Virus/Malware Found, Used MBAM, Then Weird Behavior

[AJS1970]

I'll start with what I originally posted in the wrong forum, and then add in the steps I was directed to take:

Several days ago, I noticed that my version of McAfee Antivirus had stopped updating automatically and suspected a virus or Malware. It turned out that I did have several viruses/malware on it including Red Cross and possibly Antivirus 2010. I ran (one after another, not at the same time) AdAware and Spybot (which I already had), and then finally downloaded and ran MBAM due to its high rating from CNET and great reputation. All found some malware/viruses, and MBAM found the most. I instructed each program to remove all viruses/malware.

After running MBAM and having the viruses/malware removed, I rebooted my PC. Unfortunately, when it came back up, there were no Start Menu or Desktop Icons. I was able to use Task Manager to bring up a DOS Prompt and navigated around my directory tree, determining that all of my Icons/Start Menu Links/Apps *were* still there, and was even able to bring up Firefox, Email, PDF files, etc by running them from a cmd prompt (DOS Shell).

After some more consultation with friends and colleagues, I ran System Restore from about 12 days before (predating any known virus issues) from the Cmd Line. While saying that it didn't work, it *did* bring my Desktop Icons and Start Menu back. This seemed like a solution, but strange tabs were popping up in my Firefox browser (this happened earlier in the week as well), and the PC's performance degraded quickly and had to be rebooted the next evening. Upon doing so, first only a black screen with mouse cursor came up, and upon subsequent reboots I was back to the "No Start Menu, No Desktop Icons" scenario. I used System Restore for an even earlier date - once again, it said that this didn't work, but my Start Menu and Desktop Icons came back. However, now my audio device cannot be found. The PC is also running much more slowly than usual.

I ran a full scan of McAfee Antivirus and MBAM overnight (one after another, not at the same time) and they both came back clean. I then posted here on a different forum and was directed to run some more programs. Since I already have Antivirus Software that I ran (McAfee), I didn't run Avira AVR.

I did run DeFogger and disabled the CD Rom Emulation Software as directed, and then rebooted.

I ran DDR. The first time it didn't produce anything, but after rebooting again it did. Here is the DDR.txt log:

[replaced my actual user name with "Full Name"]

DDS (Ver_10-10-10.03) - NTFSx86

Run by Full Name at 14:53:34.40 on Sun 10/17/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.257 [GMT -4:00]

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\dcmsvc\dcmsvc.exe

C:\Program Files\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\EarthLink TotalAccess\TaskPanl.exe

C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exe

C:\Documents and Settings\Full Name\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe

C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Hewlett-Packard\HP OfficeJet T Series\bin\HPOVDX05.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\hpoipm07.exe

C:\WINDOWS\system32\wuauclt.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\Full Name\My Documents\Downloads\dds(4).scr

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://start.earthlink.net/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

BHO: PnIEBrowserHelperObj Class: {4b5f2e08-6f39-479a-b547-b2026e4c7edf} - c:\program files\earthlink totalaccess\PnEL.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common

files\mcafee\systemcore\ScriptSn.20100915033341.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google

toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program

files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - No File

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program

files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: EarthLink Toolbar: {d7f30b62-8269-41af-9539-b2697fa7d77e} - c:\program files\earthlink totalaccess\PnEL.dll

TB: &Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\compan~1\installs\cpn\ycomp5_5_7_0.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes0521.dll

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [spySweeper]

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [Google Update] "c:\documents and settings\Full Name\local settings\application

data\google\update\GoogleUpdate.exe" /c

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [E6TaskPanel] "c:\program files\earthlink totalaccess\TaskPanl.exe" -winstart

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [dcmsvc] c:\program files\dcmsvc\dcmsvc.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [4teewauwumkk] c:\windows\temp\0.017339685619220502.exe

dRun: [AntiVirus 2010] "c:\documents and settings\localservice\application data\antivirus 2010\AntiVirus Studio 2010.exe"

/STARTUP

dRun: [securityCenter] c:\documents and settings\localservice\application data\antivirus 2010\securitycenter.exe

StartupFolder: c:\docume~1\andrew~1\startm~1\programs\startup\warner~1.lnk - c:\program files\warner bros. digital copy

manager\Warner Bros. Digital Copy Manager.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoffi~1.lnk - c:\program files\hewlett-packard\hp officejet t

series\bin\HPOstr05.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare

software\bin\EasyShare.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodaks~1.lnk - c:\program files\kodak\kodak software

updater\7288971\program\Kodak Software Updater.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft

office\office10\OSA.EXE

uPolicies-explorer: NoThemesTab = 0 (0x0)

uPolicies-system: NoColorChoice = 0 (0x0)

uPolicies-system: NoSizeChoice = 0 (0x0)

uPolicies-system: NoVisualStyleChoice = 0 (0x0)

uPolicies-system: NoDispSettingsPage = 0 (0x0)

IE: Google Sidewiki... - c:\program files\google\google

toolbar\component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\program

files\yahoo!\messenger\yhexbmes0521.dll

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

Trusted Zone: dell.com\accessories.us

Trusted Zone: internet

Trusted Zone: jpmorgan.com\mcpuk1

Trusted Zone: jpmorganchase.com\trainingcentralinternet

Trusted Zone: jpmorganchase.com\webvpn

Trusted Zone: mcafee.com

Trusted Zone: musicmatch.com

Trusted Zone: skillport.com

Trusted Zone: skillwsa.com

DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/viewers/ipixx.cab

DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab

DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab

DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} - hxxps://mcpuk1.jpmorgan.com/llclient/webvpn-amer/winxp/AXXPEE.dll

DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} - hxxp://www.linkedin.com/cab/LinkedInContactFinderControl.cab

DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} - hxxp://www.amiuptodate.com/vsc/bin/2,0,0,0/McUpdatePortal.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {B49C4597-8721-4789-9250-315DFBD9F525} - hxxp://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://webvpn.jpmorganchase.com/dana-cached/setup/JuniperSetupSP1.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://webvpn-bw03.jpmorganchase.com/dana-cached/sc/JuniperSetupClient.cab

DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - hxxp://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

LSA: Notification Packages = scecli c:\windows\system32\nubavofi.dll

Hosts: 207.69.131.10 http://webconnect.jpmorganchase.com # jpm webconnect server

Hosts: 207.69.131.9 https://mcpuk1.jpmorgan.com # jpm secure webconnect server

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\andrew~1\applic~1\mozilla\firefox\profiles\s2qsc6ca.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://start.earthlink.net/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=

FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll

FF - plugin: c:\documents and settings\Full Name\local settings\application

data\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\mcafee\supportability\mvt\NPMVTPlugin.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla

firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-10-14 64288]

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-9-5 386712]

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-9-5 84072]

R1 NEOFLTR_650_15255;Juniper Networks TDI Filter Driver (NEOFLTR_650_15255);c:\windows\system32\drivers\NEOFLTR_650_15255.SYS

[2010-6-8 85360]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 1357464]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-7-4 93320]

R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc

[2010-9-5 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-5

271480]

R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-9-5 271480]

R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-9-5 171168]

R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-9-5 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-9-5

141792]

R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-9-5 55840]

R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15008]

R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-9-5 152992]

R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-9-5 52104]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-9-5 312904]

R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-9-5 88544]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-11 135664]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-9-5 88544]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-9-5 84264]

=============== Created Last 30 ================

2010-10-15 04:31:59 6729 ----a-w- c:\windows\system32\dllcache\disrvci.dll

2010-10-15 04:30:58 175104 ----a-w- c:\windows\system32\dllcache\csamsp.dll

2010-10-15 04:29:35 13824 ----a-w- c:\windows\system32\dllcache\bulltlp3.sys

2010-10-15 04:28:59 38912 ----a-w- c:\windows\system32\dllcache\avc.sys

2010-10-15 04:24:41 46112 ----a-w- c:\windows\system32\dllcache\adptsf50.sys

2010-10-15 01:59:35 232 ----a-w- c:\docume~1\andrew~1\applic~1\jsfhjjsd.bat

2010-10-15 01:49:34 -------- d-----w- c:\docume~1\andrew~1\applic~1\Malwarebytes

2010-10-15 01:49:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-15 01:49:23 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-10-15 01:49:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-15 01:49:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-15 01:28:23 15880 ----a-w- c:\windows\system32\lsdelete.exe

2010-10-15 01:13:48 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2010-10-15 01:13:40 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-10-15 01:10:50 -------- d-----w- c:\docume~1\andrew~1\locals~1\applic~1\Sunbelt Software

2010-10-15 01:06:49 -------- dc-h--w- c:\docume~1\alluse~1\applic~1\{ECC164E0-3133-4C70-A831-F08DB2940F70}

2010-10-14 01:57:26 -------- d-----w- c:\docume~1\alluse~1\applic~1\STOPzilla!

2010-09-22 22:10:52 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2010-09-22 22:10:52 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2010-09-19 01:07:32 398744 ----a-r- c:\windows\system32\cpnprt2.cid

2010-09-19 01:07:23 -------- d-----w- c:\windows\Cache

2010-09-19 01:07:17 -------- d-----w- c:\program files\Coupons

==================== Find3M ====================

2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-07-22 05:57:20 5120 ----a-w- c:\windows\system32\xpsp4res.dll

============= FINISH: 14:58:41.34 ===============

I will upload the other logs in my next post so that in cae my browser/system crashes, this at least gets posted.

One more thing I neglected to mention: since the "No Desktop Icons, No Start Menu" issue began, the following msg has briefly appeared during the reboot process:

"Loading PBR for Descriptor 2: Done"

I did some googling and there are other forum references to this being a partition access issue and running chkdsk being the solution to resolve this. Does that sound plausible?

The PC is a Dell Desktop 8400 running Windows XP, Service Pack 2

Thanks, AJS

[AJS1970]

Sorry for breaking my first post into two. Attached is the "attach.txt" log from DDR

I also ran GMER twice. This first time it hung and after about 3 hours I killed it (screen had gone black). The second time I ran it, after about 2 minutes I got the "Blue Screen" with this msg:

"A problem has been detected and windows has been shut down to prevent damage to your computer"

File: pxtdipow.sys

PAGE_FAULT_IN_NONPAGED_AREA

Since it crashed there was no log produced (that I'm aware of). Upon rebooting now I'm seeing my Desktop Icons and Start Menu as per normal, but AdAware is catching what it thinks are attempts to access malware sites by my PC, so I'm concerned something is still amiss.

Any advice would be greatly appreciated. If I missed any steps, please let me know - it's been a bit tricky trying to perform this amidst all of the unexpected reboots etc.

Thanks.

Attach.txt

[sjpritch25]

Scan with RKUnHooker

• Please download Rootkit Unhooker Save it to your desktop.
  
• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth. Uncheck the rest, then Click Ok.
  
• Wait till the scanner has finished then click File, Save Report.
  
• Save the report to your Desktop. Click Close.
  

In your next reply, copy and paste the contents of the log.

Note*** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!!

It is recommended to remove parasite, okay?"

============================================

Please download mbr.exe to your root drive (usually C;).

