Random pop ups

Tyler_Durden · July 27, 2010

Hello all, I am new to the forums and would really appreciate any help with my current problem. I have been trying to rid my computer of what i suspect is very well hidden spyware. My web browser keeps redirecting itself to random sites. Also a google window keeps opening by itself. I have tried reinstalling the OS to no avail. I have lost most of my files that i have not had backed up. The problem has persisted for a week now. I have attatched the logs that have been requested beforehand. I know that people that help around here are extremely busy. I just want to say thanks on advance for your help.

DDS.txt

Attach.zip

Kenny94 · July 27, 2010

Hi Tyler_Durden And Welcome to Malwarebytes Forum!

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

DeFogger

Download DeFogger by jpshortstuff from here & save it to your desktop.

Right click DeFogger then choose Run as Administrator Or you can double-click to run the tool
The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A Finished! message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK. If not reboot your PC

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Download ComboFix from below:
Combofix download
* IMPORTANT !!! Place combofix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on combofix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
The Recovery Console was successfully installed.

Click on Yes, to continue scanning for malware.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.
---------------------------------------------------------------------------------------------

Tyler_Durden · July 27, 2010

Hello Kenny94, thank you for your time in helping me with my problem! Firstly, I disabled my antivirus protection then I finished running Defogger, it didn't ask me to reboot, so I did so myself. I ran it again to be sure and it said ERROR could not access files. So here is the log that it produced.

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 12:34 on 27/07/2010 (Administrator)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Then i ran combofix and it did everything it was supposed to except that it did not create a log.

I will post the Hijackthis log just in case you need it.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:59:34 PM, on 7/27/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe

C:\Program Files\PDF Complete\pdfsty.exe

C:\WINDOWS\SMINST\Scheduler.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe

C:\Program Files\PDF Complete\pdfsvc.exe

C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\IPSBHO.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe

O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe

O4 - HKLM\..\Run: [scheduler] C:\WINDOWS\SMINST\Scheduler.exe

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://download.cnet.com

O15 - Trusted Zone: http://www.eohpoker.com

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe

O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe

O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe

O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe

--

End of file - 5892 bytes

Lastly, I noticed this in the Highjackthis results, it looks kind of suspicious to me but I'm no professional

O2-BHO:WormRadar.com IESiteblocker.NavFilter -{3CA2F312-6F6E-A66E-4E65E497C8CO} - C:\Program Files\AVG9\avgssie.dll (file missing)

Kenny94 · July 27, 2010

ComboFix log is in your C: Drive and please post it.....

Tyler_Durden · July 27, 2010

oh ok sorry, I had to look in the Combo Fix folder to retrieve it though it is kind of short

ComboFix 10-07-26.04 - Administrator 07/27/2010 12:45:10.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3055.2461 [GMT -5:00]

Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

.

Also i forgot to mention that when Combofix was done running I recieved an error message from microsoft, but i could not copy past the info it gave me.

Kenny94 · July 27, 2010

ComboFix log was cut off. Can you post the whole log please. Thanks. If this is all to the ComboFix log? Please run it again.

Tyler_Durden · July 27, 2010

Here it is

ComboFix 10-07-26.04 - Administrator 07/27/2010 14:31:21.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3055.2510 [GMT -5:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

D:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2010-06-27 to 2010-07-27 )))))))))))))))))))))))))))))))

.

2010-07-27 09:44 . 2010-05-21 19:14 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-07-27 09:43 . 2010-07-27 09:43 -------- d-----w- c:\program files\Windows Defender

2010-07-27 09:27 . 2010-07-27 09:27 -------- d-----w- c:\program files\Common Files\Java

2010-07-27 09:26 . 2010-07-27 09:26 503808 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62ee3fed-n\msvcp71.dll

2010-07-27 09:26 . 2010-07-27 09:26 499712 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62ee3fed-n\jmc.dll

2010-07-27 09:26 . 2010-07-27 09:26 348160 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62ee3fed-n\msvcr71.dll

2010-07-27 09:26 . 2010-07-27 09:26 61440 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1a66e7b6-n\decora-sse.dll

2010-07-27 09:26 . 2010-07-27 09:26 12800 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1a66e7b6-n\decora-d3d.dll

2010-07-27 09:26 . 2010-07-27 09:26 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-07-27 09:26 . 2010-07-27 09:26 -------- d-----w- c:\program files\Java

2010-07-27 09:22 . 2010-07-27 09:22 -------- d-----w- c:\windows\Sun

2010-07-27 05:40 . 2010-07-27 05:40 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Temp

2010-07-27 05:40 . 2010-07-27 05:40 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2010-07-27 05:35 . 2010-07-27 05:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

2010-07-27 04:50 . 2010-07-27 08:09 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google

