Rogue Antivirus

Judy Lee · September 19, 2010

As instructed on your What Do I Do Now Page, I completed the following steps:

I downloaded Defogger. When I tried to run it, I received the message:

C:\Documents and Settings\Judy\Desktop\Defogger.exe is not a valid Win32 application.

I downloaded dds.scr. When I tried to run it, I received the message:

C:\Documents and Settings\Judy\Desktop\dds.scr is not a valid Win32 application.

I downloaded GMER, made the changes in the right panel which you suggested, and ran it. It ran for about 30 minutes, and then I got the blue screen stating "A problem has been encountered, and windows is shutting down to prevent damage to your system."

The computer rebooted. I started GMER again, and tried to save the few lines of information on the screen, but the program froze and I got (Not responding) message. I had to kill the program through Task Manager.

Now I find that every action (mouse click) is taking several minutes to acknowledge. I had to force shutdown. On reboot, I was able to get online and send the following log to my main computer.

Here is the MBAM log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4635

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

9/17/2010 10:11:26 AM

mbam-log-2010-09-17 (10-11-26).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 264903

Time elapsed: 1 hour(s), 18 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\us?rinit.exe (Rogue.Antivirus2010) -> Quarantined and deleted successfully.

Thank you for your help. I greatly appreciate it.

Judy Lee

Gammo · September 22, 2010

Hi,

Please download ComboFix from: Here to your Desktop.

**Note:**In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Tools->Options->Main tab
- Set to "Always ask me where to Save the files".

[*]During the download, rename Combofix to the name provided in the image below:

Cfix_explorer.exe.jpg

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.

[*]Double click on the renamed version of ComboFix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the ComboFix log which can be found in the root drive (usually the C: Drive) for further review.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

If you can't run the renamed version of ComboFix, then please try running it in Safe Mode. You can reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Judy Lee · September 22, 2010

Following is my ComboFix log:

ComboFix 10-09-22.02 - Judy 09/22/2010 15:14:21.7.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.520 [GMT -4:00]

Running from: c:\documents and settings\Judy\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\.wtav

c:\documents and settings\Judy\Local Settings\Application Data\{4C5E87FD-822C-40E8-8014-6E99B894CBCB}

c:\documents and settings\Judy\Local Settings\Application Data\{4C5E87FD-822C-40E8-8014-6E99B894CBCB}\chrome.manifest

c:\documents and settings\Judy\Local Settings\Application Data\{4C5E87FD-822C-40E8-8014-6E99B894CBCB}\chrome\content\_cfg.js

c:\documents and settings\Judy\Local Settings\Application Data\{4C5E87FD-822C-40E8-8014-6E99B894CBCB}\chrome\content\overlay.xul

c:\documents and settings\Judy\Local Settings\Application Data\{4C5E87FD-822C-40E8-8014-6E99B894CBCB}\install.rdf

c:\documents and settings\Judy\Local Settings\Application Data\Windows Server

c:\documents and settings\Judy\Local Settings\Application Data\Windows Server\flags.ini

c:\documents and settings\Judy\Local Settings\Application Data\Windows Server\uses32.dat

c:\documents and settings\LocalService\Local Settings\Application Data\Windows Server

c:\documents and settings\NetworkService\Local Settings\Application Data\Windows Server

C:\feed.txt

c:\windows\system32\ESQULzxspectrum

c:\windows\system32\fsc.txt

c:\windows\system32\ide.txt

c:\windows\system32\klgd.bmp

c:\windows\system32\lrg.txt

c:\windows\system32\qks.txt

c:\windows\system32\USRINI~1.EXE

c:\windows\system32\xef.txt

Infected copy of c:\windows\system32\drivers\iaStor.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))

.

