Netbook infectected with fake security suite

bangornetbook · October 7, 2010

Hi,

Last week I accidentally allowed the fake security suite virus onto my HP netbook while using chrome as the browser. I was advised to download the malwarebytes program, which I did using Internet explorer, as the malware has disabled chrome. The malwarebytes found a number of items which it removed. I ran it again ( and a few times since) and it shows clean now. I use CA security as the normal virus protection and that scan run after the MB one is also now clean .

However- chrome will still not work. I compared the settings with out laptop and they were the same so that is not why it will not work. Also in IE, I am redirected from time to time to a website daily consumer news, also the netbook is running slow, freezing up-sometimes seeming like something is using all its memory... I feel something is still hiding inside.

I tried to follow the instructions on what to post here, Please let me know if I post the incorrect info.I named the ark.txt file : gmrrootfile.txt since I had to close the instructions when it ran. I have attched it , along with attach.txt as zipped files. I also pasted two of the virus scan results.

Thank you for your assistance,

Robin P.

Bangor, Maine

DDS.txt:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Chritopher Olsen at 18:15:41.40 on Sun 10/03/2010

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.444 [GMT -4:00]

AV: CA Anti-Virus Plus *On-access scanning enabled* (Updated) {6B98D35F-BB76-41C0-876B-A50645ED099A}

FW: CA Personal Firewall *enabled* {38102F93-1B6E-4922-90E1-A35D8DC6DAA3}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

c:\program files\idt\wdm\stacsv.exe

svchost.exe

C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe

C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\QUALCOMM\QDLService\QDLService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\ccEvtMgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE

C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\CA\CA Internet Security Suite\casc.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\palmOne\Hotsync.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.00816687\Light\CAGlobalLight.exe

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\W32YEVKD\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb

uWindow Title = Windows Internet Explorer provided by Yahoo!

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll

BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: CA Toolbar Helper: {fbf2401b-7447-4727-be5d-c19b2075ca84} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\CallingIDIE.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll

TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll

TB: CA Toolbar: {10134636-e7af-4ac5-a1dc-c7c44bb97d81} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\CallingIDIE.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [iDTSysTrayApp] sttray.exe

mRun: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe

mRun: [EPSON Stylus CX3800 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"

mRun: [EPSON Stylus CX3800 Series (Copy 1)] c:\windows\system32\spool\drivers\w32x86\3\E_FATIACA.EXE /P35 "EPSON Stylus CX3800 Series (Copy 1)" /O6 "USB001" /M "Stylus CX3800"

mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [cctray] "c:\program files\ca\ca internet security suite\casc.exe"

mRun: [capfupgrade] c:\program files\ca\ca internet security suite\ca personal firewall\capfupgrade.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [Tyuguc] rundll32.exe "c:\windows\ovurixuqu.dll",Startup

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palmone\Hotsync.exe

mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

LSP: c:\windows\system32\VetRedir.dll

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: callingid - {086D03BA-57AC-4C8E-A33D-0BAABF742411} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\CallingIDToolbar.dll

Notify: igfxcui - igfxdev.dll

Notify: PFW - UmxWnp.Dll

AppInit_DLLs: UmxSbxExw.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: ShellHook Class: {1869181a-9f50-4fcf-8bff-1b8588ecb85c} - c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\linkadvisor\CIDLinkAdvisor.dll

mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\chrito~1\applic~1\mozilla\firefox\profiles\ccogbt1f.default\

FF - component: c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\linkadvisor\firefox\components\CallingIDLinkAdvisorGecko.dll

FF - component: c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\firefox\components\CIDDomFx3.dll

FF - component: c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\firefox\components\CIDDomFx35.dll

FF - component: c:\program files\ca\ca internet security suite\ca website inspector\1.2.1.24.00816687\toolbar\firefox\components\CIDDomFx36.dll

FF - plugin: c:\program files\google\google updater\2.4.1970.7372\npCIDetect14.dll

FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: XULRunner: {2B525A4A-3090-41E1-B240-18033C735737} - c:\documents and settings\chritopher olsen\local settings\application data\{2B525A4A-3090-41E1-B240-18033C735737}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 KmxAMRT;KmxAMRT;c:\windows\system32\drivers\KmxAMRT.sys [2009-12-23 132088]

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [2009-6-8 108024]

R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2009-3-9 21488]

R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2009-3-9 15856]

R0 SysCow;SysCow;c:\windows\system32\drivers\syscow32x.sys [2008-9-25 103792]

R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2009-12-23 78840]

R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2009-9-2 53240]

R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2009-6-8 115704]

R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2009-3-9 25584]

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\roxio\backontrack\disaster recovery\SaibSVC.exe [2008-12-12 125424]