2010-07-27 04:49 . 2010-07-27 04:49 -------- d-----w- c:\program files\Trend Micro

2010-07-27 04:47 . 2010-07-27 05:35 -------- d-----w- c:\program files\Google

2010-07-27 04:47 . 2010-07-27 04:47 1975408 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\GoogleToolbarInstaller_en32_signed.exe

2010-07-27 04:47 . 2010-07-27 09:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-07-27 04:35 . 2010-07-27 04:35 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation

2010-07-27 04:35 . 2010-07-27 04:41 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin

2010-07-27 04:35 . 2010-07-27 04:41 1 ----a-w- c:\windows\system32\nvdrssel.bin

2010-07-27 04:35 . 2010-07-27 04:41 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin

2010-07-27 04:35 . 2010-07-27 04:36 -------- d-----w- c:\program files\NVIDIA Corporation

2010-07-27 04:35 . 2010-07-09 22:38 61440 ----a-w- c:\windows\system32\OpenCL.dll

2010-07-27 04:35 . 2010-07-09 22:38 4595712 ----a-w- c:\windows\system32\nvcuda.dll

2010-07-27 04:35 . 2010-07-09 22:38 2914408 ----a-w- c:\windows\system32\nvcuvid.dll

2010-07-27 04:35 . 2010-07-09 22:38 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll

2010-07-27 04:35 . 2010-07-09 22:38 2195030 ----a-w- c:\windows\system32\nvdata.bin

2010-07-27 04:35 . 2010-07-09 22:38 10260480 ----a-w- c:\windows\system32\nvcompiler.dll

2010-07-27 04:35 . 2010-07-27 04:35 -------- d-----w- C:\NVIDIA

2010-07-27 03:53 . 2010-07-27 03:53 -------- d-----w- c:\windows\ServicePackFiles

2010-07-27 03:20 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-27 03:20 . 2010-07-27 03:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-27 03:20 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-27 03:11 . 2010-07-27 04:10 -------- d-----w- c:\windows\system32\CatRoot_bak

2010-07-27 03:09 . 2009-11-21 16:36 470528 ------w- c:\windows\system32\dllcache\aclayers.dll

2010-07-27 03:09 . 2010-06-14 14:30 743936 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-07-27 03:09 . 2009-10-15 17:21 82432 ------w- c:\windows\system32\dllcache\fontsub.dll

2010-07-27 03:09 . 2009-06-21 22:04 153088 ------w- c:\windows\system32\dllcache\triedit.dll

2010-07-27 03:09 . 2009-10-23 14:27 3555328 ------w- c:\windows\system32\dllcache\moviemk.exe

2010-07-27 03:07 . 2010-07-27 03:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-07-27 03:07 . 2010-07-27 03:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-27 03:07 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys

2010-07-27 03:07 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\dllcache\bthport.sys

2010-07-27 03:07 . 2009-12-31 16:14 352640 ------w- c:\windows\system32\dllcache\srv.sys

2010-07-27 03:06 . 2010-02-24 12:31 454016 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-07-27 03:04 . 2008-05-08 12:28 202752 ------w- c:\windows\system32\dllcache\rmcast.sys

2010-07-27 02:54 . 2008-06-12 14:16 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll

2010-07-27 02:54 . 2008-06-12 14:16 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll

2010-07-27 02:54 . 2008-06-12 14:16 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll

2010-07-27 02:54 . 2008-06-12 14:16 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll

2010-07-27 02:54 . 2008-06-12 14:16 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll

2010-07-27 02:54 . 2008-06-12 14:16 428032 ------w- c:\windows\system32\dllcache\msdtcprx.dll

2010-07-27 02:54 . 2008-10-23 13:01 283648 ------w- c:\windows\system32\dllcache\gdi32.dll

2010-07-27 02:54 . 2008-04-21 10:02 215552 ------w- c:\windows\system32\dllcache\wordpad.exe

2010-07-27 02:54 . 2009-06-05 07:42 655872 ------w- c:\windows\system32\dllcache\mstscax.dll

2010-07-27 02:53 . 2009-12-24 07:05 177664 ------w- c:\windows\system32\dllcache\wintrust.dll

2010-07-27 02:53 . 2010-01-13 14:10 85504 ------w- c:\windows\system32\dllcache\cabview.dll

2010-07-27 02:53 . 2010-07-27 02:53 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2010-07-27 02:52 . 2010-07-27 02:52 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-07-27 02:51 . 2010-07-27 02:51 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-07-27 02:50 . 2010-07-27 02:50 -------- d-----w- c:\windows\ie8updates

2010-07-27 02:49 . 2010-07-27 02:50 -------- dc-h--w- c:\windows\ie8

2010-07-27 02:49 . 2008-06-24 16:23 74240 ------w- c:\windows\system32\dllcache\mscms.dll