[*]Go to Start -? Run and type the following mbr.exe

[AJS1970]

Thanks for your speedy and detailed response! Here is the log from Rootkit Unhooker:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #2

==============================================

>Drivers

==============================================

0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2260992 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2260992 bytes

0x804D7000 RAW 2260992 bytes

0x804D7000 WMIxWDM 2260992 bytes

0xBF084000 C:\WINDOWS\System32\ati3duag.dll 2240512 bytes (ATI Technologies Inc. , ati3duag.dll)

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xF5CDB000 C:\WINDOWS\system32\DRIVERS\IntelC51.sys 1208320 bytes (Intel Corporation, Modem DSP Driver)

0xF5E8B000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 897024 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)

0xF5C46000 C:\WINDOWS\system32\DRIVERS\IntelC52.sys 610304 bytes (Intel Corporation, Modem CP Driver)

0xF73B5000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xBF2A7000 C:\WINDOWS\System32\ativvaxx.dll 479232 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)

0xB19AC000 C:\WINDOWS\System32\Drivers\dump_iaStor.sys 471040 bytes

0xF755A000 iaStor.sys 471040 bytes (Intel Corporation, Intel Application Accelerator driver)

0xB6BE7000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xF5B84000 C:\WINDOWS\system32\drivers\senfilt.sys 385024 bytes (Sensaura, Sensaura WDM 3D Audio Driver)

0xF5A3F000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xF746E000 mfehidk.sys 380928 bytes (McAfee, Inc., McAfee Link Driver)

0xB6CF7000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xB04A4000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)

0xF5A9D000 C:\WINDOWS\system32\drivers\mfefirek.sys 307200 bytes (McAfee, Inc., McAfee Core Firewall Engine Driver)

0xAFC6F000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xF5C06000 C:\WINDOWS\system32\drivers\smwdm.sys 262144 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )

0xBF04A000 C:\WINDOWS\System32\ati2cqag.dll 237568 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module)

0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 229376 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver)

0xB6D83000 C:\WINDOWS\system32\DRIVERS\Dot4.sys 208896 bytes (Microsoft Corporation, One Cool Transport)

0xF7615000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xF5E49000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 188416 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.)

0xB0703000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xF7388000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF74FD000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver)

0xAF179000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)

0xB6C57000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xB6CA4000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF5B10000 C:\WINDOWS\system32\drivers\mfeavfk.sys 147456 bytes (McAfee, Inc., Anti-Virus File System Filter Driver)

0xF5BE2000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xF5E25000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xF5E02000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xB6C82000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x806FF000 ACPI_HAL 134400 bytes

0x806FF000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xF74DD000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xF75E5000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xF736E000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xF7529000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport)

0xB097D000 C:\WINDOWS\system32\dla\tfsnudf.sys 102400 bytes (Sonic Solutions, Drive Letter Access Component)

0xB0964000 C:\WINDOWS\system32\dla\tfsnudfa.sys 102400 bytes (Sonic Solutions, Drive Letter Access Component)

0xF7542000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xB6CCC000 C:\WINDOWS\system32\Drivers\NEOFLTR_650_15255.SYS 98304 bytes (Juniper Networks, NetBIOS Redirector)

0xF75CD000 C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)

0xF7442000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xF5B45000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xAFB41000 C:\WINDOWS\system32\drivers\mfeapfk.sys 90112 bytes (McAfee, Inc., Access Protection Filter Driver)

0xB0996000 C:\WINDOWS\system32\dla\tfsnifs.sys 90112 bytes (Sonic Solutions, Drive Letter Access Component)

0xF7459000 drvmcdb.sys 86016 bytes (Sonic Solutions, Device Driver)

0xB08AF000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xF5B5C000 C:\WINDOWS\system32\DRIVERS\mfendisk.sys 81920 bytes (McAfee, Inc., McAfee NDIS Intermediate Driver)

0xF5B70000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xF5E77000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xB6D50000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xB6CE4000 C:\WINDOWS\system32\drivers\mfetdi2k.sys 77824 bytes (McAfee, Inc., Anti-Virus Mini-Firewall Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xF74CB000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xF7604000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xF5B34000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xB2C4D000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xF77B4000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF7286000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xF72A6000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xF72B6000 C:\WINDOWS\system32\DRIVERS\IntelC53.sys 61440 bytes (Intel Corporation, Modem AFE Driver)

0xF7734000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)

0xF77C4000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xF682F000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF5F86000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF76C4000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport)

0xF7694000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport)

0xF7724000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xF7296000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xF77E4000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF7684000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xAFFE8000 C:\WINDOWS\system32\drivers\cfwids.sys 49152 bytes (McAfee, Inc., McAfee Personal Firewall IDS Plugin)

0xF7704000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)

0xF76F4000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)

0xF7804000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF7764000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)

0xF7794000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter)

0xF7774000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter)

0xF7784000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)

0xB9448000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xF77D4000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xAFB87000 C:\WINDOWS\system32\drivers\mfebopk.sys 45056 bytes (McAfee, Inc., Buffer Overflow Protection Driver)

0xF7674000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF77F4000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF7754000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)

0xEB054000 C:\WINDOWS\system32\drivers\drvnddm.sys 40960 bytes (Sonic Solutions, Device Driver Manager)

0xF7664000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF5FA6000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF76E4000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)

0xF76B4000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters)

0xF7744000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)

0xF7824000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF7714000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF72C6000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)

0xF7814000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xEBB80000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xAF214000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xF76A4000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters)

0xEB064000 C:\WINDOWS\system32\dla\tfsncofs.sys 36864 bytes (Sonic Solutions, Drive Letter Access Component)

0xF76D4000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver)

0xEBBA0000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xF79C4000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)

0xB9508000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xF7914000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver)

0xF7924000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver)

0xF79B4000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0xF78FC000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver)

0xF794C000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver)

0xF78E4000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xF7944000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver)

0xF791C000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver)

0xB1E16000 C:\WINDOWS\system32\dla\tfsnboio.sys 28672 bytes (Sonic Solutions, Drive Letter Access Component)

0xB2F29000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)

0xF792C000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver)

0xF7934000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver)

0xF79DC000 C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)

0xF79CC000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xF79BC000 C:\WINDOWS\system32\DRIVERS\mohfilt.sys 24576 bytes (Intel Corporation, Filter Driver to Support Modem-on-Hold)

0xF79D4000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xB9520000 C:\WINDOWS\system32\drivers\ssrtln.sys 24576 bytes (Sonic Solutions, Shared Driver Component)

0xF79AC000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0xB9518000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xF79FC000 C:\WINDOWS\system32\DRIVERS\wanatw4.sys 24576 bytes (America Online, Inc., Wan Miniport (ATW))

0xF793C000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport)

0xF790C000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver)

0xF7904000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32)

0xB9510000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xF61C9000 C:\WINDOWS\system32\DRIVERS\omci.sys 20480 bytes (Dell Computer Corporation, OMCI Device Driver)

0xF78EC000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xF79EC000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xF7954000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xF79F4000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xF78F4000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport)

0xF79E4000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xB2AC0000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xF7A80000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport)

0xF7A90000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver)

0xF7A98000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver)

0xF7A7C000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver)

0xF7A88000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver)

0xED96F000 C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys 16384 bytes (Microsoft Corporation, Dot4 Printer Driver)

0xF7A94000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport)

0xF5AE8000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)

0xF7B50000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xB52F4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF7259000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xF7A84000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver)

0xED983000 C:\WINDOWS\system32\dla\tfsnopio.sys 16384 bytes (Sonic Solutions, Drive Letter Access Component)

0xF7A8C000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller)

0xF7A78000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xB1A33000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xEBC24000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)

0x86DF1000 C:\WINDOWS\system32\KDCOM.DLL 12288 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xF71C2000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xEBC1C000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xF7B66000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)

0xF7C0E000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xF7B70000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport)

0xF7B68000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)

0xB44CA000 C:\WINDOWS\system32\DRIVERS\dsunidrv.sys 8192 bytes (Gteko Ltd., GUniDriver)

0xF7C0C000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xF7B6E000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)

0xF7C10000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xF7B72000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver)

0xF7C12000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xF7BB0000 C:\WINDOWS\system32\drivers\sscdbhk5.sys 8192 bytes (Sonic Solutions, Shared Driver Component)

0xF7BB4000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xF7C1C000 C:\WINDOWS\system32\dla\tfsnpool.sys 8192 bytes (Sonic Solutions, Drive Letter Access Component)

0xF7B6A000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller)

0xF7BBC000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xF7B6C000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0xF7B64000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xF7D8F000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xF7D52000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xB782A000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xF7C2C000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0xF7CFA000 C:\WINDOWS\system32\dla\tfsndrct.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)

0xF7CF9000 C:\WINDOWS\system32\dla\tfsndres.sys 4096 bytes (Sonic Solutions, Drive Letter Access Component)

!!!!!!!!!!!Hidden driver: 0x86E4D3B2 ?_empty_? 3150 bytes

==============================================

>Stealth

==============================================

0xF755A000 WARNING: suspicious driver modification [iaStor.sys::0x86E4D3B2]

This is what the log from mbr returned:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

I do have the original XP disk from Dell, although I am a bit concerned that it says it is only for reinstallation. Perhaps that is an overstatement and it can be used for restoring DLLs too.

Thanks

[sjpritch25]

Download Combofix from this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.

• When finished, it will produce a report for you.
  
• Please post the "C:\ComboFix.txt" .
  

Note:

Do not mouseclick combofix's window while it's running. That may cause it to stall

[AJS1970]

Thanks for your latest advice. I was able to download ComboFix, but when I tried to download ResetTeaTimer.exe (which I need since I have Spybot/TeaTimer installed) from http://www.techsupportforum.com/sectools/ResetTeaTimer.exe , the http://www.techsupportforum.com/sectools link redirects back to http://www.techsupportforum.com and I cannot access this link.

I did register on http://www.techsupportforum.com and did the search again on that site (and tried the link), nothing found. I checked otherwise on the site and did not turn up a software repository. Did some basic googling but did not find another site that I could trust which had this app.

Would you be able to point me to another site that has it? I am assuming it is required and I don't want to start turning off AV and AM apps until I have all the software so my window of "nonprotection" before I start running ComboFix is as short as possible.

Related question - it looks like I did not properly set up to fwd to my email for these posts (although I thought that I did) - is there a way that I can set that up now?

[AJS1970]

Fixed the email notification when an updated post occurs (I should have searched before asking, my bad)

[sjpritch25]

here just do this for teatimer

Spybot Search & Destroy Tea Timer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.

Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
  
• In the Mode menu click "Advanced mode" if not already selected.
  
• Choose "Yes" at the Warning prompt.
  
• Expand the "Tools" menu.
  
• Click "Resident".
  
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  
• In the File menu click "Exit" to exit Spybot Search & Destroy.
  

[AJS1970]

The McAfee Security UI looked different than expected but I turned off all of the indicated areas along with the steps required to disable AdAware and Spybot. Going to start ComboFix shortly ...

[AJS1970]

Ok - I ran ComboFix after disabling all the AV/AM software. It successfully downloaded/installed the Recovery Console and ran for several minutes. Then a box popped up saying it had detected a Rootkit and needed to reboot (this was after the "Scan times may easily double" message but the "Resetting Clocks" msg had not appeared at this point). It rebooted ... and didn't restart ComboFix again. That was about 20 minutes ago, and also my Start Menu and Desktop Icons have disappeared once again (as has happened sporadically over the last few days). I did *not* use System Restore to bring them back up from a previous day since another admin on this forum had strongly advised against that.

Using the DOS Shell, I navigated to the Start Menu directory and brought up FF and my Email client. Looks like they are working fine. I had configured McAfee to come back up and reenable all of its defense settings upon reboot, and a check showed that McAfee Security Center, AdAware, and Spybot are all back and running (I accessed them through the DOS Shell); I manually turned TeaTimer back on and saw the process is running in the Task Manager.

So ... I've got a running PC, but I suspect things are still amiss. Should I re-disable the AV/AM software once again and rerun ComboFix? Do I need to configure McAfee Security Center to stay disabled for viruses etc even after the reboot? Are reboots and reruns in an iterative fashion expected behavior for Rootkit infections, removing one (or more) Rootkits with each run until the last one is gone?

Again, many thanks for your advice and patience.

[sjpritch25]

Yes please run ComboFix again

[AJS1970]

I ran ComboFix, and the log is below. My Desktop Icons and Start Menu returned when it finished, which is a good sign. ComboFix rebooted twice during the process and my AV software came back up automatically after the first reboot (I had it configured to come back upon reboot, because I didn't anticipate ComboFix rebooting and then starting to run again automatically), but my AM software appears to have stayed down because I had to reset/rerun it afterwards. McAfee AV did quarantine one file during the post-reboot run before I could stop it.

