Scan results from infected computer

pminkler · September 14, 2010

Hi! I have noticed lately that Firefox is opening new tabs at random, containing ads like Registry Defender and various "Google" money schemes. I was able to find instructions from you all about various scans to run and such, and I would like to share the results.

First of all, I have been running Malwarebytes, Ad-Aware, and Avast, and none of these are picking up any threats other than cookies, which only Ad-Aware is picking up. I recently uninstalled AVG, as it was picking up "unavailable" viruses, and an internet search that I did suggested that that might mean that AVG itself was infected. I now suspect that it wasn't and that it alone was finding this issue.

Regardless ... I followed the basic steps that you all had posted in a forum, and I have a bunch of results to post for you. I have now run the GMER Rootkit Scanner five times, but it becomes unresponsive immediately after running, and I have been unable to save the results. I'm not sure what to do about that -- hopefully, the remainder of the scans will tell you something. Finally, I know that I was supposed to include "DDS.txt" in the body of this post, but my computer won't let me open the file ... so I just zipped it and attached it.

Thank you so much for your help!

pminkler

DDS.zip

Attach.zip

mbam_log_2010_09_09__10_43_16_.txt

Gammo · September 16, 2010

Hi,

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
Click me
If you can't disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

pminkler · September 16, 2010

Hi! Thank you so much for your help. I just did everything specified in your previous post -- I was able to disable Avast and Ad-Aware, but I couldn't figure out how to disable Malwarebytes. I ran ComboFix, and I have attached the log.

It's my work computer that's having these issues, and I will be out of the office until Tuesday morning. If I hear back from you before then (I will check periodically from home), I will try to run by the office over the weekend and do what I need to do ... but if you don't hear from me until Tuesday, don't worry -- I will be back.

We have another office computer with the same popup/new tabs that I was getting. Would it be safe to repeat this process (once it's finished) on that computer?

Thanks again for your help -- I really appreciate it!

log.txt

Gammo · September 16, 2010

Hi,

As a business computer you need to have a license for use of MBAM. Please send a private message with your Cleverbridge order reference number to AdvancedSetup (Manager of Online Support) and they can assist you from the Corporate Support.

pminkler · September 17, 2010

I did not realize that and have submitted a request for a price quote for my (very small) company. In the meantime, however, I am concerned that I was told it would take 3-4 business days to process my request, and it will obviously take longer than that to actually get the licenses. I'm assuming I should get a quote by Tuesday or Wednesday, but my computer has had all these steps taken along the way and needs to be functional on Tuesday ... is it safe to use in its current state? If not, is there a way to speed along the process of getting a quote for licenses from you guys?

Gammo · September 17, 2010

Hi,

I believe you. You don't have the license yet, but I'll help you anyway.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do not attach your logs as it is harder for me to read them that way. Post them instead:

ComboFix 10-09-16.02 - PamHer 09/16/2010 13:54:40.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1214.865 [GMT -4:00]

Running from: c:\documents and settings\PamHer\Desktop\ComboFix.exe

AV: avast! Antivirus *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\dxe.txt

c:\windows\system32\fsc.txt

c:\windows\system32\ide.txt

c:\windows\system32\klgd.bmp

c:\windows\system32\lrg.txt

c:\windows\system32\qks.txt

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_IAS

-------\Service_6to4

-------\Service_Ias

((((((((((((((((((((((((( Files Created from 2010-08-16 to 2010-09-16 )))))))))))))))))))))))))))))))

.

2010-09-15 12:25 . 2010-09-15 12:25 -------- d-----w- c:\documents and settings\PamHer\Application Data\Bitrix Security

2010-09-14 20:30 . 2010-09-14 20:30 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Bitrix Security

2010-09-09 13:20 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-09 13:20 . 2010-09-09 13:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-09 13:20 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-01 19:34 . 2010-09-01 19:42 -------- dc-h--w- c:\windows\ie8

2010-09-01 13:00 . 2010-06-28 20:32 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2010-09-01 13:00 . 2010-06-28 20:37 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys

2010-09-01 13:00 . 2010-06-28 20:33 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2010-09-01 13:00 . 2010-06-28 20:37 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2010-09-01 13:00 . 2010-06-28 20:32 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2010-09-01 13:00 . 2010-06-28 20:32 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys

2010-09-01 13:00 . 2010-06-28 20:32 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2010-09-01 12:59 . 2010-06-28 20:57 38848 ----a-w- c:\windows\avastSS.scr

2010-09-01 12:59 . 2010-06-28 20:57 165032 ----a-w- c:\windows\system32\aswBoot.exe

2010-09-01 12:59 . 2010-09-01 12:59 -------- d-----w- c:\program files\Alwil Software