2010-09-15 01:29 . 2010-09-15 01:30 -------- d-----w- c:\documents and settings\Judy\Application Data\MSNInstaller

2010-09-08 17:17 . 2010-09-11 03:04 188496 ----a-w- c:\documents and settings\Judy\Local Settings\Application Data\prvlcl.dat

2010-08-31 16:11 . 2010-08-31 16:11 3401880 ----a-w- c:\documents and settings\Judy\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll

2010-08-31 15:55 . 2010-08-31 15:55 275096 ----a-w- c:\documents and settings\Judy\Application Data\Mozilla\plugins\npgoogletalk.dll

2010-08-31 15:39 . 2010-08-31 15:39 3734536 ----a-w- c:\documents and settings\Judy\Application Data\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll

2010-08-25 00:21 . 2010-08-25 00:21 -------- d-----w- c:\windows\system32\Adobe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-22 19:11 . 2010-05-05 05:41 824696 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2010-09-22 18:08 . 2009-03-21 02:50 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-09-19 23:48 . 2010-04-21 22:16 1 ----a-w- c:\documents and settings\Judy\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-09-07 01:21 . 2005-10-13 01:07 874240 ----a-w- c:\windows\system32\drivers\iaStor.sys

2010-09-04 08:57 . 2009-03-21 17:18 46 ----a-w- c:\documents and settings\Judy\jagex_runescape_preferences.dat

2010-09-04 08:30 . 2009-09-03 23:42 99 ----a-w- c:\documents and settings\Judy\jagex_runescape_preferences2.dat

2010-08-07 06:00 . 2010-08-07 06:00 0 ----a-w- c:\documents and settings\Judy\jagex__preferences3.dat

2010-08-01 23:33 . 2010-08-01 23:33 99664 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2010_08_01_16_34_26_small.dmp.zip

2010-08-01 20:34 . 2010-08-01 23:28 2096640 ----a-w- c:\windows\Internet Logs\xDB3B.tmp

2010-08-01 20:34 . 2010-08-01 23:28 1187840 ----a-w- c:\windows\Internet Logs\xDB3A.tmp

2010-07-27 21:36 . 2009-05-23 13:30 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2010-07-27 21:36 . 2010-07-27 21:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll

2010-07-27 21:34 . 2009-05-23 13:30 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys

2010-07-14 23:37 . 2009-06-02 22:25 16 ----a-w- c:\windows\popcinfot.dat

2010-07-09 03:23 . 2006-09-12 06:39 79456 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-08 12:39 . 2010-07-08 12:39 128886 ----a-w- c:\windows\Internet Logs\vsmon_2nd_2010_07_08_08_34_29_small.dmp.zip

2010-07-08 12:34 . 2010-07-08 12:34 2077696 ----a-w- c:\windows\Internet Logs\xDB39.tmp

2010-07-08 12:31 . 2009-11-02 01:28 17183057 ----a-w- c:\windows\Internet Logs\tvDebug.Zip

2010-07-08 05:31 . 2010-07-08 12:33 2077696 ----a-w- c:\windows\Internet Logs\xDB38.tmp

2010-06-27 18:13 . 2010-06-27 18:17 2062848 ----a-w- c:\windows\Internet Logs\xDB37.tmp

2010-06-27 17:57 . 2010-06-27 18:04 2062848 ----a-w- c:\windows\Internet Logs\xDB36.tmp

2010-06-26 04:21 . 2010-06-26 04:48 2059264 ----a-w- c:\windows\Internet Logs\xDB35.tmp

2010-06-25 09:52 . 2010-06-25 17:40 2054144 ----a-w- c:\windows\Internet Logs\xDB34.tmp

2008-01-05 21:56 . 2009-03-08 05:52 22 -csha-w- c:\windows\SMINST\HPCD.SYS

.

<pre>
c:\program files\AIM6\aim6 .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\QTTask	.exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\windows\SMINST\RecGuard .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [N/A]

"Aim6"="c:\program files\AIM6\aim6 .exe" [2009-05-19 49968]

"Google Update"="c:\documents and settings\Judy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-23 133104]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [N/A]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [N/A]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"SWHelper"="c:\windows\system32\Macromed\Shockwave 10\PostUpdate.exe" [2010-08-16 53248]

c:\documents and settings\Judy\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2009-12-16 0]

ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-8-21 900816]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-07-27 21:36 12536 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"RequireSignedAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@=""

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

[N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=

"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Documents and Settings\\Judy\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\Judy\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/23/2009 9:30 AM 216400]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/23/2009 9:30 AM 243024]

R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [7/27/2010 5:34 PM 921952]

R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [7/27/2010 5:36 PM 308136]

R3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5U870CAP.sys [6/6/2006 4:39 PM 61952]

S0 fkdl;fkdl;c:\windows\system32\drivers\ndwagps.sys --> c:\windows\system32\drivers\ndwagps.sys [?]

