MBAM detected Rootkit.Dropper

psa25 · September 2, 2010

Hello

While doing a semi-regular malware scan with MBAM it informed me it had detected a Rootkit.Dropper and I quarantined it. Subsequently I did a full virus scan with Avast free 5 and Avira rescue cd but nothing was found. I googled Rootkit.Dropper and results pointed here so I followed the instructions and did a DDS and GMER scan.

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4521

Windows 5.1.2600 Service Pack 3, v.5938

Internet Explorer 8.0.6001.18702

01/09/2010 13:13:44

mbam-log-2010-09-01 (13-13-44).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 359384

Time elapsed: 48 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\P\Application Data\Thinstall\{02A4F43E-98ED-4236-9D15-A9FB2C1376F2}\1000000b00002i\rundll32.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.

------

Here is the DDS.txt log:

DDS (Ver_10-03-17.01) - FAT32x86

Run by P at 12:24:56.45 on 02/09/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1392 [GMT 1:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\COMODO\Firewall\cmdagent.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\COMODO\Firewall\cfp.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Program Files\Creative\DVDAudio\CTDVDDET.EXE

C:\WINDOWS\system32\spoolsv.exe

E:\Program Files\iTunes\iTunesHelper.exe

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\PROGRA~1\Eraser\Eraser.exe

E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

E:\Program Files\Diskeeper\DkService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

E:\Program Files\Macrium\Reflect\ReflectService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\System32\StkASv2K.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Documents and Settings\P\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - e:\progra~1\spybot~1\SDHelper.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - e:\program files\free download manager\iefdm2.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [spybotSD TeaTimer] e:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe

mRun: [36X Raid Configurer] c:\windows\system32\xRaidSetup.exe boot

mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\cfp.exe" -h

mRun: [Adobe Reader Speed Launcher] "e:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [CTHelper] CTHELPER.EXE

mRun: [CTDVDDET] "c:\program files\creative\dvdaudio\CTDVDDET.EXE"

mRun: [DiskeeperSystray] "e:\program files\diskeeper\DkIcon.exe"

mRun: [QuickTime Task] "c:\program files\quicktime alternative\QTTask.exe" -atboottime

mRun: [iTunesHelper] "e:\program files\itunes\iTunesHelper.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [COMODO Internet Security] "c:\program files\comodo\firewall\cfp.exe" -h

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Eraser] "c:\progra~1\eraser\Eraser.exe" --atRestart

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

IE: Download all with Free Download Manager - file://e:\program files\free download manager\dlall.htm

IE: Download selected with Free Download Manager - file://e:\program files\free download manager\dlselected.htm

IE: Download video with Free Download Manager - file://e:\program files\free download manager\dlfvideo.htm

IE: Download with Free Download Manager - file://e:\program files\free download manager\dllink.htm

IE: E&xport to Microsoft Excel - e:\progra~1\micros~1\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - e:\progra~1\micros~1\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\progra~1\spybot~1\SDHelper.dll

DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} - hxxp://simcity.ea.com/update/EARTPX.cab

DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - hxxp://www.eset.eu/buxus/docs/OnlineScanner.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281021520234

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281021509562

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} - hxxp://simcity.ea.com/update/MaxisSimCity4PatcherX.cab

DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: AtiExtEvent - Ati2evxx.dll

AppInit_DLLs: c:\windows\system32\guard32.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\p\applic~1\mozilla\firefox\profiles\hwvym7ln.default\

FF - prefs.js: browser.startup.homepage - www.google.co.uk

FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?ei=utf-8&fr=megaup&p=

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin2.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin3.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin4.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin5.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin6.dll

FF - plugin: c:\program files\quicktime alternative\plugins\npqtplugin7.dll

FF - plugin: e:\program files\adobe\reader 9.0\reader\browser\nppdf32.dll

FF - plugin: e:\program files\itunes\mozilla plugins\npitunes.dll

FF - plugin: e:\program files\videolan\vlc\npvlc.dll

FF - HiddenExtension: Java Console: No Registry Reference - e:\program files\mozilla firefox 4.0 beta 1\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - e:\program files\mozilla firefox 4.0 beta 1\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [2008-5-20 15328]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-7-14 165456]

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-5-16 134344]

R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-5-16 25160]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-7-14 17744]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-7-14 40384]

R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\firewall\cmdagent.exe [2008-5-16 723632]

R2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-7-29 20072]

R2 ReflectService;Macrium Reflect Image Mounting Service;e:\program files\macrium\reflect\ReflectService.exe [2009-11-12 220128]

R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-7-14 40384]

R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-7-14 40384]

R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [2009-3-7 99352]

R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-7 555032]

R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-7 566296]

S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [2009-3-7 99352]

S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [2009-3-7 555032]

S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-7 100888]

S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [2009-3-7 100888]

S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [2009-3-7 566296]

S3 GVTDrv;GVTDrv;c:\windows\system32\drivers\GVTDrv.sys [2008-5-16 24944]

S3 MarkFun_NT;MarkFun_NT;\??\c:\program files\gigabyte\et5pro\markfun.w32 --> c:\program files\gigabyte\et5pro\markfun.w32 [?]

S3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [2009-11-12 32736]

S3 RTLWUSB;USB 54M Wireless Network Adapter;c:\windows\system32\drivers\rtl8187.sys --> c:\windows\system32\drivers\RTL8187.sys [?]

S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]

S3 TfBulk;TfBulk;c:\windows\system32\drivers\TfBulk.SYS [2007-5-31 13312]

=============== Created Last 30 ================

2010-09-02 10:52:02 0 ----a-w- c:\documents and settings\p\defogger_reenable

2010-09-01 23:46:04 4958588 ------w- c:\windows\{00000005-00000000-00000000-00001102-00000008-10211102}.BAK

2010-09-01 12:28:19 0 d-sha-r- C:\cmdcons

2010-08-30 16:49:56 38 ----a-w- c:\windows\avisplitter.ini

2010-08-30 16:49:51 790528 ----a-w- c:\windows\system32\xvidcore.dll

2010-08-30 16:49:51 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest

2010-08-30 16:49:51 232448 ----a-w- c:\windows\system32\mp3fhg.acm

2010-08-30 16:49:51 217088 ----a-w- c:\windows\system32\yv12vfw.dll

2010-08-30 16:49:51 151552 ----a-w- c:\windows\system32\ac3acm.acm

2010-08-30 16:49:51 134144 ----a-w- c:\windows\system32\xvidvfw.dll

2010-08-30 16:49:51 108032 ----a-w- c:\windows\system32\ff_vfw.dll

2010-08-30 16:49:49 0 d-----w- c:\program files\K-Lite Codec Pack

2010-08-29 11:31:50 715776 -c----w- c:\windows\system32\dllcache\ntdll.dll

2010-08-29 11:31:50 179712 -c----w- c:\windows\system32\dllcache\mrxdav.sys

2010-08-28 00:04:36 3120 ----a-w- c:\windows\system32\PE6RTEOI.ocx

2010-08-28 00:04:36 3120 ----a-w- c:\windows\FK6JR9KH.ocx

2010-08-28 00:00:43 0 d-----w- c:\docume~1\p\applic~1\Downloaded Installations

2010-08-24 14:28:56 0 d-----w- c:\docume~1\p\applic~1\CorsixTH

2010-08-24 14:07:18 299008 ----a-w- c:\windows\uninst.exe

2010-08-23 16:13:50 0 d-----w- c:\docume~1\p\applic~1\TrueCrypt

2010-08-23 16:13:33 230736 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2010-08-14 12:30:42 3621 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.dat

2010-08-14 12:30:42 33846 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Nero AAC Encoder.bmp

2010-08-14 12:30:28 33846 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.bmp

2010-08-14 12:30:28 3328 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp AAC Encoder.dat

2010-08-10 14:49:16 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-08-10 14:46:31 133440 ----a-w- c:\windows\system32\LnkProtect.dll

2010-08-10 14:43:55 0 d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro

2010-08-10 14:43:54 0 d-----w- c:\program files\Hitman Pro 3.5

2010-08-08 11:53:28 285696 -c----w- c:\windows\system32\dllcache\atmfd.dll

2010-08-08 11:53:01 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2010-08-08 11:51:04 1851264 -c----w- c:\windows\system32\dllcache\win32k.sys

2010-08-08 11:45:24 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2010-08-07 14:04:10 0 d-----w- c:\program files\Eraser

2010-08-07 13:35:05 33846 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.bmp

2010-08-07 13:35:05 3143 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat

2010-08-06 08:18:21 0 d-----w- c:\docume~1\p\applic~1\WinPatrol

2010-08-05 21:15:10 8461312 -c----w- c:\windows\system32\dllcache\shell32.dll

2010-08-05 15:19:09 15064 ----a-w- c:\windows\system32\wuapi.dll.mui

2010-08-05 14:51:41 0 d-----w- c:\docume~1\p\applic~1\Secunia CSI

==================== Find3M ====================

2010-08-14 12:30:14 3291 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat

2010-08-14 12:29:42 949992 ----a-w- c:\windows\system32\SpoonUninstall.exe

2010-07-28 13:42:31 4383 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis aoTuV Encoder.dat

2010-07-28 12:08:57 3003 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat

2010-07-17 04:00:04 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-30 14:56:37 715776 ----a-w- c:\windows\system32\ntdll.dll

2010-06-28 20:57:33 38848 ----a-w- c:\windows\avastSS.scr

2010-06-16 11:27:54 3012 ----a-w- c:\windows\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat

2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

2009-04-16 14:36:22 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009041620090417\index.dat

============= FINISH: 12:25:10.15 ===============

I had a little trouble with GMER. After it had scanned and I saved the ark.txt log to the desktop and closed GMER, Windows seemed to slow down and grind to a halt. I tried ctrl-alt-delete to open the task manager but it wouldn't respond, so I had to do a hard reset. When the computer restarted it was fine.

Thanks in advance for your help and time

Paolo

Attach.zip

Maniac · September 2, 2010

Hello Paolo! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

Why do you think that your system is infected? Only for this file?

psa25 · September 2, 2010

Hello Borislav

Thanks for replying.

I thought that my system may possibly have a rootkit on it as I assumed the Rootkit.Dropper was an installer. This is the first time MABM has warned me of an infection, do you think it may be a false alarm?

Thanks

Paolo

Maniac · September 5, 2010

I see. It seems not, but let's check. Thank you!

Step 1

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

After you disabled Teatimer, download ResetTeaTimer.exe to your desktop.

Then run ResetTeaTimer.exe.

This will only take a few seconds.

Step 2

Please, uninstall the following applications:

Adobe Reader 9

You can read, how to do this here:

Step 3

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it back when you reply
Then look for the following Java folders and if found delete them.
C:\Program Files\Java
C:\Program Files\Common Files\Java
C:\Windows\Sun
C:\Documents and Settings\All Users\Application Data\Java
C:\Documents and Settings\All Users\Application Data\Sun\Java
C:\Documents and Settings\username\Application Data\Java
C:\Documents and Settings\username\Application Data\Sun\Java

Step 4

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s):

JavaRa log
Malwarebytes' Anti-Malware log
a new fresh DDS log only

psa25 · September 5, 2010

Hello Borislav

I have disabled Teatimer, uninstalled Adobe Reader and removed JAVA.

Here are the logs you requested:

=====

JavaRa 1.16 Removal Log.Report follows after line.------------------------------------The JavaRa removal process was started on Fri Sep 03 00:24:31 2010

Found and removed: Software\Classes\JavaPlugin.160_06------------------------------------Finished reporting.JavaRa 1.16 Removal Log.Report follows after line.------------------------------------The JavaRa removal process was started on Sun Sep 05 17:15:29 2010

------------------------------------Finished reporting.

=====

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4550

Windows 5.1.2600 Service Pack 3, v.5938

Internet Explorer 8.0.6001.18702

05/09/2010 17:24:51

mbam-log-2010-09-05 (17-24-51).txt

Scan type: Quick scan

Objects scanned: 153279

Time elapsed: 3 minute(s), 2 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

=====

DDS (Ver_10-03-17.01) - FAT32x86

Run by P at 17:41:30.62 on 05/09/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1487 [GMT 1:00]