bon reed Posted August 2, 2010 ID:294057 Share Posted August 2, 2010 Below I've posted the malwarebytes log it did not fix the problem so I ran combofix and also posted those results Thanks for the help in advance!!!Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4378Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187028/1/2010 2:12:46 PMmbam-log-2010-08-01 (14-12-46).txtScan type: Full scan (C:\|E:\|F:\|)Objects scanned: 338182Time elapsed: 2 hour(s), 15 minute(s), 15 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 3Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 0Files Infected: 6Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\AppID\{84c3c236-f588-4c93-84f4-147b2abbe67b} (Adware.Adrotator) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully.Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Update\seupd.exe.vir (Trojan.Clicker) -> Quarantined and deleted successfully.C:\Qoobox\Quarantine\C\WINDOWS\system32\6to4v32.dll.vir (Trojan.Dropper) -> Quarantined and deleted successfully.C:\Qoobox\Quarantine\C\WINDOWS\system32\Memman.vxd.vir (Rogue.sysCleaner) -> Quarantined and deleted successfully.C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1086\A0097814.exe (Trojan.Clicker) -> Quarantined and deleted successfully.C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP1086\A0097824.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.C:\WINDOWS\system32\Memman.vxd (Rogue.sysCleaner) -> Quarantined and deleted successfully.ComboFix 10-07-31.04 - Admin 08/01/2010 15:36:58.2.2 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1334 [GMT -7:00]Running from: c:\documents and settings\Admin\Desktop\ComboFix.exeAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\system32\SET335.tmpc:\windows\system32\skinboxer43.dllF:\Autorun.inf.((((((((((((((((((((((((( Files Created from 2010-07-01 to 2010-08-01 ))))))))))))))))))))))))))))))).2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\documents and settings\Admin\Application Data\Malwarebytes2010-08-01 18:50 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2010-08-01 18:50 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-07-25 06:35 . 2010-07-25 06:36 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Deployment2010-07-23 04:02 . 2010-08-01 22:45 766976 ----a-w- c:\windows\system32\drivers\lvtxfw.sys2010-07-23 04:02 . 2010-07-24 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Update2010-07-23 04:02 . 2010-07-23 04:08 -------- d-----w- c:\documents and settings\Admin\Application Data\12717EA6ABB8F3FBFE1F9620351EE3A92010-07-20 15:05 . 2010-07-20 15:05 1615200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssie.dll2010-07-20 15:05 . 2010-07-20 15:05 1373536 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgssff.dll2010-07-20 15:05 . 2010-07-20 15:05 921440 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgemc.exe2010-07-20 15:05 . 2010-07-20 15:05 4368224 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll2010-07-20 15:05 . 2010-07-20 15:05 1107296 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgxpl.dll2010-07-18 11:24 . 2010-07-18 11:24 128 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\fusioncache.dat2010-07-18 11:24 . 2010-07-18 11:24 -------- d-----w- c:\program files\The Internet Company2010-07-15 15:21 . 2010-07-15 15:21 242896 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys2010-07-15 15:21 . 2010-07-15 15:21 216200 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgldx86.sys2010-07-15 15:20 . 2010-07-15 15:20 12536 ----a-w- c:\windows\system32\avgrsstx.dll2010-07-15 15:18 . 2010-07-15 15:18 813336 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll2010-07-15 15:18 . 2010-07-15 15:18 624920 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe2010-07-15 15:18 . 2010-07-15 15:18 1690464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll2010-07-15 15:18 . 2010-07-15 15:18 1038688 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe2010-07-14 11:13 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-08-01 22:21 . 2009-10-22 09:11 -------- d-----w- c:\documents and settings\Admin\Application Data\Skype2010-08-01 18:03 . 2009-10-22 09:13 -------- d-----w- c:\documents and settings\Admin\Application Data\skypePM2010-08-01 17:59 . 2010-01-09 21:33 66 ----a-w- c:\documents and settings\Admin\Application Data\isfree4_0.tmp2010-07-25 01:46 . 