games\\Neverwinter Nights 2\\nwupdate.exe"=

"e:\\Games\\Neverwinter Nights 2\\nwn2server.exe"=

"e:\\Games\\Turbine\\beta\\lotroclient.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"57597:TCP"= 57597:TCP:Pando Media Booster

"57597:UDP"= 57597:UDP:Pando Media Booster

R1 AsUpIO;AsUpIO;c:\windows\system32\drivers\AsUpIO.sys [5/16/2010 12:11 AM 11448]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [7/15/2010 12:41 AM 304464]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [7/15/2010 12:41 AM 20952]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [5/14/2010 7:36 PM 2106880]

S0 fbjgfu;fbjgfu; [x]

S3 DMService;Whale Component Manager;c:\windows\DOWNLO~1\DMService.exe [2/3/2010 1:39 PM 423576]

S3 naecd;naecd;\??\c:\docume~1\Hands\LOCALS~1\Temp\naecd.sys --> c:\docume~1\Hands\LOCALS~1\Temp\naecd.sys [?]

S3 Normandy;Normandy SR2; [x]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/17/2010 12:54 AM 691696]

.

Contents of the 'Scheduled Tasks' folder

2010-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1960408961-725345543-1003Core.job

- c:\documents and settings\Hands\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-29 05:49]

2010-07-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1960408961-725345543-1003UA.job

- c:\documents and settings\Hands\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-29 05:49]

2010-07-18 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]

2010-07-18 c:\windows\Tasks\MpIdleTask.job

- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyServer = http=127.0.0.1:5643

uInternet Settings,ProxyOverride = <local>

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

LSP: c:\progra~1\WHALEC~1\CLIENT~1\31265D~1.0\WhlLSP.dll

.

- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

AddRemove-KB923789 - c:\windows\system32\MacroMed\Flash\genuinst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-18 12:37

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2010-07-18 12:38:48

ComboFix-quarantined-files.txt 2010-07-18 16:38

Pre-Run: 465,997,455,360 bytes free

Post-Run: 466,348,851,200 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - 85977F42D76A75911A2106CBC0CB8928

RPMcMurphy · July 18, 2010

That's a little better, but we still have work to do:

Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above DirLook::

DirLook::
C:\22987e4bcb09d00e9fa6fd
DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5643
uInternet Settings,ProxyOverride = <local>
Driver::
fbjgfu
naecd
Normandy
File::
c:\windows\system32\drivers\fu.bak
c:\docume~1\Hands\LOCALS~1\Temp\naecd.sys 
Folder::
c:\documents and settings\NetworkService\Local Settings\Application Data\ydujvjitr
KillAll::

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

ComboFix log

MBAB_Saved_My_A · July 18, 2010

ComboFix 10-07-16.02 - Hands 07/18/2010 14:12:58.2.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1496 [GMT -4:00]

Running from: c:\documents and settings\Hands\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Hands\Desktop\CFScript.txt

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FILE ::

"c:\docume~1\Hands\LOCALS~1\Temp\naecd.sys"

"c:\windows\system32\drivers\fu.bak"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\NetworkService\Local Settings\Application Data\ydujvjitr

c:\windows\system32\drivers\fu.bak

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FBJGFU

-------\Legacy_NAECD

-------\Legacy_NORMANDY

-------\Service_fbjgfu

-------\Service_naecd

-------\Service_Normandy