2010-09-01 12:59 . 2010-09-01 12:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-14 20:30 . 2010-09-14 20:30 49664 ----a-w- c:\documents and settings\NetworkService\Application Data\Bitrix Security\dnmyf12.dll

2010-09-01 13:51 . 2010-07-13 19:38 0 ----a-w- c:\documents and settings\PamHer\Local Settings\Application Data\prvlcl.dat

2010-09-01 13:21 . 2010-09-01 13:20 2788816 ----a-w- c:\documents and settings\PamHer\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

2010-08-31 14:10 . 2006-11-17 15:58 -------- d-----w- c:\program files\Citrix

2010-08-17 17:59 . 2010-08-17 17:59 1244648 ----a-w- c:\documents and settings\administrator.BRAC\Application Data\MSNInstaller\msnauins.exe

2010-08-17 17:59 . 2010-08-17 17:59 -------- d-----w- c:\documents and settings\administrator.BRAC\Application Data\MSNInstaller

2010-08-05 17:42 . 2006-04-12 14:04 68640 ----a-w- c:\documents and settings\PamHer\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-08-04 14:13 . 2010-08-03 15:37 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-08-03 15:46 . 2006-03-02 15:14 -------- d-----w- c:\program files\Common Files\Adobe

2010-08-03 15:41 . 2010-08-03 15:41 -------- d-----w- c:\program files\Common Files\Adobe AIR

2010-08-03 15:38 . 2010-08-03 15:38 77184 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

2010-08-03 13:48 . 2010-08-03 13:48 -------- dc----w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}

2010-07-20 12:59 . 2010-07-20 12:59 -------- d-----w- c:\documents and settings\LocalService\Application Data\McAfee

2010-07-12 08:56 . 2010-08-03 13:48 2979280 -c--a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe

2010-07-12 08:55 . 2010-06-24 21:54 15880 ----a-w- c:\windows\system32\lsdelete.exe

2010-07-07 18:14 . 2006-03-02 15:20 68640 ----a-w- c:\documents and settings\aliadmin.BRAC\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-24 18:40 . 2010-06-24 18:40 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-06-24 18:40 . 2010-06-24 18:40 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2010-06-22 14:48 . 2010-06-07 10:56 112 ----a-w- c:\documents and settings\All Users\Application Data\LT8325IV.dat

.

<pre>
c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\Common Files\Microsoft Shared\DW\dwtrig20 .exe
c:\program files\Compaq\SetRefresh\SetRefresh .exe
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
c:\program files\HP\HP Software Update\HPWuSchd2 .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\PDF Complete\pdfsty .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]

"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [N/A]

"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [N/A]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [N/A]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [N/A]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Aroyez"="c:\windows\BDXPTck.dll" [N/A]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10b.exe" [2009-02-03 240544]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/24/2010 2:40 PM 64288]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [9/1/2010 9:00 AM 165456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [9/1/2010 9:00 AM 17744]

R2 eBLVD;eBLVD;c:\program files\eBLVD\ebhost.exe [7/8/2010 9:40 AM 462296]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/11/2007 11:42 AM 24652]

S2 COMServer;COMServer;"c:\windows\system32\msapps\comsrvr.exe" s --> c:\windows\system32\msapps\comsrvr.exe [?]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 4:55 AM 1355928]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/11/2010 8:56 AM 15008]

S3 mipsinf;mipsinf;\??\c:\windows\system32\mipsinf.sys --> c:\windows\system32\mipsinf.sys [?]

S3 PCAlertDriver;PCAlertDriver;\??\c:\biostools\NTGLM7X.sys --> c:\biostools\NTGLM7X.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3BE36237-0244-4960-9C22-1B5D337E5591}]

2010-09-14 20:30 49664 ----a-w- c:\documents and settings\NetworkService\Application Data\Bitrix Security\dnmyf12.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8656E568-BE29-4C1B-AE2B-59B45CB2E24C}]

zfsudknm.dll [N/A]

.

Contents of the 'Scheduled Tasks' folder

2010-09-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 12:41]

2010-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

c:\windows\Tasks\At370.job

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.aol.com/

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5577

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html

DPF: {78698357-BDDC-453D-B65A-EC341DC23922} - hxxps://va00x-obgyn.nash.digichart.com/OB/WebReporting/res/DigiWebPrint.cab

FF - ProfilePath - c:\documents and settings\PamHer\Application Data\Mozilla\Firefox\Profiles\vwtc22p8.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.aol.com

FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

BHO-{43460459-FB0C-46CA-B8F5-BB9013229611} - zfsudknm.dll

AddRemove-Mozilla Firefox (2.0.0.11) - f:\system\Apps\3C9F7B3F-D55C-42cd-8537-B878518B73AF\Exec\firefox\uninstall\helper.exe

AddRemove-Octoshape add-in for Adobe Flash Player - c:\documents and settings\PamHer\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-16 14:14

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fb,c4,1e,5c,05,6c,0f,44,98,3d,31,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fb,c4,1e,5c,05,6c,0f,44,98,3d,31,\

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(944)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1844)

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\OneX.DLL

c:\windows\system32\eappprxy.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Cisco Systems\VPN Client\cvpnd.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

.

