Malwarebytes having problems

Hvehve · August 9, 2010

So I tried running malwarebytes the other day, and it froze during the scan saying it encountered a problem. I've tried doing various things; running in safe mode, making an exception in my firewall and AVG 9, and uninstalling/reinstalling, but it still freezes. While the scan was occurring, I noticed there were two infections so I aborted the scan to fix them. I followed the direction in the sticky and got the DDS and attach files, but for some reason when running the gmer thing my comp got the blue screen of death and I had to restart. After I restarted GMER freezes during the scan.

Most recent malwarebytes scan

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4408

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18928

8/8/2010 9:47:42 PM

mbam-log-2010-08-08 (21-47-42).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 86606

Time elapsed: 31 minute(s), 23 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Last.fm\killer.exe (Worm.Koobface) -> Quarantined and deleted successfully.

C:\Program Files\Splitcam Toolbar\somoto.dll (Adware.EcoBar) -> Quarantined and deleted successfully.

DDS file

DDS (Ver_10-03-17.01) - NTFSx86

Run by Sebastian at 14:46:51.74 on 08/09/2010 Mon

Internet Explorer: 8.0.6001.18928 BrowserJavaVersion: 1.6.0_20

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\SMINST\BLService.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\svchost.exe -k HPService

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\HP\QuickPlay\QPService.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\AVG\AVG9\avgtray.exe

C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\vVX3000.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe

C:\Users\Sebastian\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe

C:\Program Files\PowerMenu\PowerMenu.exe

C:\Program Files\Rainmeter\Rainmeter.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Windows\system32\conime.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\Vidalia Bundle\Tor\tor.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Users\Sebastian\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: ToolbarURLSearchHook Class: {ca3eb689-8f09-4026-aa10-b9534c691ce0} - c:\program files\splitcam toolbar\tbhelper.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\splitcam toolbar\tbcore3.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File

TB: Splitcam Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\splitcam toolbar\tbcore3.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [bitTorrent DNA] "c:\users\sebastian\program files\dna\btdna.exe"

uRun: [Vidalia] "c:\program files\vidalia bundle\vidalia\vidalia.exe"

uRun: [sansaDispatch] c:\users\sebastian\appdata\roaming\sandisk\sansa updater\SansaDispatch.exe

uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"

mRun: [updateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"

mRun: [updatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start

mRun: [updateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"

mRun: [updatePDIRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"

mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe

mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe

mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"

mRun: [VX3000] c:\windows\vVX3000.exe

mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

dRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

StartupFolder: c:\users\sebast~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\powerm~1.lnk - c:\program files\powermenu\PowerMenu.exe

StartupFolder: c:\users\sebast~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\rainme~1.lnk - c:\program files\rainmeter\Rainmeter.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\privoxy.lnk - c:\program files\vidalia bundle\privoxy\privoxy.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: avgrsstx.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\sebast~1\appdata\roaming\mozilla\firefox\profiles\a5f7v7m2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: network.proxy.type - 1

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - component: c:\users\sebastian\appdata\roaming\mozilla\firefox\profiles\a5f7v7m2.default\extensions\lazarus@interclue.com\platform\winnt_x86-msvc\components\WeaveCrypto.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\users\sebastian\program files\dna\plugins\npbtdna.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-9 216400]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-9 29584]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-9 243024]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]

R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2008-10-23 365952]

R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2008-10-23 193840]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-29 112128]

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.2;c:\windows\system32\drivers\libusb0.sys [2009-7-4 29184]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-8-8 38224]

S3 PsSdk41;PsSdk41;c:\windows\system32\drivers\pssdk41.sys [2009-6-9 36928]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-08-09 19:40:18 20 ----a-w- c:\users\sebastian\defogger_reenable

2010-08-09 02:02:21 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-09 02:02:20 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-08 03:47:13 0 d-----w- c:\users\sebast~1\appdata\roaming\Azureus