2010-03-30 06:49 766 ----a-r- c:\documents and settings\Admin\Application Data\Microsoft\Installer\{50349CC6-93AF-4E38-BA37-AE5E34FC4AAC}\_641c2d4e.exe2010-07-25 01:46 . 2010-03-30 06:49 207886 ----a-r- c:\documents and settings\Admin\Application Data\Microsoft\Installer\{50349CC6-93AF-4E38-BA37-AE5E34FC4AAC}\_64335335.exe2010-07-25 01:46 . 2010-03-30 06:49 207886 ----a-r- c:\documents and settings\Admin\Application Data\Microsoft\Installer\{50349CC6-93AF-4E38-BA37-AE5E34FC4AAC}\_48c5412e.exe2010-07-25 01:46 . 2010-03-30 06:49 -------- d-----w- c:\program files\Forum Submitter Pro Full2010-07-24 19:37 . 2008-01-21 01:41 -------- d-----w- c:\program files\GamesBar2010-07-24 19:25 . 2010-01-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\avg92010-07-15 15:20 . 2008-11-13 19:07 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys2010-07-15 15:19 . 2008-11-13 19:07 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys2010-07-01 23:07 . 2009-10-17 09:10 -------- d-----w- c:\program files\Common Files\Adobe AIR2010-07-01 23:07 . 2010-07-01 23:07 53632 ----a-w- c:\documents and settings\Admin\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe2010-07-01 23:06 . 2010-07-01 23:06 -------- d-----w- c:\documents and settings\Admin\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.12010-06-14 14:31 . 2004-08-11 23:12 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe2010-06-10 18:01 . 2010-03-18 18:42 -------- d-----w- c:\program files\Microsoft Silverlight2010-06-09 19:16 . 2010-06-09 19:15 -------- d-----w- c:\program files\iTunes2010-06-09 19:16 . 2010-06-09 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}2010-06-09 19:15 . 2010-06-09 19:15 -------- d-----w- c:\program files\iPod2010-06-09 19:15 . 2007-12-26 20:34 -------- d-----w- c:\program files\Common Files\Apple2010-06-09 19:12 . 2009-10-31 19:58 -------- d-----w- c:\program files\QuickTime2010-06-09 19:08 . 2010-06-09 19:08 -------- d-----w- c:\program files\Bonjour2010-06-09 19:08 . 2010-06-09 19:08 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe2010-06-09 19:06 . 2008-08-25 18:58 -------- d-----w- c:\program files\Safari2010-06-09 19:04 . 2010-06-09 19:04 71992 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe2010-06-02 15:57 . 2008-11-13 19:07 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2010-05-23 00:42 . 2010-05-23 00:42 503808 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1c4e0469-n\msvcp71.dll2010-05-23 00:42 . 2010-05-23 00:42 499712 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1c4e0469-n\jmc.dll2010-05-23 00:42 . 2010-05-23 00:42 348160 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-1c4e0469-n\msvcr71.dll2010-05-06 10:41 . 2004-08-11 23:00 916480 ----a-w- c:\windows\system32\wininet.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-03-09 26100520]"GoToMeeting"="c:\program files\Citrix\GoToMeeting\457\g2mstart.exe" [2010-05-22 39816][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-12 7204864]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-14 149280]"SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 282624]"Popup"="c:\program files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe" [2006-04-20 61526]"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]"FileZilla Server Interface"="c:\program files\FileZilla Server\FileZilla Server Interface.exe" [2009-09-06 1230336]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2010-07-15 15:20 12536 ----a-w- c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Dell SAS RAID Storage Manager\\MegaPopup\\popup.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Google\\Google Talk\\googletalk.exe"="c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\Documents and Settings\\Admin\\temp\\TeamViewer\\Version5\\TeamViewer.exe"="c:\\Program Files\\AVG\\AVG9\\avgemc.exe"="c:\\Program Files\\AVG\\AVG9\\avgupd.exe"="c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Java\\jre6\\bin\\java.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/13/2008 12:07 PM 216400]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/13/2008 12:07 PM 243024]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 8:19 AM 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 8:20 AM 308136]S2 gupdate1ca52f79a16c064;Google Update Service (gupdate1ca52f79a16c064);c:\program files\Google\Update\GoogleUpdate.exe [10/22/2009 2:11 AM 133104]--- Other Services/Drivers In Memory ---*Deregistered* - lvtxfw.Contents of the 'Scheduled Tasks' folder2010-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 09:10]2010-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 09:10]..