2010-07-27 02:49 . 2009-05-07 15:44 344064 ------w- c:\windows\system32\dllcache\localspl.dll

2010-07-27 02:49 . 2009-11-27 17:33 17920 ------w- c:\windows\system32\dllcache\msyuv.dll

2010-07-27 02:49 . 2009-07-31 04:57 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll

2010-07-27 02:43 . 2010-05-06 10:41 12800 ------w- c:\windows\system32\dllcache\xpshims.dll

2010-07-27 02:43 . 2010-05-06 10:41 599040 ------w- c:\windows\system32\dllcache\msfeeds.dll

2010-07-27 02:43 . 2010-05-06 10:41 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-07-27 02:43 . 2010-05-06 10:41 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll

2010-07-27 02:43 . 2010-05-06 10:41 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll

2010-07-27 02:43 . 2010-05-06 10:41 1985536 ------w- c:\windows\system32\dllcache\iertutil.dll

2010-07-27 02:43 . 2010-05-06 10:41 11076096 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-07-27 02:42 . 2010-04-16 11:43 41984 ------w- c:\windows\system32\dllcache\iecompat.dll

2010-07-27 02:42 . 2008-02-26 11:59 294912 ------w- c:\windows\system32\dllcache\msctf.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-27 01:19 . 2010-07-27 01:19 -------- d-----w- c:\program files\Program Shortcuts

2010-07-27 01:15 . 2010-07-27 01:15 1744 --sha-r- c:\windows\system32\drivers\103C_HP_WS_HP xw4600 Workstation_YW_0xw_Q2UA805_EU_48WS_I0AA0h_SHP_V_B786F3 v01.04_T071108_WXP2_L409_M3056_J250_7Intel_8Core2 Duo E6850_93_#100726_N14E4167B_()_X_CD6_Z_2_G10DE040E_OATAPI DVD A DH16A1L_DDEFAULT.MRK

2010-07-27 01:15 . 2010-07-27 01:13 -------- d-----w- c:\program files\Hewlett-Packard

2010-07-27 01:14 . 2006-04-26 00:31 91227 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-07-27 01:14 . 2010-07-27 01:14 -------- d-----w- c:\program files\Hewlett-Packard Company

2010-07-27 01:14 . 2010-07-27 01:10 -------- d-----w- c:\program files\Broadcom

2010-07-27 01:13 . 2010-07-27 01:13 -------- d-----w- c:\program files\PDF Complete

2010-07-27 01:13 . 2010-07-27 01:13 -------- d-----w- c:\program files\Common Files\LightScribe

2010-07-27 01:13 . 2010-07-27 01:13 -------- d-----w- c:\program files\Intel

2010-07-27 01:12 . 2010-07-27 01:11 -------- d-----w- c:\program files\HPQ

2010-07-27 01:11 . 2010-07-27 01:11 -------- d-----w- c:\program files\HP

2010-07-27 01:11 . 2010-07-27 01:11 315392 ----a-w- c:\windows\HideWin.exe

2010-07-27 01:11 . 2010-07-27 01:11 -------- d-----w- c:\program files\Realtek

2010-07-27 01:10 . 2010-07-27 01:10 -------- d-----w- c:\program files\Common Files\InstallShield

2010-07-27 01:05 . 2010-07-27 00:53 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-07-27 01:03 . 2010-07-27 01:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\SampleView

2010-07-27 01:03 . 2010-07-27 01:03 -------- d-----w- c:\program files\microsoft frontpage

2010-07-27 00:53 . 2010-07-27 00:53 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2010-07-27 00:53 . 2010-07-27 00:53 7443 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2010-07-27 00:53 . 2010-07-27 00:53 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2010-07-27 00:53 . 2010-07-27 00:53 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2010-07-27 00:53 . 2010-07-27 00:53 -------- d-----w- c:\program files\Symantec

2010-07-27 00:53 . 2010-07-27 00:53 -------- d-----w- c:\program files\Norton AntiVirus

2010-07-27 00:53 . 2010-07-27 00:53 -------- d-----w- c:\program files\Windows Sidebar

2010-07-27 00:53 . 2010-07-27 00:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2010-07-27 00:51 . 2010-07-27 00:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller

2010-07-27 00:50 . 2010-07-27 00:50 -------- d-----w- c:\program files\NortonInstaller

2010-07-26 23:40 . 2010-07-26 23:40 -------- d-----w- c:\program files\AVG

2010-07-26 23:22 . 2010-07-26 23:22 14024 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-26 23:21 . 2010-07-26 23:21 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles

2010-07-26 23:20 . 2010-07-27 01:11 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-09 22:38 . 2010-07-27 01:10 604776 ----a-w- c:\windows\system32\nvudisp.exe