S0 ldebjscv;ldebjscv;c:\windows\system32\drivers\lftitk.sys --> c:\windows\system32\drivers\lftitk.sys [?]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 8:20 AM 12648]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2010\RpcAgentSrv.exe [5/31/2010 5:26 PM 93336]

S3 xboxdrv;xboxdrv;\??\c:\windows\system32\xboxdrv.sys --> c:\windows\system32\xboxdrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{11522865-037B-4E24-99D6-B43A3782302F}]

uaihv27.dll [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1DFC0CB0-CE09-4E94-BD01-91C2E9D2A7CA}]

zzir.dll [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{77D30FCF-771E-4EF4-9DCD-69056CA0B517}]

dfmcd21.dll [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7D94FE9D-0031-4911-9D51-2A24CB88120C}]

wokxgism8.dll [N/A]

.

Contents of the 'Scheduled Tasks' folder

2010-09-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-550649503-4093617429-2617151104-1005Core.job

- c:\documents and settings\Judy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-23 03:37]

2010-09-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-550649503-4093617429-2617151104-1005UA.job

- c:\documents and settings\Judy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-23 03:37]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/go/notebookaccessories

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

TCP: {4D908843-2D1F-43AF-BC92-EC2AFCB524B7} = 208.67.220.220,208.67.222.222

FF - ProfilePath - c:\documents and settings\Judy\Application Data\Mozilla\Firefox\Profiles\yklwuwgl.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p=

FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll

FF - plugin: c:\documents and settings\Judy\Application Data\Mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\documents and settings\Judy\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\documents and settings\Judy\Local Settings\Application Data\Google\Update\1.2.183.29\npGoogleOneClick8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-22 15:26

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\docume~1\Judy\LOCALS~1\Temp\catchme.dll

scan completed successfully

hidden files: 1

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2010-09-22 15:28:55

ComboFix-quarantined-files.txt 2010-09-22 19:28

Pre-Run: 25,470,263,296 bytes free

Post-Run: 25,666,981,888 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

Current=5 Default=5 Failed=4 LastKnownGood=6 Sets=1,4,5,6

- - End Of File - - 646072914A550F7EC76F822533FA5EA5

Thank you very much for your time and generosity.

Gammo · September 22, 2010

Hi,

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

http://forums.malwarebytes.org/index.php?showtopic=63056

Collect::
c:\windows\system32\drivers\ndwagps.sys
c:\windows\system32\drivers\lftitk.sys
c:\windows\system32\xboxdrv.sys

Driver::
fkdl
ldebjscv
xboxdrv

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{11522865-037B-4E24-99D6-B43A3782302F}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1DFC0CB0-CE09-4E94-BD01-91C2E9D2A7CA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{77D30FCF-771E-4EF4-9DCD-69056CA0B517}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7D94FE9D-0031-4911-9D51-2A24CB88120C}]

RenV::
c:\program files\AIM6\aim6 .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
c:\program files\iTunes\iTunesHelper .exe
c:\program files\QuickTime\QTTask	.exe
c:\program files\Spybot - Search & Destroy\TeaTimer .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\windows\SMINST\RecGuard .exe

KillAll::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Judy Lee · September 23, 2010

The resulting log follows...

ComboFix 10-09-22.02 - Judy 09/22/2010 20:26:54.8.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.437 [GMT -4:00]

Running from: c:\documents and settings\Judy\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Judy\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_fkdl

-------\Service_ldebjscv

-------\Service_xboxdrv

((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 )))))))))))))))))))))))))))))))

.

2010-09-15 01:29 . 2010-09-15 01:30 -------- d-----w- c:\documents and settings\Judy\Application Data\MSNInstaller

2010-09-08 17:17 . 2010-09-11 03:04 188496 ----a-w- c:\documents and settings\Judy\Local Settings\Application Data\prvlcl.dat

2010-08-25 00:21 . 2010-08-25 00:21 -------- d-----w- c:\windows\system32\Adobe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-23 00:35 . 2009-03-22 07:08 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-09-23 00:26 . 2010-05-19 13:26 -------- d-----w- c:\program files\QuickTime

2010-09-23 00:26 . 2009-10-26 06:34 -------- d-----w- c:\program files\iTunes

2010-09-23 00:26 . 2009-06-19 03:06 -------- d-----w- c:\program files\AIM6