2010-08-07 06:30:51 0 d-----w- c:\program files\uTorrent

2010-08-07 06:30:32 0 d-----w- c:\users\sebast~1\appdata\roaming\uTorrent

2010-08-04 01:13:59 0 d-----w- c:\program files\JDownloader

2010-08-03 03:24:57 0 d-----w- c:\program files\LibUSB-Win32-0.1.10.1

2010-08-01 22:24:20 0 d-----w- c:\users\sebast~1\appdata\roaming\Rainmeter

2010-07-30 07:13:02 89128 ----a-w- c:\program files\sav4.dat

2010-07-30 07:13:02 800 ----a-w- c:\program files\globa2.dat

2010-07-30 07:13:02 6440 ----a-w- c:\program files\omak4.dat

2010-07-30 07:13:02 122880 ----a-w- c:\program files\play4r101.dat

2010-07-30 07:12:49 49644 ----a-w- c:\program files\uninstalltof.exe

2010-07-30 05:35:41 122880 ----a-w- c:\program files\play3r101.dat

2010-07-19 22:37:32 122880 ----a-w- c:\program files\play3r002.dat

2010-07-16 20:03:11 0 d-----w- c:\users\sebast~1\appdata\roaming\ONScripter-En

2010-07-16 19:56:50 0 d-----w- c:\users\sebast~1\appdata\roaming\Umineko6

2010-07-15 15:35:29 12536 ----a-w- c:\windows\system32\avgrsstx.dll

==================== Find3M ====================

2010-07-30 07:43:22 112 ----a-w- c:\program files\system.dat

2010-07-30 07:11:36 6440 ----a-w- c:\program files\omak3.dat

2010-07-30 07:11:36 10800 ----a-w- c:\program files\globa1.dat

2010-07-30 05:41:55 178128 ----a-w- c:\program files\sav3.dat

2010-07-19 05:44:33 122880 ----a-w- c:\program files\play3r001.dat

2010-07-15 15:35:31 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-15 15:34:55 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-07-07 21:33:28 51200 ----a-w- c:\windows\inf\infpub.dat

2010-07-07 21:33:28 143360 ----a-w- c:\windows\inf\infstrng.dat

2010-07-07 21:33:20 143360 ----a-w- c:\windows\inf\infstor.dat

2010-07-07 00:54:13 147057 ----a-w- c:\windows\hpoins31.dat

2010-07-06 05:45:57 163644 ----a-w- c:\windows\system32\drivers\SECDRV.SYS

2010-07-05 22:44:45 89360 ----a-w- c:\windows\system32\VB5DB.DLL

2010-07-05 22:44:45 69632 ----a-w- c:\windows\system32\xmltok.dll

2010-07-05 22:44:45 36864 ----a-w- c:\windows\system32\xmlparse.dll

2010-07-05 22:44:45 28432 ----a-w- c:\windows\system32\msxmlr.dll

2010-07-05 22:44:45 26064 ----a-w- c:\windows\system32\xmlinst.exe

2010-07-05 22:44:45 24576 ----a-w- c:\windows\system32\msxml3a.dll

2010-06-08 05:01:39 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-07 19:50:34 6656 ----a-w- c:\windows\system32\bcmwlrc.dll

2010-05-26 17:06:41 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-05-26 14:47:41 289792 ----a-w- c:\windows\system32\atmfd.dll

2010-04-13 18:33:03 49818 ----a-w- c:\program files\uninstall.exe

2009-11-19 02:47:29 665600 ----a-w- c:\windows\inf\drvindex.dat

2009-10-01 15:18:06 2453425 ----a-w- c:\program files\tofscr.pd

2009-10-01 15:16:10 3546 ----a-w- c:\program files\tof-readme.txt

2009-10-01 15:10:06 5158536 ----a-w- c:\program files\engscr.pd

2009-09-08 00:38:36 721166 ----a-w- c:\program files\cc-tof.exe

2009-09-07 21:51:58 4842 ----a-w- c:\program files\Readme.txt

2009-08-26 07:52:10 5493 ----a-w- c:\program files\Walkthrough.txt

2009-08-26 06:27:48 206247687 ----a-w- c:\program files\gx.pd

2009-08-25 21:31:24 2431 ----a-w- c:\program files\Crossing.txt

2009-08-25 07:46:06 57069 ----a-w- c:\program files\TL Note List.txt

2009-08-01 00:15:16 7168 ----a-w- c:\program files\ccHook.dll

2009-08-01 00:03:02 22564 ----a-w- c:\program files\Inconsolata.ttf

2009-06-07 21:54:20 2318340 ----a-w- c:\program files\ccop_bn.avi

2009-06-07 20:56:56 45889540 ----a-w- c:\program files\ccop_an.avi

2009-06-07 07:59:12 721166 ----a-w- c:\program files\cc-eng.exe

2008-01-21 02:57:01 174 --sha-w- c:\program files\desktop.ini

2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2003-09-15 14:25:32 9080442 ----a-w- c:\program files\se.pd

2003-09-15 09:58:36 461390077 ----a-w- c:\program files\voice.pd

2003-09-14 15:10:14 133749450 ----a-w- c:\program files\bgm.pd

2003-09-12 01:41:16 7604228 ----a-w- c:\program files\FS_LOGO.avi

2009-12-28 03:18:26 245760 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat

2010-01-14 19:35:10 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

2008-10-23 05:54:23 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 14:48:34.93 ===============

Attach.zip

Maniac · August 10, 2010

Hello Hvehve! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

Step 1

Something about registry cleaners:

http://miekiemoes.blogspot.com/2008/02/reg...weaking_13.html

I suggest you to uninstall TweakNow RegCleaner Standard.

Step 2

Going over your logs I noticed that you have ??Torrent (or something) installed.

Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
They are a security risk which can make your computer susceptible to a smorgasbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall ??Torrent (or something), however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Step 3

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 4

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

JavaRa log
Malwarebytes' Anti-Malware log
a new fresh DDS log only

Hvehve · August 11, 2010

Ok I followed your directions and have the files in the attachment, but one problem. I ran malwarebytes again and I got this:

So I can't post that log. I tried a full scan and it did the same thing, only at the hour mark or longer.

DDS.zip

Maniac · August 11, 2010

Interesting...

Step 1

Go into C:\Program Files\Malwarebytes' Anti-Malware and you will see a file called mbam.exe Right click on it and drop down to Rename change the name to firefox.com From mbam.exe to firefox.com . Please, restart your computer.

Step 2

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Hvehve · August 14, 2010

Renamed it to firefox.com but got the same problem, it just freezes during the scan.

Maniac · August 14, 2010

Are you sure is a firefox.com not firefox.com.exe ?

Hvehve · August 14, 2010

Yeah, the .exe is gone and it's just firefox.com. I've also tried running it in safe mode and got nothing.

Maniac · August 15, 2010

Amazing....

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Hvehve · August 15, 2010

Combofix worked, here's the file

ComboFix 10-08-14.06 - Sebastian 5/2010 Sun 12:40:34.1.2 - x86

Running from: c:\users\Sebastian\Desktop\Combo-Fix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Logo.sys

c:\programdata\Microsoft\Windows\Start Menu\HP ??????? ???? .lnk

c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall.lnk

c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb

c:\windows\system32\scvideo.dll

.

((((((((((((((((((((((((( Files Created from 2010-07-15 to 2010-08-15 )))))))))))))))))))))))))))))))

.

2010-08-15 17:54 . 2010-08-15 17:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-08-15 17:54 . 2010-08-15 17:54 -------- d-----w- c:\users\Admin\AppData\Local\temp

2010-08-14 03:11 . 2010-08-14 03:11 -------- d-----w- c:\users\Admin\AppData\Roaming\Malwarebytes

2010-08-11 19:10 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-08-11 19:10 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-08-11 19:09 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll

2010-08-11 19:09 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-11 19:09 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-11 19:09 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

2010-08-09 02:02 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-09 02:02 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-08 03:47 . 2010-08-08 03:47 310208 ----a-w- c:\users\Sebastian\AppData\Roaming\Azureus\plugins\mlab\ShaperProbeC.exe

2010-08-08 03:47 . 2010-08-08 03:50 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Azureus

2010-08-07 06:30 . 2010-08-07 06:30 -------- d-----w- c:\program files\uTorrent

2010-08-07 06:30 . 2010-08-15 17:22 -------- d-----w- c:\users\Sebastian\AppData\Roaming\uTorrent

2010-08-06 03:53 . 2010-08-06 07:17 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Winamp

2010-08-04 01:13 . 2010-08-07 05:51 -------- d-----w- c:\program files\JDownloader

2010-08-03 03:24 . 2010-08-03 03:24 -------- d-----w- c:\program files\LibUSB-Win32-0.1.10.1

2010-08-01 22:24 . 2010-08-06 06:57 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Rainmeter

2010-07-30 07:13 . 2010-07-30 07:43 800 ----a-w- c:\program files\globa2.dat

2010-07-30 07:13 . 2010-07-30 07:43 6440 ----a-w- c:\program files\omak4.dat

2010-07-30 07:13 . 2010-07-30 07:17 89128 ----a-w- c:\program files\sav4.dat

2010-07-30 07:13 . 2010-07-30 07:17 122880 ----a-w- c:\program files\play4r101.dat

2010-07-30 07:12 . 2010-07-30 07:12 49644 ----a-w- c:\program files\uninstalltof.exe

2010-07-30 05:35 . 2010-07-30 05:41 122880 ----a-w- c:\program files\play3r101.dat

2010-07-19 22:37 . 2010-07-30 05:27 122880 ----a-w- c:\program files\play3r002.dat

2010-07-16 20:03 . 2010-07-16 20:03 -------- d-----w- c:\users\Sebastian\AppData\Roaming\ONScripter-En

2010-07-16 19:56 . 2010-08-10 05:47 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Umineko6

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-15 17:12 . 2009-02-09 00:03 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Vidalia

2010-08-15 17:11 . 2009-02-07 21:54 -------- d-----w- c:\users\Sebastian\AppData\Roaming\DNA

2010-08-15 08:09 . 2009-03-10 01:23 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Skype

2010-08-15 07:36 . 2009-02-09 00:03 -------- d-----w- c:\users\Sebastian\AppData\Roaming\tor

2010-08-15 05:24 . 2010-01-14 19:35 -------- d-----w- c:\program files\Mp3tag

2010-08-14 07:06 . 2009-02-08 22:10 -------- d-----w- c:\users\Sebastian\AppData\Roaming\mIRC

2010-08-14 07:06 . 2008-10-23 06:47 -------- d-----w- c:\program files\Common Files\Java

2010-08-14 07:05 . 2010-06-08 05:02 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-08-14 07:05 . 2008-10-23 06:47 -------- d-----w- c:\program files\Java

2010-08-14 03:45 . 2010-04-04 22:04 -------- d-----w- c:\users\Admin\AppData\Roaming\HPAppData

2010-08-14 03:02 . 2009-02-13 16:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-12 04:20 . 2010-06-09 01:06 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2010-08-11 19:27 . 2008-10-23 06:16 -------- d-----w- c:\program files\Microsoft Works

2010-08-11 19:26 . 2008-10-23 06:28 -------- d-----w- c:\programdata\Microsoft Help

2010-08-11 19:15 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-08-10 17:15 . 2009-03-16 16:31 -------- d-----w- c:\program files\TweakNow RegCleaner Std

2010-08-09 02:47 . 2009-02-08 01:34 -------- d--h--w- c:\program files\Last.fm

2010-08-09 01:58 . 2009-03-17 23:13 5972 ----a-w- c:\users\Sebastian\AppData\Local\d3d9caps.dat

2010-08-09 01:55 . 2009-02-13 16:49 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Malwarebytes

2010-08-09 01:55 . 2009-02-13 16:49 -------- d-----w- c:\programdata\Malwarebytes

2010-08-08 03:47 . 2009-07-09 17:14 -------- d-----w- c:\users\Sebastian\AppData\Roaming\OneSwarm

2010-08-06 03:55 . 2010-01-30 04:41 -------- d-----w- c:\program files\Winamp

2010-08-06 03:53 . 2010-01-30 01:40 -------- d-----w- c:\program files\Winamp Detect

2010-08-03 03:20 . 2010-02-03 00:32 -------- d-----w- c:\program files\Trillian

2010-08-01 22:24 . 2009-05-08 16:54 -------- d-----w- c:\program files\Rainmeter

2010-07-30 07:43 . 2010-04-13 18:47 112 ----a-w- c:\program files\system.dat

2010-07-30 07:11 . 2010-04-13 18:47 6440 ----a-w- c:\program files\omak3.dat

2010-07-30 07:11 . 2010-04-13 18:47 10800 ----a-w- c:\program files\globa1.dat

2010-07-30 05:41 . 2010-04-13 18:47 178128 ----a-w- c:\program files\sav3.dat

2010-07-19 05:44 . 2010-04-13 18:48 122880 ----a-w- c:\program files\play3r001.dat

2010-07-16 19:59 . 2009-09-03 01:46 -------- d-----w- c:\programdata\ONScripter-En

2010-07-16 19:44 . 2009-09-03 00:12 -------- d-----w- c:\program files\07th_Expansion

2010-07-15 18:31 . 2009-02-08 23:01 -------- d-----w- c:\program files\Vidalia Bundle

2010-07-15 15:35 . 2009-04-09 17:53 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-15 15:35 . 2010-07-15 15:35 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-15 15:34 . 2009-04-09 17:52 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-07-10 06:52 . 2010-07-10 06:52 -------- d-----w- c:\programdata\Trymedia

2010-07-10 06:32 . 2010-07-10 06:32 -------- d-----w- c:\program files\Sierra

2010-07-10 06:07 . 2010-07-06 18:13 -------- d-----w- c:\program files\ubi.com

2010-07-10 06:07 . 2008-10-23 05:29 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-10 06:07 . 2010-07-09 03:37 -------- d-----w- c:\program files\PeerBlock

2010-07-08 19:28 . 2010-05-23 08:16 -------- d-----w- c:\programdata\DivX

2010-07-08 19:28 . 2010-05-23 08:19 57344 ----a-w- c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-07-08 19:26 . 2010-07-08 19:26 56765 ----a-w- c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-07-08 19:26 . 2009-06-06 19:28 -------- d-----w- c:\program files\DivX

2010-07-08 19:26 . 2010-07-08 19:26 57715 ----a-w- c:\programdata\DivX\Player\Uninstaller.exe

2010-07-08 19:19 . 2010-07-08 19:19 -------- d-----w- c:\users\Admin\AppData\Roaming\DivX

2010-07-08 19:14 . 2010-07-08 19:14 54153 ----a-w- c:\programdata\DivX\DFXPlugin\Uninstaller.exe

2010-07-08 19:10 . 2010-05-23 08:19 1062184 ----a-w- c:\programdata\DivX\Setup\Resource.dll

2010-07-08 19:10 . 2010-05-23 08:19 895256 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe

2010-07-08 19:09 . 2009-02-08 17:06 109864 ----a-w- c:\users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-08 09:21 . 2010-07-08 09:20 -------- d-----w- c:\users\Sebastian\AppData\Roaming\ManyCam

2010-07-08 09:20 . 2010-07-08 09:20 -------- d-----w- c:\program files\ManyCam

2010-07-08 09:17 . 2010-07-08 08:30 -------- d-----w- c:\program files\Fake Webcam

2010-07-08 08:25 . 2009-09-20 17:57 -------- d-----w- c:\users\Sebastian\AppData\Roaming\GetRightToGo

2010-07-07 21:42 . 2010-07-07 21:31 -------- d-----w- c:\program files\UltraVPN

2010-07-07 00:54 . 2009-02-07 21:09 147057 ----a-w- c:\windows\hpoins31.dat

2010-07-06 18:38 . 2010-07-06 03:59 -------- d-----w- c:\program files\Red Storm Entertainment

2010-07-06 05:45 . 2002-04-28 14:37 163644 ----a-w- c:\windows\system32\drivers\SECDRV.SYS

2010-07-06 05:12 . 2010-07-06 05:12 -------- d-----w- c:\program files\Ubisoft

2010-07-05 22:49 . 2010-07-05 22:49 -------- d-----w- c:\program files\Ubi Soft

2010-07-05 22:44 . 2010-07-05 22:49 89360 ----a-w- c:\windows\system32\VB5DB.DLL

2010-07-05 22:44 . 2010-07-05 22:49 69632 ----a-w- c:\windows\system32\xmltok.dll

2010-07-05 22:44 . 2010-07-05 22:49 36864 ----a-w- c:\windows\system32\xmlparse.dll

2010-07-05 22:44 . 2010-07-05 22:49 28432 ----a-w- c:\windows\system32\msxmlr.dll

2010-07-05 22:44 . 2010-07-05 22:49 26064 ----a-w- c:\windows\system32\xmlinst.exe

2010-07-05 22:44 . 2010-07-05 22:49 24576 ----a-w- c:\windows\system32\msxml3a.dll

2010-07-05 06:56 . 2010-07-05 06:12 -------- d-----w- c:\program files\America's Army

2010-07-04 17:12 . 2009-02-07 19:37 109864 ----a-w- c:\users\Sebastian\AppData\Local\GDIPFONTCACHEV1.DAT

2010-07-02 23:48 . 2010-07-02 23:48 85504 ----a-w- c:\users\Sebastian\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0B.dll

2010-07-02 23:48 . 2010-06-26 02:53 -------- d-----w- c:\users\Sebastian\AppData\Roaming\SystemRequirementsLab

2010-06-26 07:25 . 2010-06-26 07:25 -------- d-----w- c:\programdata\GRAW2

2010-06-26 07:23 . 2010-06-26 07:23 -------- d-----w- c:\program files\AGEIA Technologies

2010-06-26 07:19 . 2010-06-26 07:19 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-06-26 06:05 . 2010-08-11 19:12 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-26 06:02 . 2010-08-11 19:12 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-06-26 06:02 . 2010-08-11 19:12 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-06-26 04:25 . 2010-08-11 19:12 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2010-06-26 02:53 . 2010-06-26 02:53 -------- d-----w- c:\program files\SystemRequirementsLab

2010-06-26 02:53 . 2010-06-26 02:53 85504 ----a-w- c:\users\Sebastian\AppData\Roaming\SystemRequirementsLab\srlproxy_cyri_4.1.71.0A.dll

2010-06-25 02:07 . 2009-03-11 23:15 -------- d-----w- c:\program files\Microsoft.NET

2010-06-21 21:21 . 2009-09-02 03:18 -------- d-----w- c:\users\Sebastian\AppData\Roaming\vlc

2010-06-21 13:37 . 2010-08-11 19:12 2037760 ----a-w- c:\windows\system32\win32k.sys

2010-06-18 17:31 . 2010-08-11 19:12 36864 ----a-w- c:\windows\system32\rtutils.dll

2010-06-11 16:16 . 2010-08-11 19:12 274944 ----a-w- c:\windows\system32\schannel.dll

2010-06-09 01:06 . 2010-06-09 01:06 53248 ----a-r- c:\users\Sebastian\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2010-06-07 23:25 . 2009-02-10 22:09 5972 ----a-w- c:\users\Admin\AppData\Local\d3d9caps.dat

2010-06-07 19:50 . 2010-06-07 19:41 6656 ----a-w- c:\windows\system32\bcmwlrc.dll

2010-06-04 06:38 . 2010-06-04 06:38 56997 ----a-w- c:\programdata\DivX\WebPlayer\Uninstaller.exe

2010-06-04 06:38 . 2010-06-04 06:38 53600 ----a-w- c:\programdata\DivX\Update\Uninstaller.exe

2010-06-04 06:37 . 2010-06-04 06:37 54128 ----a-w- c:\programdata\DivX\Converter\Uninstaller.exe

2010-06-04 06:37 . 2010-06-04 06:37 54644 ----a-w- c:\programdata\DivX\TranscodeEngine\Uninstaller.exe

2010-06-04 06:37 . 2010-06-04 06:37 54101 ----a-w- c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe

2010-06-02 16:30 . 2009-04-09 17:52 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys

2010-05-27 20:08 . 2010-08-11 19:12 81920 ----a-w- c:\windows\system32\iccvid.dll

2010-05-26 20:24 . 2010-04-22 19:10 18488 ----a-w- c:\windows\Help\OEM\scripts\HPHC_BUY_BATTERY.exe

2010-05-26 17:06 . 2010-06-09 17:12 34304 ----a-w- c:\windows\system32\atmlib.dll

2010-05-26 14:47 . 2010-06-09 17:12 289792 ----a-w- c:\windows\system32\atmfd.dll

2010-05-23 08:18 . 2010-05-23 08:18 84040 ----a-w- c:\programdata\DivX\TransferWizard\Uninstaller.exe

2010-05-23 08:17 . 2010-05-23 08:17 57054 ----a-w- c:\programdata\DivX\DSDesktopComponents\Uninstaller.exe

2008-10-23 05:54 . 2008-10-23 05:42 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

.