R2 BOTService;BOTService;c:\program files\roxio\backontrack\instant restore\BOTService.exe [2008-12-25 203248]

R2 CAISafe;CAISafe;c:\program files\ca\ca internet security suite\ca anti-virus plus\isafe.exe [2010-8-5 212992]

R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\ca\ca internet security suite\ccschedulersvc.exe [2010-8-5 206160]

R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2009-8-14 145912]

R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2009-9-30 60920]

R2 QDLService;Qualcomm Gobi Download Service;c:\qualcomm\qdlservice\QDLService.exe [2009-1-14 345336]

R2 UmxAgent;HIPS Event Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-8-4 887288]

R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-7-13 760664]

R2 UmxPol;HIPS Policy Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-7-27 227832]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-3-9 112128]

R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2009-9-30 239608]

R3 QCFilterhp;HP USB Composite Device Filter Driver;c:\windows\system32\drivers\qcfilterhp.sys [2009-3-9 5248]

R3 qcusbnethp;HP USB-NDIS miniport;c:\windows\system32\drivers\qcusbnethp.sys [2009-3-9 115200]

R3 qcusbserhp;HP USB Device for Legacy Serial Communication;c:\windows\system32\drivers\qcusbserhp.sys [2009-3-9 104448]

S0 vxuyv;vxuyv;c:\windows\system32\drivers\kgohwc.sys --> c:\windows\system32\drivers\kgohwc.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-10-1 136176]

S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 --> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?]

S3 KmxAMVet;KmxAMVet;c:\windows\system32\drivers\KmxAMVet.sys [2009-3-27 598656]

S3 NAVENG;NAVENG;\??\c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\naveng.sys --> c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\NAVENG.SYS [?]

S3 NAVEX15;NAVEX15;\??\c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\navex15.sys --> c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20080829.024\NAVEX15.SYS [?]

S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2010-9-30 50704]

S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~2\SMSIVZAM5.SYS [2009-5-25 32408]

=============== Created Last 30 ================

2010-10-03 22:04:57 0 ----a-w- c:\documents and settings\chritopher olsen\defogger_reenable

2010-10-03 17:40:23 664 ----a-w- c:\windows\system32\d3d9caps.dat

Here is the original quick scan with malwarebytes which shows the infections found:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4726

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

10/1/2010 12:08:28 AM

mbam-log-2010-10-01 (00-08-28).txt

Scan type: Quick scan

Objects scanned: 139243

Time elapsed: 24 minute(s), 20 second(s)

Memory Processes Infected: 3

Memory Modules Infected: 2

Registry Keys Infected: 2

Registry Values Infected: 5

Registry Data Items Infected: 2

Folders Infected: 2

Files Infected: 51

Memory Processes Infected:

C:\WINDOWS\temp\_ex-08.exe (Trojan.Downloader) -> Unloaded process successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\dfrgsnapnt.exe (Trojan.FakeAlert) -> Unloaded process successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\eapp32hst.dll (Trojan.FakeAV) -> Delete on reboot.

C:\WINDOWS\dpstmshc.dll (Trojan.Hiloti) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\AnVi (Rogue.AnVi) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Antivirus (Rogue.AntiVirus) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jjunacepexom (Trojan.Hiloti) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sniffer (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dfrgsnapnt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\24d1ca9a-a864-4f7b-86fe-495eb56529d8 (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\7bde84a2-f58f-46ec-9eac-f1f90fead080 (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

C:\Program Files\AnVi (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi (Rogue.AntiVirus) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\eapp32hst.dll (Trojan.FakeAV) -> Delete on reboot.

C:\WINDOWS\dpstmshc.dll (Trojan.Hiloti) -> Delete on reboot.

C:\WINDOWS\temp\_ex-08.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\dfrgsnapnt.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\fiu1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\fiu2.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\fiu5.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\dhdhtrdhdrtr5y (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\eGjsxSzpvd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\rrUBZwrYyx.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\tmpC1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\tmpEF4C.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\topwesitjh (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\68.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\69.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Application Data\81339.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\6B9CJEK1\setup[1].exe (Trojan.Hiloti) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\FGDRY09I\setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\W32YEVKD\setup[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\W32YEVKD\setup[2].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\about.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\activate.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\avt.db (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\avtext.dll (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\avthook.dll (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\buy.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\help.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\scan.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\settings.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\Uninstall.exe (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Program Files\AnVi\update.ico (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\About.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Activate.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Antivirus Support.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Antivirus.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Buy.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Scan.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Settings.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\AnVi\Update.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\AntiVirus.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\nudetube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\pornotube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\spam001.exe (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\spam003.exe (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\troj000.exe (Malware.Trave) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Desktop\youporn.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus.lnk (Rogue.AntiVirus) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\0.36441954040698454.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temp\0.9233175569367515.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