------- Supplementary Scan -------.uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uStart Page = about:blankuInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: {552164CA-6A60-428E-A60F-E2C918C0D1EF} = 68.116.46.115,68.116.46.70FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\yslunii9.default\FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: keyword.URL - hxxp://search.search-star.net/?sid=10101038100&s=FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dllFF - plugin: c:\documents and settings\Admin\Application Data\Move Networks\plugins\npqmp071701000002.dllFF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\---- FIREFOX POLICIES ----FF - user.js: browser.search.selectedEngine - GoogleFF - user.js: browser.search.order.1 - GoogleFF - user.js: keyword.URL - hxxp://search.search-star.net/?sid=10101038100&s=.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-08-01 15:45Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\docume~1\Admin\LOCALS~1\Temp\catchme.dll 53248 bytes executablescan completed successfullyhidden files: 1**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lvtxfw].Completion time: 2010-08-01 15:51:16ComboFix-quarantined-files.txt 2010-08-01 22:50ComboFix2.txt 2010-07-24 19:59Pre-Run: 88,926,691,328 bytes freePost-Run: 88,954,339,328 bytes free- - End Of File - - B475F36C8943F6A91D0CBFF0035AEFCB Link to post Share on other sites More sharing options...
Staff screen317 Posted August 2, 2010 Staff ID:294427 Share Posted August 2, 2010 Hi and welcome to Malwarebytes.Please understand that running ComboFix on your own without a trained analyst is very dangerous.With that said, please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.Next, please open Notepad - don't use any other text editor than notepad or the script will fail.Copy/paste the text in the quotebox below into Notepad:Driver::lvtxfwSave this as CFScript Then drag the CFScript into ComboFix.exe as you see in the screenshot below.This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new DDS log.-screen317 Link to post Share on other sites More sharing options...
bon reed Posted August 2, 2010 Author ID:294481 Share Posted August 2, 2010 Hi and welcome to Malwarebytes.Please understand that running ComboFix on your own without a trained analyst is very dangerous.With that said, please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Do not run it yet.Next, please open Notepad - don't use any other text editor than notepad or the script will fail.Copy/paste the text in the quotebox below into Notepad:Save this as CFScript Then drag the CFScript into ComboFix.exe as you see in the screenshot below.This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new DDS log.-screen317Thanks Here are the logs you requested:DDS (Ver_10-03-17.01) - NTFSx86 Run by Admin at 14:21:10.73 on Mon 08/02/2010Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1405 [GMT -7:00]AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchost.exeC:\Program Files\AVG\AVG9\avgchsvx.exeC:\Program Files\AVG\AVG9\avgrsx.exeC:\Program Files\AVG\AVG9\avgcsrvx.exeC:\WINDOWS\system32\spoolsv.exesvchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\AVG\AVG9\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\FileZilla Server\FileZilla Server.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\stsystra.exeC:\Program Files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Microsoft IntelliPoint\ipoint.exeC:\Program Files\Google\Google Talk\googletalk.exeC:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exeC:\PROGRA~1\AVG\AVG9\avgtray.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Microsoft IntelliPoint\dpupdchk.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exeC:\Program Files\Citrix\GoToMeeting\457\g2mstart.exeC:\Program Files\Dell SAS RAID Storage Manager\MegaMonitor\Monitor.exeC:\Program Files\AVG\AVG9\avgnsx.exeComboFix 10-08-02.01 - Admin 08/02/2010 13:45:41.3.2 - x86Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1336 [GMT -7:00]Running from: c:\documents and settings\Admin\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Admin\Desktop\CFScript.txtAV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}.