------- Sigcheck -------

[-] 2010-01-30 . 690D53BD10A804BB6D0A772D1C0E6907 . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BitTorrent DNA"="c:\users\Sebastian\Program Files\DNA\btdna.exe" [2009-02-08 342848]

"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2010-05-25 5475403]

"SansaDispatch"="c:\users\Sebastian\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-12-28 79872]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-08-07 327472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 145944]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-09-24 468264]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2008-10-07 210216]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-10-09 75008]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-07-12 74752]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-15 2065760]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-30 202256]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]

"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-05-18 1311312]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

PowerMenu.lnk - c:\program files\PowerMenu\PowerMenu.exe [2002-12-19 57344]

Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2010-6-13 113664]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

Privoxy.lnk - c:\program files\Vidalia Bundle\Privoxy\privoxy.exe [2006-11-20 250368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer3"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(:D8,92,01,77,55,3d,ca,01

R0 ttgfl;ttgfl;c:\windows\System32\drivers\kbqaf.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]

R3 pbfilter;pbfilter;c:\program files\PeerBlock\pbfilter.sys [x]

R3 PsSdk41;PsSdk41;c:\windows\system32\Drivers\pssdk41.sys [2009-06-09 36928]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-02-01 691696]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-07-15 216400]

S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-07-15 243024]

S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-15 308136]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [2008-10-06 365952]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-06-29 112128]

S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.2;c:\windows\system32\DRIVERS\libusb0.sys [2007-05-11 29184]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contents of the 'Scheduled Tasks' folder

2010-08-14 c:\windows\Tasks\HPCeeScheduleForAdmin.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-23 18:34]

2010-08-13 c:\windows\Tasks\HPCeeScheduleForSebastian.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-23 18:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\a5f7v7m2.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: network.proxy.type - 1

FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll

FF - component: c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\a5f7v7m2.default\extensions\lazarus@interclue.com\platform\WINNT_x86-msvc\components\WeaveCrypto.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: c:\users\Sebastian\Program Files\DNA\plugins\npbtdna.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

HKCU-Run-TomTomHOME.exe - c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

AddRemove-Cross Channel - c:\program files\uninstall.exe

AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-15 12:54

Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

SansaDispatch = c:\users\Sebastian\AppData\Roaming\SanDisk\Sansa Updater\SansaDispatch.exe?211.t ????????F?I???I???????c:\users\Sebastian\AppData\Roaming\SanDisk\San

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2010-08-15 12:59:29

ComboFix-quarantined-files.txt 2010-08-15 17:59

Pre-Run: 61,659,840,512 bytes free

Post-Run: 61,409,255,424 bytes free

- - End Of File - - 54BFFCC2B35B451276585A4F9FE03DD6

Maniac · August 16, 2010

Open Notepad and copy and paste the text in the code box below into it:

Driver::
kbqaf
ttgfl

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Hvehve · August 16, 2010

Here

ComboFix 10-08-15.04 - Sebastian 6/2010 Mon 10:27:09.2.2 - x86

Running from: c:\users\Sebastian\Desktop\Combo-Fix.exe

Command switches used :: c:\users\Sebastian\Desktop\CFScript.txt

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_ttgfl

((((((((((((((((((((((((( Files Created from 2010-07-16 to 2010-08-16 )))))))))))))))))))))))))))))))

.

2010-08-16 15:34 . 2010-08-16 15:34 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-08-16 15:34 . 2010-08-16 15:34 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-08-15 17:34 . 2010-08-15 17:59 -------- d-----w- C:\Combo-Fix