This is the second run of Malwarebytes using fullscan:

alwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4726

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

10/1/2010 4:18:32 PM

mbam-log-2010-10-01 (16-18-32).txt

Scan type: Full scan (C:\|)

Objects scanned: 201063

Time elapsed: 1 hour(s), 43 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Rollback Data\Restore\Current\24843\7\Target\PROGRAM FILES\AnVi\avthook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Rollback Data\Restore\Current\24843\7\Target\PROGRAM FILES\AnVi\avtext.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Attach_10_3_10.zip

gmrrootfile.zip

inzanity · October 7, 2010

Hello and

I will be helping you remove malware on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

Please read through these instructions to familiarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs

--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.

ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.

Click on Yes, to continue scanning for malware.

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with the combofix log.

bangornetbook · October 10, 2010

Hello and
I will be helping you remove malware on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.
_________________________________________________
Please read through these instructions to familiarize yourself with what to expect when this tool runs
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty in properly disabling your protective programs, refer to this link - How to Disable your Security Programs
--------------------------------------------------------------------
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
The Recovery Console was successfully installed.
Click on Yes, to continue scanning for malware.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Please post back with the combofix log.

bangornetbook · October 10, 2010

Hi,

I have tried to use the combofix, but it seems to freeze up, or not work

I turned off the CA virus scans and the firewall as instructed. The recovery module did download as you indicated . The combo fix came up with a blue screen when I clicked on it and said ( paraphrased here) it was "scanning, that it should take 10 minutes, maybe double if badly infected." I left the netbook alone and checked it later, still had same message- for about 2 hours it was the same, no change at all.

I had to shut it off manually since I had to go to bed

I tried it again tonight- double clicked on the icon, it asked after a few minutes that there was an updated version would I like that so I clicked yes. It verified the recovery module and set a recovery point, then it said it was scanning , it sat on that same blue screen that said "10 minutes maybe double" for over 4 hours....basically frozen that way. It never did the things you said it would like blank screen or disconnect from the internet.

So is this normal- how many hours should it take? This netbook only has an 80 gig hard drive so I would think it would not take an extra long time.

Not sure if it is any different since it is a netbook? It runs regular programs, but it does not a have its own optical drive. It is very small.

Thanks for your help

Robin

inzanity · October 12, 2010

Hi,

Let's run Combofix in Safe Mode

To do this,

Restart your computer.
Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
When a list of menu appears, scroll to Safe Mode using the arrow keys then press Enter
Log in to your usual account.

Be sure to disable CA by doing the following:

Anti Virus

Right click on CA Antivirus icon near the clock (a shield).
Click on CA Anti-Virus > Snooze Anti-Virus Protection.
When prompted, enter in 50 and click on Snooze.

Firewall

Please navigate to the system tray on the bottom right hand corner.

Right click CA Firewall icon -> hover (mouse-over) over CA Personal Firewall menue option. A sub-menu will popup.
Please chose "Disable CA Personal Firewall"
Unfortunately the system tray icon does not change, so if you want to double-check whether or not you successfully disabled the Firewall, do the above steps again and look for "Enable CA Personal Firewall." If this is the case, then you succesfully disabled the CA Personal Firewall Guard.

--Next--

Run Combofix in Safe Mode by following the steps outlined in post #2. If it asks for an update, please do so.

bangornetbook · October 17, 2010

Hi,

I have tried running combo fix in safe mode- same result 3 times. it gets to the autoscan and never moves ahead, it sits there for hours... I made sure the CA security was off as well as fire wall....

I have attached a print screen of what combofix looks like on my computer.

Any sugeestions?

Thanks!!!

print_screen.doc

inzanity · October 18, 2010

Hi,

Do you have your CA serial? We may be needing it as we may need to uninstall CA as it is interfering with our tools.

Please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*wmiacpi*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

--Next--

Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window similar to this should open on your desktop:
If you are prompted with options, enter N at the prompt and press Enter
Press Enter again
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your deskop. Please post the contents of that file.

To post in your next reply:

1. Regarding my question above.

2. Systemlook log.

3. MBRCheck log.

bangornetbook · October 18, 2010

I tried running combofix one last time this evening before I saw your last reply- and it worked this time!!!!!!!!!!

It was by the way the CA blocking it as you thought in the last reply. After the virus invasion on the netbook we had increased the security setting on all 3 computers to hopefully prevent future intrusions....

I noticed by chance when looking at the CA settings tonight - many things were blocked or permission required - I went through the list and changed anything that said "combo fix" to allow and gave it a shot .