((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_LVTXFW-------\Service_lvtxfw((((((((((((((((((((((((( Files Created from 2010-07-02 to 2010-08-02 ))))))))))))))))))))))))))))))).2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\documents and settings\Admin\Application Data\Malwarebytes2010-08-01 18:50 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-08-01 18:50 . 2010-08-01 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2010-08-01 18:50 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-07-25 06:35 . 2010-07-25 06:36 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Deployment2010-07-23 04:02 . 2010-08-02 20:55 766976 ----a-w- c:\windows\system32\drivers\lvtxfw.sys2010-07-23 04:02 . 2010-07-24 19:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Update2010-07-23 04:02 . 2010-07-23 04:08 -------- d-----w- c:\documents and settings\Admin\Application Data\12717EA6ABB8F3FBFE1F9620351EE3A92010-07-18 11:24 . 2010-07-18 11:24 128 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\fusioncache.dat2010-07-18 11:24 . 2010-07-18 11:24 -------- d-----w- c:\program files\The Internet Company2010-07-15 15:20 . 2010-07-15 15:20 12536 ----a-w- c:\windows\system32\avgrsstx.dll2010-07-14 11:13 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-08-02 21:00 . 2009-10-22 09:11 -------- d-----w- c:\documents and settings\Admin\Application Data\Skype2010-08-02 18:54 . 2009-10-22 09:13 -------- d-----w- c:\documents and settings\Admin\Application Data\skypePM2010-08-02 02:26 . 2010-01-09 21:33 66 ----a-w- c:\documents and settings\Admin\Application Data\isfree4_0.tmp2010-07-25 01:46 . 2010-03-30 06:49 -------- d-----w- c:\program files\Forum Submitter Pro Full2010-07-24 19:37 . 2008-01-21 01:41 -------- d-----w- c:\program files\GamesBar2010-07-24 19:25 . 2010-01-19 20:56 -------- d-----w- c:\documents and settings\All Users\Application Data\avg92010-07-15 15:20 . 2008-11-13 19:07 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys2010-07-15 15:19 . 2008-11-13 19:07 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys2010-07-01 23:07 . 2009-10-17 09:10 -------- d-----w- c:\program files\Common Files\Adobe AIR2010-07-01 23:06 . 2010-07-01 23:06 -------- d-----w- c:\documents and settings\Admin\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.12010-06-10 18:01 . 2010-03-18 18:42 -------- d-----w- c:\program files\Microsoft Silverlight2010-06-09 19:16 . 2010-06-09 19:15 -------- d-----w- c:\program files\iTunes2010-06-09 19:16 . 2010-06-09 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}2010-06-09 19:15 . 2010-06-09 19:15 -------- d-----w- c:\program files\iPod2010-06-09 19:15 . 2007-12-26 20:34 -------- d-----w- c:\program files\Common Files\Apple2010-06-09 19:12 . 2009-10-31 19:58 -------- d-----w- c:\program files\QuickTime2010-06-09 19:08 . 2010-06-09 19:08 -------- d-----w- c:\program files\Bonjour2010-06-09 19:06 . 2008-08-25 18:58 -------- d-----w- c:\program files\Safari2010-06-02 15:57 . 2008-11-13 19:07 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys2010-05-06 10:41 . 2004-08-11 23:00 916480 ----a-w- c:\windows\system32\wininet.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-03-09 26100520]"GoToMeeting"="c:\program files\Citrix\GoToMeeting\457\g2mstart.exe" [2010-05-22 39816][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-12 7204864]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-14 149280]"SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 282624]"Popup"="c:\program files\Dell SAS RAID Storage Manager\MegaPopup\Popup.exe" [2006-04-20 61526]"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]"FileZilla Server Interface"="c:\program files\FileZilla Server\FileZilla Server Interface.exe" [2009-09-06 1230336]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]2010-07-15 15:20 12536 ----a-w- c:\windows\system32\avgrsstx.dll[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Dell SAS RAID Storage Manager\\MegaPopup\\popup.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Google\\Google Talk\\googletalk.exe"="c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"="c:\\Program Files\\Mozilla Firefox\\firefox.exe"="c:\\Documents and Settings\\Admin\\temp\\TeamViewer\\Version5\\TeamViewer.exe"="c:\\Program Files\\AVG\\AVG9\\avgemc.exe"="c:\\Program Files\\AVG\\AVG9\\avgupd.exe"="c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Java\\jre6\\bin\\java.