2010-07-09 22:38 . 2010-07-27 00:59 13549568 ----a-w- c:\windows\system32\nvoglnt.dll

2010-07-09 22:38 . 2010-07-27 00:59 236136 ----a-w- c:\windows\system32\nvcodins.dll

2010-07-09 22:38 . 2010-07-27 00:59 236136 ----a-w- c:\windows\system32\nvcod.dll

2010-07-09 22:38 . 2010-07-27 00:59 1388544 ----a-w- c:\windows\system32\nvapi.dll

2010-07-09 22:38 . 2010-07-27 00:59 6343040 ----a-w- c:\windows\system32\nv4_disp.dll

2010-07-09 22:38 . 2010-07-27 00:59 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2010-07-09 21:24 . 2010-07-09 21:24 81920 ----a-w- c:\windows\system32\nvwddi.dll

2010-07-09 21:24 . 2010-07-09 21:24 277608 ----a-w- c:\windows\system32\nvmccs.dll

2010-07-09 21:24 . 2010-07-09 21:24 110696 ----a-w- c:\windows\system32\nvmctray.dll

2010-07-09 21:24 . 2010-07-09 21:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe

2010-07-09 21:24 . 2010-07-09 21:24 145000 ----a-w- c:\windows\system32\nvcolor.exe

2010-07-09 21:24 . 2010-07-09 21:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll

2010-07-07 18:46 . 2010-07-27 01:10 604776 ----a-w- c:\windows\system32\NVUNINST.EXE

2010-06-14 14:30 . 2004-08-04 07:56 743936 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-05-06 10:41 . 2004-08-04 07:56 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 07:09 . 2004-08-04 06:17 1859968 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-27 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 16377344]

"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2007-06-25 331288]

"Recguard"="c:\windows\Sminst\Recguard.exe" [2006-05-12 1138688]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-03-31 761856]

"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-07-10 872448]

"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\SMINST\\Scheduler.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1107000.00C\symds.sys [7/26/2010 8:55 PM 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1107000.00C\symefa.sys [7/26/2010 8:55 PM 173104]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.5.0.127\Definitions\BASHDefs\20100709.001\BHDrvx86.sys [7/9/2010 9:44 PM 691248]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1107000.00C\cchpx86.sys [7/26/2010 8:55 PM 501888]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1107000.00C\ironx86.sys [7/26/2010 8:55 PM 116784]

R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.7.0.12\ccsvchst.exe [7/26/2010 8:55 PM 126392]

R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [4/30/2010 6:52 AM 3795560]

R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [7/26/2010 8:13 PM 540184]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/26/2010 8:02 PM 102448]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.5.0.127\Definitions\IPSDefs\20100723.001\IDSXpx86.sys [7/26/2010 8:02 PM 331640]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/27/2010 12:35 AM 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-27 05:35]

2010-07-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-27 05:35]

2010-07-27 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 00:20]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.bing.com/

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

Trusted Zone: cnet.com\download

Trusted Zone: eohpoker.com\www

.

- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

AddRemove-NVIDIA Display Control Panel - c:\program files\NVIDIA Corporation\Uninstall\nvuninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-27 14:32

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]

"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"

--

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]

"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3631521018-3230012320-2596617520-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4a,39,53,62,f9,96,79,4c,91,c9,f8,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,4a,39,53,62,f9,96,79,4c,91,c9,f8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2010-07-27 14:33:30

ComboFix-quarantined-files.txt 2010-07-27 19:33

Pre-Run: 226,159,951,872 bytes free

Post-Run: 226,185,441,280 bytes free

- - End Of File - - 03A006BC69639ED8C3E666B731408C2F

Kenny94 · July 27, 2010

Lastly, I noticed this in the Highjackthis results, it looks kind of suspicious to me but I'm no professional
O2-BHO:WormRadar.com IESiteblocker.NavFilter -{3CA2F312-6F6E-A66E-4E65E497C8CO} - C:\Program Files\AVG9\avgssie.dll (file missing)

This is a left over from AVG. It's fine.

Run CFScript

Close any open browsers.
Open Notepad by click start
Click Run
Type notepad into the box and click enter
Notepad will open
Copy and Paste everything from the Code box into Notepad:

KILLALL::

RegLock::
[HKEY_USERS\S-1-5-21-3631521018-3230012320-2596617520-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

Folder::
c:\program files\AVG

DDS:: 
Trusted Zone: cnet.com\download
Trusted Zone: eohpoker.com\www

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt and Malwarebytes report in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Next

lease download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Click Exit on the Main menu to close the program.

Then

Update Run Malwarebytes

Launch Malwarebytes' Anti-Malware
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Tyler_Durden · July 27, 2010

New ComboFix Log

ComboFix 10-07-26.04 - Administrator 07/27/2010 15:23:29.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3055.2480 [GMT -5:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\AVG