=========== START OF FILE ================

ComboFix 10-10-18.01 - Full Name 10/19/2010 21:37:38.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.574 [GMT -4:00]

Running from: C:\ComboFix.exe

Command switches used :: ComboFix.exe

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Acr1BE.tmp

C:\Acr1C0.tmp

C:\Acr1C6.tmp

C:\Acr1C8.tmp

C:\Acr1CA.tmp

C:\Acr1CC.tmp

C:\Acr1CE.tmp

C:\Acr1D0.tmp

C:\Acr21C.tmp

C:\Acr25F.tmp

C:\Acr261.tmp

C:\Acr265.tmp

C:\Acr267.tmp

C:\Acr26B.tmp

C:\Acr26D.tmp

C:\Acr271.tmp

C:\Acr273.tmp

C:\Acr277.tmp

C:\Acr279.tmp

C:\Acr27D.tmp

C:\Acr27F.tmp

C:\Acr283.tmp

C:\Acr285.tmp

C:\Acr289.tmp

C:\Acr28B.tmp

C:\Acr28D.tmp

C:\Acr28F.tmp

C:\Acr291.tmp

C:\Acr295.tmp

C:\Acr297.tmp

C:\Acr29B.tmp

C:\Acr29D.tmp

C:\Acr2A1.tmp

C:\Acr2A3.tmp

C:\Acr2A7.tmp

C:\Acr2A9.tmp

C:\Acr2AD.tmp

C:\Acr2AF.tmp

C:\Acr2B3.tmp

C:\Acr2B5.tmp

C:\Acr2B9.tmp

C:\Acr2BB.tmp

C:\Acr2BD.tmp

C:\Acr2BF.tmp

C:\Acr2C1.tmp

C:\Acr2C3.tmp

C:\Acr2C5.tmp

C:\Acr2C6.tmp

C:\Acr2C7.tmp

C:\Acr2C9.tmp

C:\Acr2CB.tmp

C:\Acr2CD.tmp

C:\Acr2CF.tmp

C:\Acr2D0.tmp

C:\Acr2D1.tmp

C:\Acr2D2.tmp

C:\Acr2D3.tmp

C:\Acr2D4.tmp

C:\Acr2D5.tmp

C:\Acr2D6.tmp

C:\Acr2D7.tmp

C:\Acr2D8.tmp

C:\Acr2D9.tmp

C:\Acr2DA.tmp

C:\Acr2DB.tmp

C:\Acr2DC.tmp

C:\Acr2DD.tmp

C:\Acr2DE.tmp

C:\Acr2DF.tmp

C:\Acr2E0.tmp

C:\Acr2E1.tmp

C:\Acr2E2.tmp

C:\Acr2E3.tmp

C:\Acr2E4.tmp

C:\Acr2E5.tmp

C:\Acr2E6.tmp

C:\Acr2E7.tmp

C:\Acr2E8.tmp

C:\Acr2E9.tmp

C:\Acr2EB.tmp

C:\Acr2ED.tmp

C:\Acr2EF.tmp

C:\Acr2F1.tmp

C:\Acr2F2.tmp

C:\Acr2F3.tmp

C:\Acr2F4.tmp

C:\Acr2F5.tmp

C:\Acr2F6.tmp

C:\Acr2F7.tmp

C:\Acr2F8.tmp

C:\Acr2F9.tmp

C:\Acr2FA.tmp

C:\Acr2FB.tmp

C:\Acr2FC.tmp

C:\Acr2FD.tmp

C:\Acr2FE.tmp

C:\Acr2FF.tmp

C:\Acr300.tmp

C:\Acr301.tmp

C:\Acr302.tmp

C:\Acr303.tmp

C:\Acr304.tmp

C:\Acr305.tmp

C:\Acr306.tmp

C:\Acr308.tmp

C:\Acr309.tmp

C:\Acr30A.tmp

C:\Acr30B.tmp

C:\Acr30C.tmp

C:\Acr30E.tmp

C:\Acr30F.tmp

C:\Acr310.tmp

C:\Acr311.tmp

C:\Acr312.tmp

C:\Acr314.tmp

C:\Acr315.tmp

C:\Acr316.tmp

C:\Acr317.tmp

C:\Acr318.tmp

C:\Acr31A.tmp

C:\Acr31B.tmp

C:\Acr31C.tmp

C:\Acr31D.tmp

C:\Acr321.tmp

C:\Acr323.tmp

C:\Acr327.tmp

C:\Acr329.tmp

C:\Acr32D.tmp

C:\Acr32F.tmp

C:\Acr333.tmp

C:\Acr335.tmp

C:\Acr339.tmp

C:\Acr33B.tmp

C:\Acr33F.tmp

C:\Acr341.tmp

C:\Acr345.tmp

C:\Acr347.tmp

C:\Acr3D8.tmp

C:\Acr40A.tmp

C:\Acr40C.tmp

C:\Acr446.tmp

C:\Acr448.tmp

C:\Acr44A.tmp

C:\Acr44C.tmp

C:\Acr44E.tmp

C:\Acr450.tmp

C:\Acr452.tmp

C:\Acr598.tmp

C:\Acr5F72.tmp

C:\Acr5F74.tmp

c:\documents and settings\All Users\Application Data\98877496.ini

c:\documents and settings\All Users\invokesi.exe

c:\documents and settings\Full Name\GoToAssistDownloadHelper.exe

c:\windows\Tasks\At1.job

c:\windows\Tasks\At10.job

c:\windows\Tasks\At11.job

c:\windows\Tasks\At12.job

c:\windows\Tasks\At13.job

c:\windows\Tasks\At14.job

c:\windows\Tasks\At15.job

c:\windows\Tasks\At16.job

c:\windows\Tasks\At17.job

c:\windows\Tasks\At18.job

c:\windows\Tasks\At19.job

c:\windows\Tasks\At2.job

c:\windows\Tasks\At20.job

c:\windows\Tasks\At21.job

c:\windows\Tasks\At22.job

c:\windows\Tasks\At23.job

c:\windows\Tasks\At24.job

c:\windows\Tasks\At25.job

c:\windows\Tasks\At26.job

c:\windows\Tasks\At27.job

c:\windows\Tasks\At28.job

c:\windows\Tasks\At29.job

c:\windows\Tasks\At3.job

c:\windows\Tasks\At30.job

c:\windows\Tasks\At31.job

c:\windows\Tasks\At32.job

c:\windows\Tasks\At33.job

c:\windows\Tasks\At34.job

c:\windows\Tasks\At35.job

c:\windows\Tasks\At36.job

c:\windows\Tasks\At37.job

c:\windows\Tasks\At38.job

c:\windows\Tasks\At39.job

c:\windows\Tasks\At4.job

c:\windows\Tasks\At40.job

c:\windows\Tasks\At41.job

c:\windows\Tasks\At42.job

c:\windows\Tasks\At43.job

c:\windows\Tasks\At44.job

c:\windows\Tasks\At45.job

c:\windows\Tasks\At46.job

c:\windows\Tasks\At47.job

c:\windows\Tasks\At48.job

c:\windows\Tasks\At5.job

c:\windows\Tasks\At6.job

c:\windows\Tasks\At7.job

c:\windows\Tasks\At8.job

c:\windows\Tasks\At9.job

.

((((((((((((((((((((((((( Files Created from 2010-09-20 to 2010-10-20 )))))))))))))))))))))))))))))))

.

2010-10-19 03:20 . 2010-10-19 03:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-10-18 02:01 . 2010-10-18 01:58 77312 ----a-w- C:\mbr.exe

2010-10-15 04:31 . 2001-08-18 02:36 6729 ----a-w- c:\windows\system32\dllcache\disrvci.dll

2010-10-15 04:30 . 2001-08-18 02:36 175104 ----a-w- c:\windows\system32\dllcache\csamsp.dll

2010-10-15 04:29 . 2001-08-17 17:51 13824 ----a-w- c:\windows\system32\dllcache\bulltlp3.sys

2010-10-15 04:28 . 2008-04-13 18:46 38912 ----a-w- c:\windows\system32\dllcache\avc.sys

2010-10-15 04:24 . 2001-08-17 16:11 46112 ----a-w- c:\windows\system32\dllcache\adptsf50.sys

2010-10-15 01:59 . 2010-10-15 01:59 232 ----a-w- c:\documents and settings\Full Name\Application Data\jsfhjjsd.bat

2010-10-15 01:49 . 2010-10-15 01:49 -------- d-----w- c:\documents and settings\Full Name\Application Data\Malwarebytes

2010-10-15 01:49 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-15 01:49 . 2010-10-15 01:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-10-15 01:49 . 2010-10-19 02:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-15 01:49 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-15 01:28 . 2010-08-12 12:15 15880 ----a-w- c:\windows\system32\lsdelete.exe

2010-10-15 01:13 . 2010-08-12 12:15 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2010-10-15 01:13 . 2010-10-15 01:13 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2010-10-15 01:10 . 2010-10-15 01:10 -------- d-----w- c:\documents and settings\Full Name\Local Settings\Application Data\Sunbelt Software

2010-10-15 01:06 . 2010-10-15 01:07 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}

2010-10-15 01:05 . 2010-10-15 01:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2010-10-14 21:52 . 2010-10-14 22:17 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2010-10-14 01:57 . 2010-10-14 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!

2010-09-22 22:10 . 2010-09-22 22:10 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2010-09-22 22:10 . 2010-09-22 22:10 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-24 18:57 . 2010-09-05 05:14 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll

.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2004-12-03 15:56 . 2004-06-30 19:33 1388544 c:\program files\Analog Devices\SoundMAX\bak\SMax4PNP.exe

2004-12-03 15:57 . 2004-08-25 18:52 339968 c:\program files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe

2005-01-08 15:09 . 2005-01-08 15:09 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2004-01-07 07:01 . 2004-01-07 07:01 110592 c:\program files\Common Files\Sonic\Update Manager\bak\sgtray.exe

2004-12-03 15:59 . 2004-08-24 00:19 57344 c:\program files\CyberLink\PowerDVD\bak\DVDLauncher.exe

2004-12-03 15:58 . 2004-04-12 02:15 290816 c:\program files\Dell\Media Experience\bak\PCMService.exe

2007-03-15 15:09 . 2007-03-15 15:09 460784 c:\program files\DellSupport\bak\DSAgnt.exe

2004-06-19 03:04 . 2004-06-19 03:04 913408 c:\program files\EarthLink TotalAccess\bak\TaskPanl.exe

2004-06-19 02:04 . 2004-06-19 02:04 913408 c:\program files\EarthLink TotalAccess\TaskPanl.exe

2006-01-15 15:17 . 2006-01-15 15:17 169984 c:\program files\Google\Google Desktop Search\bak\GoogleDesktop.exe

2004-12-03 15:57 . 2004-03-23 18:16 135168 c:\program files\Intel\Intel Application Accelerator\bak\iaanotif.exe

2004-12-03 15:57 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2004-04-21 15:28 . 2004-04-21 15:28 286720 c:\program files\iTunes\bak\iTunesHelper.exe

2010-01-23 00:16 . 2010-01-23 00:16 141608 c:\program files\iTunes\iTunesHelper.exe

2007-07-29 23:29 . 2007-07-12 08:00 132496 c:\program files\Java\jre1.6.0_02\bin\bak\jusched.exe

2004-08-04 07:06 . 2004-10-13 16:24 1694208 c:\program files\Messenger\bak\msmsgs.exe

2008-08-30 06:20 . 2008-04-14 00:12 1695232 c:\program files\Messenger\msmsgs.exe

2004-12-03 16:05 . 2004-10-08 13:49 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\bak\mmtask.exe

2004-12-03 16:08 . 2005-05-07 03:08 98304 c:\program files\QuickTime\bak\qttask.exe

2009-11-11 04:08 . 2009-11-11 04:08 417792 c:\program files\QuickTime\QTTask.exe

2005-02-17 02:28 . 2005-02-11 18:35 2506752 c:\program files\Yahoo!\Messenger\bak\ypager.exe

2004-08-04 11:00 . 2004-08-04 11:00 15360 c:\windows\SYSTEM32\bak\ctfmon.exe

2004-08-04 11:00 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\ctfmon.exe

2005-09-23 23:31 . 2004-11-16 05:05 127035 c:\windows\SYSTEM32\dla\bak\tfswctrl.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpySweeper"="" [N/A]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-13 39408]

"Google Update"="c:\documents and settings\Full Name\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-16 133104]

"E6TaskPanel"="c:\program files\EarthLink TotalAccess\TaskPanl.exe" [2004-06-19 913408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]

"dcmsvc"="c:\program files\dcmsvc\dcmsvc.exe" [2009-04-07 30440]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

c:\documents and settings\Full Name\Start Menu\Programs\Startup\

Warner Bros.lnk - c:\program files\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe [2010-4-18 95744]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2004-12-3 156784]

HP OfficeJet T Series Startup.lnk - c:\program files\Hewlett-Packard\HP OfficeJet T Series\Bin\HPOstr05.exe [2004-12-6 1175552]

Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2005-11-4 176128]

KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=

"c:\\WINDOWS\\SYSTEM32\\verclsid.exe"=

"c:\\Program Files\\iTunes\\iTunesHelper.exe"=

"c:\\Program Files\\McAfee.com\\Agent\\mcagent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [10/14/2010 9:13 PM 64288]

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\SYSTEM32\DRIVERS\mfetdi2k.sys [9/5/2010 1:14 AM 84072]

R1 NEOFLTR_650_15255;Juniper Networks TDI Filter Driver (NEOFLTR_650_15255);c:\windows\SYSTEM32\DRIVERS\NEOFLTR_650_15255.SYS [6/8/2010 11:21 PM 85360]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [7/4/2009 12:11 AM 93320]

R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/5/2010 1:14 AM 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [9/5/2010 1:14 AM 271480]

R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [9/5/2010 1:15 AM 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [9/5/2010 1:14 AM 141792]

R3 cfwids;McAfee Inc. cfwids;c:\windows\SYSTEM32\DRIVERS\cfwids.sys [9/5/2010 1:14 AM 55840]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\SYSTEM32\DRIVERS\mfefirek.sys [9/5/2010 1:14 AM 312904]

R3 mfendiskmp;mfendiskmp;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [9/5/2010 1:14 AM 88544]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/11/2010 9:05 PM 135664]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/12/2010 8:15 AM 1357464]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/12/2010 8:15 AM 15008]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [9/5/2010 1:14 AM 88544]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\SYSTEM32\DRIVERS\mferkdet.sys [9/5/2010 1:14 AM 84264]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk01

.

Contents of the 'Scheduled Tasks' folder

2010-10-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 01:13]

2010-10-15 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-12 01:05]

2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-12 01:05]

2010-10-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1128741446-1676377901-411198756-1006Core.job

- c:\documents and settings\Full Name\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-16 00:16]

2010-10-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1128741446-1676377901-411198756-1006UA.job

- c:\documents and settings\Full Name\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-16 00:16]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://start.earthlink.net/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html

Trusted Zone: dell.com\accessories.us

Trusted Zone: internet

Trusted Zone: jpmorgan.com\mcpuk1

Trusted Zone: jpmorganchase.com\trainingcentralinternet

Trusted Zone: jpmorganchase.com\webvpn

Trusted Zone: mcafee.com

Trusted Zone: musicmatch.com

Trusted Zone: skillport.com

Trusted Zone: skillwsa.com

DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} - hxxps://mcpuk1.jpmorgan.com/llclient/webvpn-amer/winxp/AXXPEE.dll

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://webvpn-bw03.jpmorganchase.com/dana-cached/sc/JuniperSetupClient.cab

FF - ProfilePath - c:\documents and settings\Full Name\Application Data\Mozilla\Firefox\Profiles\s2qsc6ca.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://start.earthlink.net/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - plugin: c:\documents and settings\Full Name\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\McAfee\Supportability\MVT\NPMVTPlugin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----

FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

AddRemove-Google Desktop - c:\program files\Google\Google Desktop Search\GoogleDesktopSetup.exe

AddRemove-HijackThis - c:\documents and settings\Full Name\Desktop\HijackThis.exe

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86E44566]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf7742f28

\Driver\ACPI -> ACPI.sys @ 0xf7635cb8

\Driver\atapi -> atapi.sys @ 0xf7562852

\Driver\iaStor -> iaStor.sys @ 0xf7585316

IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e710a

NDIS: Broadcom NetXtreme 57xx Gigabit Controller -> SendCompleteHandler -> NDIS.sys @ 0xf73b7bb0

PacketIndicateHandler -> NDIS.sys @ 0xf73c4a21

SendHandler -> NDIS.sys @ 0xf73a287b

user & kernel MBR OK

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1068)

c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(1128)

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(4036)

c:\windows\system32\WININET.dll

c:\docume~1\ANDREW~1\LOCALS~1\Temp\IadHide5.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Intel\Intel Application Accelerator\iaantmon.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\McAfee\SystemCore\mcshield.exe

c:\documents and settings\Full Name\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe

c:\program files\Hewlett-Packard\HP OfficeJet T Series\bin\HPOVDX05.EXE

c:\windows\system32\hpoipm07.exe

c:\program files\iPod\bin\iPodService.exe

c:\progra~1\mcafee.com\agent\mcagent.exe

c:\progra~1\mcafee.com\agent\mcupdate.exe

.

**************************************************************************

.

Completion time: 2010-10-19 22:05:40 - machine was rebooted

ComboFix-quarantined-files.txt 2010-10-20 02:05

Pre-Run: 115,653,406,720 bytes free

Post-Run: 115,783,454,720 bytes free

- - End Of File - - 5409D4A0C05454A402C636F389376CD2

======== END OF FILE ======================

I've re-enabled my AV/AM software now that it's done. FF might have launched another unwanted tab while I was typing this though (I deleted it by reflex when I saw it start to open), so I don't know if the PC is 100% clean yet. I'm going to look into reenabling Google Chrome, since it seems to run cleanest of all browsers in my experience - but I think the latest McAfee version has a conflict which needs to be overwritten.