**************************************************************************

.

Completion time: 2010-09-16 14:25:31 - machine was rebooted

ComboFix-quarantined-files.txt 2010-09-16 18:25

Pre-Run: 4,655,472,640 bytes free

Post-Run: 6,607,822,848 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 619EBE95CD2E07E62AB3BA1506DB1211

Gammo · September 17, 2010

Hi,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

http://forums.malwarebytes.org/index.php?showtopic=62664

Collect::
c:\documents and settings\NetworkService\Application Data\Bitrix Security\dnmyf12.dll

Folder::
c:\documents and settings\PamHer\Application Data\Bitrix Security
c:\documents and settings\NetworkService\Application Data\Bitrix Security
c:\windows\system32\msapps

File::
c:\documents and settings\All Users\Application Data\LT8325IV.dat
c:\windows\BDXPTck.dll
c:\windows\system32\mipsinf.sys
c:\windows\Tasks\At370.job

Registry::
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Aroyez"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{3BE36237-0244-4960-9C22-1B5D337E5591}
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8656E568-BE29-4C1B-AE2B-59B45CB2E24C}]

RenV::
c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray .exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\Common Files\Microsoft Shared\DW\dwtrig20 .exe
c:\program files\Compaq\SetRefresh\SetRefresh .exe
c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
c:\program files\HP\HP Software Update\HPWuSchd2 .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\PDF Complete\pdfsty .exe

Driver::
COMServer
mipsinf

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5577

KillAll::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

pminkler · September 20, 2010

Hello again! You are my favorite person ever. I really appreciate your continuing to help me -- I still haven't heard anything about the license quotes, and I'm so glad that I can continue trying to fix this in the meantime. My husband is now following your instructions via remote log-in to the computer in question, so we're copying and pasting things -- I'm not sending them directly from the machine we're working on. I hope nothing has gotten lost in translation!

Here is the latest log:

ComboFix 10-09-16.02 - pamher 09/19/2010 20:34:45.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1214.573 [GMT -4:00]

Running from: c:\documents and settings\PamHer\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\PamHer\Desktop\CFScript.txt

AV: avast! Antivirus *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

FILE ::

"c:\documents and settings\All Users\Application Data\LT8325IV.dat"

"c:\windows\BDXPTck.dll"

"c:\windows\system32\mipsinf.sys"

"c:\windows\Tasks\At370.job"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\LT8325IV.dat

c:\documents and settings\NetworkService\Application Data\Bitrix Security

c:\documents and settings\NetworkService\Application Data\Bitrix Security\dnmyf12_shrd

c:\documents and settings\NetworkService\Application Data\Bitrix Security\iuh

c:\documents and settings\NetworkService\Application Data\Bitrix Security\qnf.txt

c:\documents and settings\PamHer\Application Data\Bitrix Security

c:\documents and settings\PamHer\Application Data\Bitrix Security\dnmyf12_shrd

c:\windows\system32\msapps

c:\windows\Tasks\At370.job

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_COMSERVER

-------\Legacy_MIPSINF

-------\Service_COMServer

-------\Service_mipsinf

((((((((((((((((((((((((( Files Created from 2010-08-20 to 2010-09-20 )))))))))))))))))))))))))))))))

.

2010-09-19 18:54 . 2010-09-19 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage

2010-09-19 15:28 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-09-19 15:25 . 2010-06-24 12:21 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll

2010-09-19 15:24 . 2010-09-19 15:24 -------- d-----w- c:\documents and settings\PamHer\Local Settings\Application Data\LogMeIn

2010-09-19 15:24 . 2010-09-19 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\LogMeIn

2010-09-19 15:24 . 2010-09-19 15:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ICS

2010-09-19 15:24 . 2010-06-02 20:06 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2010-09-19 15:24 . 2010-06-02 20:06 53632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll

2010-09-19 15:24 . 2010-06-02 20:06 29568 ----a-w- c:\windows\system32\LMIport.dll

2010-09-19 15:24 . 2010-01-27 16:22 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys

2010-09-19 15:24 . 2010-06-02 20:06 87424 ----a-w- c:\windows\system32\LMIinit.dll

2010-09-19 15:24 . 2010-09-19 15:24 -------- d-----w- c:\program files\LogMeIn