Well after a few minutes it said rootkit activity found, rebooted and then continued on through 50 stages finally producing the log (zip file attached)

Did this remove everything or do I need to follow some more steps?

Thanks so much for your help :-)

Robin

log_combofix.zip

inzanity · October 18, 2010

Hi,

We still have some more work to do but the main infection has been taken care of. :lol:

Post the contents of the logs. No need to attach it on your next post.

Please do the following:

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <-- very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

--Next--

Outdated Java

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

Java 6 Update 7

This is outdated, and a security risk by having it installed still. Unfortunately, Java does not uninstall these older versions when you update, nor tell you that you should. Java 6 Update 17 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. Let me know if it does not.

Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

Once the install is complete...

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications and Applets
  Trace and Log Files
[*]Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
[*]Click OK to leave the Temporary Files Window
[*]Click OK to leave the Java Control Panel.

--Next--

Please be patient as this scan can take a while to complete:

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

--Next--

Run a fresh DDS scan for me please then post the logs and an update on how your computer is doing. Thank you.

To post in your next reply:

1. Malwarebytes' log.

2. Kaspersky log.

3. DDS logs.

4. How is your computer?

bangornetbook · October 19, 2010

Hi ,

I have completed all the steps you outlined in the last message, including the Java removal and update.

The netbook has not re-directed to the "sales" websites since the combofix was used. Also it does not seem to be going to 100% usage ( in processes) all the time. So it seems better. I have not tried Google Chrome again since I would need to re-install it.

I'm having trouble pasting here so I fill paste the scans etc in the next post

Thanks!

bangornetbook · October 19, 2010

Ok, not sure why , but I can't seem to paste anything here!! Can I put the reports on a word document and attach it??

inzanity · October 20, 2010

Hi,

Are there any errors when you try to copy then paste the logs in your reply? What happens when you do?

Try this:

Click on ADDREPLY button then copy the entire contents of the logs and post it here. If that won't do then please put in in Notepad then attach it.

Thank you.

bangornetbook · October 20, 2010

Okay, the paste works now, before the right mouse button would not offer the copy/paste menu...only on here.I rebooted and now it works...maybe something to do with DDS being open??? oh well...

Also by the way today a Microsoft update kept wanted to download...after I did the DDS logs it did automatically download...

So here are the logs and thank you again for all your help!!

1.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4875

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

10/18/2010 7:30:49 PM

mbam-log-2010-10-18 (19-30-49).txt

Scan type: Quick scan

Objects scanned: 149438

Time elapsed: 19 minute(s), 44 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

2.Kaspersky Log:

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Tuesday, October 19, 2010

Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Monday, October 18, 2010 15:11:25

Records in database: 4183699

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

Scan statistics:

Objects scanned: 71643

Threats found: 3

Infected objects found: 4

Suspicious objects found: 0

Scan duration: 04:15:23

File name / Threat / Threats count

C:\Program Files\AIM6\addressBook.exe Infected: Trojan.Win32.Vilsel.ajgl 1

C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\wmiacpi.sys.vir Infected: Virus.Win32.TDSS.b 1

C:\System Rollback Data\Restore\Archive\00000063\00000064\0\Target\WINDOWS\ovurixuqu.dll Infected: Trojan-Downloader.Win32.Mufanom.airf 1

C:\System Volume Information\_restore{E0F24961-02F2-45C4-9A86-797FFEC8BF9E}\RP2\A0010200.sys Infected: Virus.Win32.TDSS.b 1

Selected area has been scanned.

3. DDS logs:

DS (Ver_10-10-10.03) - NTFSx86

Run by Chritopher Olsen at 18:04:46.46 on Tue 10/19/2010

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.409 [GMT -4:00]

AV: CA Anti-Virus Plus *On-access scanning enabled* (Updated) {6B98D35F-BB76-41C0-876B-A50645ED099A}

FW: CA Personal Firewall *enabled* {38102F93-1B6E-4922-90E1-A35D8DC6DAA3}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

c:\program files\idt\wdm\stacsv.exe

svchost.exe

C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe

C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus Plus\isafe.exe

C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\QUALCOMM\QDLService\QDLService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\ccEvtMgr.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE

C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\CA\CA Internet Security Suite\casc.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\palmOne\Hotsync.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\SoftwareDistribution\Download\Install\NDP20SP2-KB2418241-x86.exe

c:\40230ba80225882aff\HotFixInstaller.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Program Files\CA\CA Internet Security Suite\CA Website Inspector\1.2.1.24.00816687\Light\CAGlobalLight.exe

c:\WINDOWS\system32\MsiExec.exe

C:\Documents and Settings\Chritopher Olsen\Local Settings\Temporary Internet Files\Content.IE5\UMHK091T\dds[1].scr