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"=R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/13/2008 12:07 PM 216400]R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/13/2008 12:07 PM 243024]R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/15/2010 8:19 AM 921952]R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/15/2010 8:20 AM 308136]S2 gupdate1ca52f79a16c064;Google Update Service (gupdate1ca52f79a16c064);c:\program files\Google\Update\GoogleUpdate.exe [10/22/2009 2:11 AM 133104].Contents of the 'Scheduled Tasks' folder2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 09:10]2010-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-22 09:10]..------- Supplementary Scan -------.uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uStart Page = about:blankuInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sTCP: {552164CA-6A60-428E-A60F-E2C918C0D1EF} = 68.116.46.115,68.116.46.70FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\yslunii9.default\FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: keyword.URL - hxxp://search.search-star.net/?sid=10101038100&s=FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dllFF - plugin: c:\documents and settings\Admin\Application Data\Move Networks\plugins\npqmp071701000002.dllFF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dllFF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\---- FIREFOX POLICIES ----FF - user.js: browser.search.selectedEngine - GoogleFF - user.js: browser.search.order.1 - GoogleFF - user.js: keyword.URL - hxxp://search.search-star.net/?sid=10101038100&s=.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-08-02 13:58Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(3584)c:\windows\system32\WININET.dllc:\windows\system32\ieframe.dllc:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dllc:\windows\system32\webcheck.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\program files\AVG\AVG9\avgchsvx.exec:\program files\AVG\AVG9\avgrsx.exec:\program files\AVG\AVG9\avgcsrvx.exec:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exec:\program files\Bonjour\mDNSResponder.exec:\program files\FileZilla Server\FileZilla Server.exec:\program files\Java\jre6\bin\jqs.exec:\program files\Maxtor\Sync\SyncServices.exec:\windows\stsystra.exec:\windows\system32\nvsvc32.exec:\program files\Microsoft IntelliPoint\dpupdchk.exec:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exec:\program files\Skype\Phone\Skype.exec:\program files\Dell SAS RAID Storage Manager\Framework\VivaldiFramework.exec:\program files\Dell SAS RAID Storage Manager\MegaMonitor\Monitor.exec:\program files\AVG\AVG9\avgnsx.exec:\program files\Dell SAS RAID Storage Manager\JRE\bin\javaw.exec:\program files\Citrix\GoToMeeting\457\g2mcomm.exec:\program files\Citrix\GoToMeeting\457\g2mlauncher.exec:\program files\AVG\AVG9\avgcsrvx.exec:\windows\system32\wscntfy.exec:\program files\iPod\bin\iPodService.exec:\program files\Skype\Plugin Manager\skypePM.exec:\program files\Symantec\LiveUpdate\AUpdate.exec:\progra~1\Symantec\LIVEUP~1\LUCOMS~2.EXE.**************************************************************************.Completion time: 2010-08-02 14:13:08 - machine was rebootedComboFix-quarantined-files.txt 2010-08-02 21:12ComboFix2.txt 2010-08-01 22:51ComboFix3.txt 2010-07-24 19:59Pre-Run: 88,917,221,376 bytes freePost-Run: 88,907,821,056 bytes free- - End Of File - - FDFBF82762905D39C6B4E94FC39E079E Link to post Share on other sites More sharing options...
Staff screen317 Posted August 3, 2010 Staff ID:294546 Share Posted August 3, 2010 Hi,Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.Click Start Scanning.You should get a notification bar (on top) to install the ActiveX control. Click on it and select to install the ActiveX.Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.In case you are having problems with installing the ActiveX/starting the scan, please read here.Click the Full System Scan button.It will start to download scanner components and databases. This can take a while.The main scan will start.Once the scan has finished scanning, click the Automatic cleaning (recommended) buttonIt could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.The cleaning can take a while, so please be patient.Then click the Show report button and Copy/Paste what is present under results in your next reply.Next, download my Security Check from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.Let me know how things are running now and what issues remain.-screen317 Link to post Share on other sites More sharing options...