Thanks.

[sjpritch25]

Go to Start ----> Run ---> Type the following

MBR.exe -c 0 1 dump.dat

The file should appear in your root drive C:\

Please upload it here.

http://www.bleepingcomputer.com/submit-mal....php?channel=70

[AJS1970]

I have ran the program and uploaded the dat file to the bleepingcomputer URL that you mentioned

Will await the diagnosis, thanks.

[sjpritch25]

Do you still have your cd -emulation software disabled??

[sjpritch25]

let me get confirmation on the mbr before i tell you its clean.

This is a dell computer?

[sjpritch25]

• Download TDSSKiller.zip and extract TDSSKiller.exe to your desktop
  
• Execute TDSSKiller.exe by doubleclicking on it.
  
• Press Start Scan
  
• If Malicious objects are found, ensure Cure is selected (it should be by default)
  
• Click Continue then click Reboot now
  
• Once complete, a log will be produced at the root drive which is typically C:\
  For example, C:\TDSSKiller.2.4.0.0_24.07.2010_13.10.52_log.txt
  
• Attach that log, please.
  

[AJS1970]

The app was run, it said that one rootkit was removed, and the log file is attached.

Do you think the PC is now clean? Google Chrome and ITunes now work again, which are good signs.

TDSSKiller.2.4.4.0_21.10.2010_18.26.59_log.txt

[sjpritch25]

Go to Start ---> Run ---> Type

"%systemdrive%\mbr.exe" -t "%systemdrive%\mbr.log" and press Enter

In your next reply, please include the log. Thanks

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
  

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
  
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • 
    
  • Spyware, adware, dialers, and other riskware
    
  • Archives
    
  • E-mail databases
    

  [*]Click on My Computer under the green Scan bar to the left to start the scan.

  [*]Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

  [*]Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

  [*]Click View report... at the bottom.

  [*] Click the Save report... button.

  

  [*] Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

[AJS1970]

When I ran mbr.exe with the given args, it looks like the output was written to the STDOUT/STDERR instead of the log file, so I copied the output from that DOS shell and here it is:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll

kernel: MBR read successfully

user & kernel MBR OK

I'll post the second Kaspersky site app's results after I download and run it - since that may take a while due to the AV unsetting/resetting and run time, I wanted to post this first.

[sjpritch25]

Okay your mbr is clean now.

[AJS1970]

I still need to run the Kaspersky app, correct?

[sjpritch25]

yes

[AJS1970]

Below is the log from the Kaspersky Online Scanner. The F drive is an external drive which I have manually copied some files over to as a backup over the years, some from my previous PC so I would not have lost them (typically email files and songs from physical CDs I own that I have saved onto my PC).

--------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER 7.0: scan report

Friday, October 22, 2010

Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Friday, October 22, 2010 08:23:51

Records in database: 4183068

--------------------------------------------------------------------------------

Scan settings:

scan using the following database: extended

Scan archives: yes

Scan e-mail databases: yes

Scan area - My Computer:

C:\

D:\

E:\

F:\

Scan statistics:

Objects scanned: 151831

Threats found: 11

Infected objects found: 22

Suspicious objects found: 0

Scan duration: 04:58:40

File name / Threat / Threats count

C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\50\603860b2-328de861 Infected: Trojan-Downloader.Java.Agent.hx 1

C:\Documents and Settings\LocalService\Application Data\Sun\Java\Deployment\cache\6.0\9\51587cc9-4ffc184d Infected: Trojan-Downloader.Java.Agent.hx 1

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\19\70866dd3-2e82a71b Infected: Trojan-Downloader.Java.Agent.hx 1

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1567\A0093242.exe Infected: Packed.Win32.Krap.hc 1

F:\andrews\Program Files\Common Files\BTLINK\btlink.dll Infected: not-a-virus:AdWare.Win32.Wintol.ap 1

F:\andrews\Program Files\Common Files\MSIETS\msiein.dll Infected: Trojan.Win32.Scar.cfhf 1

F:\andrews\Program Files\Common Files\MSIETS\MSIELINK.DLL Infected: not-a-virus:AdWare.Win32.Wintol.ao 1

F:\andrews\Program Files\Common Files\MSIETS\temp\hblink.cab Infected: not-a-virus:AdWare.Win32.Wintol.az 1

F:\andrews\Program Files\Common Files\MSIETS\tempss\hblink.cab Infected: not-a-virus:AdWare.Win32.Wintol.ao 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\12AB4AC2 Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\130866D5.exe Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\1B1D306C.exe Infected: Trojan.Win32.SecondThought.a 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\1B272E61.exe Infected: Trojan.Win32.SecondThought.a 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\1B712119 Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\2CE15D29.hta Infected: Email-Worm.VBS.KakWorm 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\2FAB2FD3.exe Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\3CBB0C37.exe Infected: Trojan-Downloader.Win32.Small.ar 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\426A3398 Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\483D7C6F.exe Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\Program Files\Norton AntiVirus\Quarantine\7E5A25F4.exe Infected: Trojan-Downloader.Win32.Minstaller 1

F:\andrews\WINDOWS\Application Data\Identities\{677638E0-DB3F-11D3-967F-964B17B00C3E}\Microsoft\Outlook Express\Sent Items.dbx Infected: Email-Worm.VBS.KakWorm 1

F:\andrews\WINDOWS\TEMP\msiein\CAB37997.5723922454\cab.cab Infected: not-a-virus:AdWare.Win32.WebSearch.cc 1

Selected area has been scanned.

[sjpritch25]

Download TFC to your desktop

• Open the file and close any other windows.
  
• It will close all programs itself when run, make sure to let it run uninterrupted.
  
• Click the Start button to begin the process. The program should not take long to finish its job
  
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
  

How is everything running???