bon reed Posted August 3, 2010 Author ID:294638 Share Posted August 3, 2010 Hi,Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.Click Start Scanning.You should get a notification bar (on top) to install the ActiveX control. Click on it and select to install the ActiveX.Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.In case you are having problems with installing the ActiveX/starting the scan, please read here.Click the Full System Scan button.It will start to download scanner components and databases. This can take a while.The main scan will start.Once the scan has finished scanning, click the Automatic cleaning (recommended) buttonIt could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.The cleaning can take a while, so please be patient.Then click the Show report button and Copy/Paste what is present under results in your next reply.Next, download my Security Check from here or here.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt; please post the contents of that document.Let me know how things are running now and what issues remain.-screen317Here are the log it seems like everything is back to normal. I want to say a big Thanks! Results of screen317's Security Check version 0.99.5 Windows XP Service Pack 3 Internet Explorer 8 `````````````````````````````` Antivirus/Firewall Check: Windows Firewall Enabled! AVG Free 9.0 Antivirus up to date! (On Access scanning disabled!) ``````````````````````````````` Anti-malware/Other Utilities Check: Malwarebytes' Anti-Malware Java 6 Update 17 Java 6 Update 3 Out of date Java installed! Adobe Flash Player 10.0.45.2 Adobe Reader 9.3 Mozilla Firefox (3.0.19) Firefox Out of Date! ```````````````````````````````` Process Check: objlist.exe by Laurent AVG avgwdsvc.exe AVG avgtray.exe AVG avgrsx.exe AVG avgnsx.exe AVG avgemc.exe ````````````````````````````````DNS Vulnerability Check: GREAT! (Not vulnerable to DNS cache poisoning) ``````````End of Log```````````` Here is the other log...4 malware foundTrackingCookie.Atdmt (spyware) System (Disinfected) TrackingCookie.Doubleclick (spyware) System (Disinfected) TrackingCookie.Statcounter (spyware) System (Disinfected) TrackingCookie.Yieldmanager (spyware) System (Disinfected) --------------------------------------------------------------------------------StatisticsScanned: Files: 80659 System: 3596 Not scanned: 14 Actions: Disinfected: 4 Renamed: 0 Deleted: 0 Not cleaned: 0 Submitted: 0 Files not scanned:C:\PAGEFILE.SYS C:\HIBERFIL.SYS C:\WINDOWS\TEMP\HSPERFDATA_SYSTEM\428 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB C:\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\TEMP\HSPERFDATA_ADMIN\3804 C:\DOCUMENTS AND SETTINGS\ADMIN\LOCAL SETTINGS\TEMP\HSPERFDATA_ADMIN\688 C:\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\SKYPE\ETILQS_67U3QHGAEIAGN79XYRZC C:\DOCUMENTS AND SETTINGS\ADMIN\APPLICATION DATA\SKYPE\ETILQS_PI12B6JUBSDCAMQBCD1B Link to post Share on other sites More sharing options...
Staff screen317 Posted August 4, 2010 Staff ID:295242 Share Posted August 4, 2010 Hi,Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstallThis uninstalls all of ComboFix's components.Delete SecurityCheck.After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following programs (if present):Java Link to post Share on other sites More sharing options...
bon reed Posted August 6, 2010 Author ID:296916 Share Posted August 6, 2010 Hi,Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstallThis uninstalls all of ComboFix's components.Delete SecurityCheck.After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following programs (if present):Java Link to post Share on other sites More sharing options...
Staff screen317 Posted August 6, 2010 Staff ID:296984 Share Posted August 6, 2010 Hi,Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:1) It is vital that you have a firewall. The one that comes with Windows XP is not sufficient in that it only checks incoming data. I recommend selecting one of the following free firewalls. Be sure to only install one.Sunbelt Personal FirewallComodoOutpost2) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.3) Download and install IE-Spyad, which will place over 5000 'bad' sites on your Internet Explorer Restricted List. A tutorial on it can be found here.4) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.5) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.6) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE.7) Be sure to update your Antivirus and Antispyware programs often!Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?Safe surfing,-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted August 29, 2010 Staff ID:306373 Share Posted August 29, 2010 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts