link redirect and mcafee real-time scan issue

rniemeyer · October 19, 2010

About a week ago I started having problems with being re-directed when clicking on search links. I ran some virus scans with McAfee, purchase malwarbytes and used tdsskiller.

These are the site that i am sent to, mwab detects them as malicious and stops the re-direct.

http://66.45.255.230/click.php?c=5e038c6a0...992e64f60207501

http://www.norhiogngeta.com/search.php?q=g...mp;n=1287413720

Now, I can't seem to even start windows normally. All services do not load and McAfee keeps popping up saying that real-time scanning is turned off and when I click start it shuts off again. Also, I can not seem to run anything in regular windows, all programs seem to lock up and I have to shut down.

Attached are my logs, thank you in advance for any help.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4881

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

10/19/2010 1:43:25 PM

mbam-log-2010-10-19 (13-43-25).txt

Scan type: Quick scan

Objects scanned: 200714

Time elapsed: 11 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-10-10.03) - NTFSx86 NETWORK

Run by Ron at 8:58:28.64 on Tue 10/19/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1647 [GMT -6:00]

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe

C:\WINDOWS\system32\mfevtps.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\ctfmon.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Ron\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20101015015124.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - c:\program files\windows home server\WHSDeskBands.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: DCA BHO: {b49699fc-1665-4414-a1cb-c4a2a4a13eec} - c:\program files\upromise\dca-bho.dll

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

BHO: Ask Toolbar BHO: {d4027c7f-154a-4066-a1ad-4243d8127440} - Ask Toolbar

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: Upromise TurboSaver: {edc0f17f-f4b7-47e4-b73e-887faeb376fa} - c:\program files\upromise\upromisetoolbar.dll

TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} -

TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - c:\program files\windows home server\WHSDeskBands.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Upromise TurboSaver: {06e58e5e-f8cb-4049-991e-a41c03bd419e} - c:\program files\upromise\upromisetoolbar.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [gSyncit] c:\program files\gsyncit\gsyncit.exe

uRun: [PhotoshopElements8SyncAgent] c:\program files\adobe\elements organizer 8.0\ElementsOrganizerSyncAgent.exe

uRun: [upromise Update] c:\program files\upromise\dca-ua.exe

uRun: [upromise Tray] c:\program files\upromise\UpromiseTray.exe

uRunOnce: [shockwave Updater] c:\windows\system32\adobe\shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6.4; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; OfficeLiveConnector.1.4; OfficeLivePatch.1.3; AskTB5.6)" -"http://www.mscd.edu/~catt/pepsi_center/mainmovie4.htm"

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [sigmatelSysTrayApp] stsystra.exe

mRun: [showLOMControl]

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [iSUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay

mRun: [WD Button Manager] WDBtnMgr.exe

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [<NO NAME>]

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [intelZeroConfig] "c:\program files\intel\wifi\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\common files\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray

mRun: [AmazonGSDownloaderTray] c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderTray.exe

mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimagehome\TrueImageMonitor.exe

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

StartupFolder: c:\docume~1\ron\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\windows\installer\{21e49794-7c13-4e84-8659-55bd378267d5}\WHSTrayApp.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {06E58E5E-F8CB-4049-991E-A41C03BD419E} - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - c:\program files\upromise\upromisetoolbar.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

Trusted Zone: ameritrade.com

Trusted Zone: internet

Trusted Zone: intuit.com\ttlc

Trusted Zone: mcafee.com

Trusted Zone: tdameritrade.com

Trusted Zone: turbotax.com

DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} - hxxp://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab

DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab

DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6770.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175914254906

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {99FE5072-78AA-4FEE-89BA-69A5FA55343F} - hxxp://download.microsoft.com/download/B/3/A/B3A2EA73-793D-4ABE-992D-C81140384044/igdtoolx.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {EB6D7E70-AAA9-40D9-BA05-F214089F2275} - hxxp://www.theclickteam.com/vitalize4/vitalize.cab

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

LSA: Notification Packages = :\windows\syste

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-8-24 386712]

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-10-15 84072]

R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-10-15 271480]

R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-10-15 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-10-15 141792]

R3 BackupReader;BackupReader;c:\windows\system32\drivers\BackupReader.sys [2009-4-20 44776]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-10-15 312904]

R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-10-15 88544]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2009-11-1 27632]

S2 esClient;Windows Media Center Client Service;c:\program files\windows home server\esClient.exe [2009-10-7 97128]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-7-8 133104]

S2 HPMSSConnectorSvc;HPMSSConnectorService;c:\program files\hewlett-packard\hp mediasmart server\MSSConnectorService.exe [2009-10-26 20992]

S2 Iprip;RIP Listener;c:\windows\system32\svchost.exe -k netsvcs [2008-8-25 14336]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-10-12 304464]

S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-10-15 271480]

S2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-10-15 271480]

S2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-10-15 271480]

S2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

S2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-10-15 171168]

S2 MediaCollectorService;MediaCollectorService;c:\program files\hewlett-packard\hp mediasmart server\MediaCollectorClient.exe [2009-10-26 81920]

S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-9-17 583640]

S2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe --start-service --> c:\program files\secunia\psi\sua.exe --start-service [?]

S2 WDDMService;WDDMService;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-9-8 237056]

S2 WDFME;WD File Management Engine;c:\program files\western digital\wd smartware\front parlor\wdfme\WDFME.exe [2010-9-8 1034752]

S2 WDSC;WD File Management Shadow Engine;c:\program files\western digital\wd smartware\front parlor\WDSC.exe [2010-9-8 484352]

S2 WHSConnector;Windows Home Server Connector Service;c:\program files\windows home server\WHSConnector.exe [2009-10-7 376680]

S3 Amazon Download Agent;Amazon Download Agent;c:\program files\amazon\amazon games & software downloader\AmazonGSDownloaderService.exe [2010-4-6 401920]

S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-10-15 55840]

S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-6-8 13224]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-10-12 20952]

S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-10-15 152992]

S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-10-15 52104]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-10-15 88544]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-10-15 84264]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]

S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [2010-3-1 39704]

S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-10-14 11520]

S4 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\adobe\elements organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-6 169312]

=============== Created Last 30 ================

2010-10-18 20:05:01 -------- d-----w- c:\docume~1\ron\locals~1\applic~1\Secunia PSI

2010-10-18 20:04:53 -------- d-----w- c:\program files\Secunia

2010-10-17 14:05:50 -------- d-----w- c:\program files\Canon

2010-10-16 20:53:58 -------- d-----w- c:\program files\iPod

2010-10-16 20:53:54 -------- d-----w- c:\program files\iTunes

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2010-10-16 20:47:43 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2010-10-16 20:43:54 -------- d-----w- c:\program files\Bonjour

2010-10-15 07:52:24 -------- d-----w- c:\program files\SiteAdvisor

2010-10-15 07:51:22 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys

2010-10-15 07:51:12 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys

2010-10-15 07:51:11 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys

2010-10-15 07:51:11 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys

2010-10-15 07:51:11 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys

2010-10-15 07:51:11 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys

2010-10-15 07:51:11 312904 ----a-w- c:\windows\system32\drivers\mfefirek.sys

2010-10-15 07:51:11 152992 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2010-10-15 07:51:03 -------- d-----w- c:\program files\common files\Mcafee

2010-10-15 07:51:01 -------- d-----w- c:\program files\McAfee.com

2010-10-15 07:50:44 -------- d-----w- c:\program files\McAfee

2010-10-15 07:42:27 141792 ----a-w- c:\windows\system32\mfevtps.exe

2010-10-15 01:25:34 -------- d-----w- c:\docume~1\ron\locals~1\applic~1\Western_Digital

2010-10-14 23:57:43 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys

2010-10-14 20:40:12 -------- d-----w- c:\docume~1\ron\locals~1\applic~1\WDC

2010-10-14 20:38:54 -------- d-----w- c:\docume~1\alluse~1\applic~1\Western Digital

2010-10-14 20:37:53 -------- d-----w- c:\program files\Western Digital

2010-10-14 20:37:25 -------- d-----w- c:\docume~1\ron\locals~1\applic~1\Western Digital

2010-10-14 01:34:58 -------- d-----w- c:\docume~1\ron\applic~1\upromise

2010-10-13 12:42:01 974848 ------w- c:\windows\system32\dllcache\mfc42.dll

2010-10-13 12:42:01 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll

2010-10-13 12:41:53 617472 ------w- c:\windows\system32\dllcache\comctl32.dll

2010-10-13 03:46:13 -------- d-----w- c:\docume~1\ron\applic~1\Malwarebytes

2010-10-13 03:46:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-13 03:46:03 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-13 03:46:03 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-10-13 03:46:02 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-09 00:10:29 104960 --sha-r- c:\windows\system32\w32toplm.dll

2010-10-08 00:17:41 -------- d-----w- c:\docume~1\ron\locals~1\applic~1\CANON_INC

2010-10-08 00:05:40 -------- d-----w- c:\program files\common files\Canon

2010-09-23 00:10:52 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

==================== Find3M ====================

2010-09-18 18:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll

2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll

2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll

2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll

2010-09-15 10:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-15 08:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-10 05:58:06 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-09-08 17:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-09-08 17:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll

2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys

2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll

2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll

2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-08-05 14:46:04 37336 ----a-w- c:\windows\system32\CleanMFT32.exe

2010-07-28 00:44:10 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-07-28 00:44:10 107808 ----a-w- c:\windows\system32\dns-sd.exe

============= FINISH: 8:59:59.60 ===============

ark.zip

Attach.zip

Gammo · October 21, 2010

Hi,

You can run the following tool in Safe Mode if needed.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
Click me
If you can't disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

rniemeyer · October 21, 2010

ComboFix 10-10-20.04 - Ron 10/21/2010 13:25:41.1.2 - x86

Running from: c:\documents and settings\Ron\Desktop\ComboFix.exe

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Ron\Local Settings\Application Data\ie_runner_app.exe

c:\windows\system32\kWab.dll

.

((((((((((((((((((((((((( Files Created from 2010-09-21 to 2010-10-21 )))))))))))))))))))))))))))))))

.

2010-10-20 15:49 . 2010-10-20 15:49 -------- d-----w- c:\documents and settings\LocalService\Application Data\Malwarebytes

2010-10-18 20:05 . 2010-10-18 20:05 -------- d-----w- c:\documents and settings\Ron\Local Settings\Application Data\Secunia PSI

2010-10-18 20:04 . 2010-10-18 20:04 -------- d-----w- c:\program files\Secunia

2010-10-17 14:05 . 2010-10-17 14:05 -------- d-----w- c:\program files\Canon

2010-10-16 20:53 . 2010-10-16 20:53 -------- d-----w- c:\program files\iPod

2010-10-16 20:53 . 2010-10-16 20:55 -------- d-----w- c:\program files\iTunes

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll

2010-10-16 20:47 . 2010-10-16 20:47 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll

2010-10-16 20:46 . 2010-10-16 20:47 -------- d-----w- c:\program files\QuickTime

2010-10-16 20:43 . 2010-10-16 20:43 -------- d-----w- c:\program files\Bonjour

2010-10-15 07:52 . 2010-10-15 07:52 -------- d-----w- c:\program files\SiteAdvisor

2010-10-15 07:51 . 2010-08-24 20:57 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys

2010-10-15 07:51 . 2010-08-24 20:57 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys

2010-10-15 07:51 . 2010-08-24 20:57 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys

2010-10-15 07:51 . 2010-08-24 20:57 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys

2010-10-15 07:51 . 2010-08-24 20:57 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys

2010-10-15 07:51 . 2010-08-24 20:57 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys

2010-10-15 07:51 . 2010-08-24 20:57 312904 ----a-w- c:\windows\system32\drivers\mfefirek.sys

2010-10-15 07:51 . 2010-08-24 20:57 152992 ----a-w- c:\windows\system32\drivers\mfeavfk.sys

2010-10-15 07:51 . 2010-10-15 07:51 -------- d-----w- c:\program files\Common Files\Mcafee

2010-10-15 07:50 . 2010-10-15 08:24 -------- d-----w- c:\program files\McAfee

2010-10-15 07:42 . 2010-08-24 20:57 141792 ----a-w- c:\windows\system32\mfevtps.exe

2010-10-15 07:42 . 2010-10-15 10:52 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2010-10-15 03:22 . 2010-10-15 03:22 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-10-15 03:18 . 2010-10-15 03:18 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-10-15 01:25 . 2010-10-15 01:25 -------- d-----w- c:\documents and settings\Ron\Local Settings\Application Data\Western_Digital

2010-10-14 23:57 . 2009-02-13 18:02 11520 ----a-w- c:\windows\system32\drivers\wdcsam.sys

2010-10-14 20:40 . 2010-10-14 20:40 -------- d-----w- c:\documents and settings\Ron\Local Settings\Application Data\WDC

2010-10-14 20:38 . 2010-10-14 20:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Western Digital

2010-10-14 20:37 . 2010-10-14 23:53 -------- d-----w- c:\program files\Western Digital

2010-10-14 20:37 . 2010-10-14 20:37 -------- d-----w- c:\documents and settings\Ron\Local Settings\Application Data\Western Digital

2010-10-14 07:37 . 2010-10-14 07:37 -------- d-----w- c:\documents and settings\Adobe

2010-10-14 06:47 . 2010-10-14 07:07 -------- d-----w- c:\documents and settings\Test Elements

2010-10-14 01:34 . 2010-10-14 01:34 -------- d-----w- c:\documents and settings\Ron\Application Data\upromise

2010-10-13 12:42 . 2010-09-18 06:53 974848 ------w- c:\windows\system32\dllcache\mfc42.dll

2010-10-13 12:42 . 2010-09-18 06:53 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll

2010-10-13 12:41 . 2010-08-23 16:12 617472 ------w- c:\windows\system32\dllcache\comctl32.dll

2010-10-13 03:46 . 2010-10-13 03:46 -------- d-----w- c:\documents and settings\Ron\Application Data\Malwarebytes

2010-10-13 03:46 . 2010-04-29 21:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-13 03:46 . 2010-10-13 03:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-10-13 03:46 . 2010-04-29 21:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-13 03:46 . 2010-10-13 03:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-13 00:03 . 2010-10-13 00:06 -------- d-----w- c:\program files\Windows Live Safety Center

2010-10-09 02:14 . 2010-10-09 02:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Registry Mechanic

2010-10-09 01:58 . 2010-10-09 01:58 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-10-09 00:10 . 2010-10-09 00:10 104960 --sha-r- c:\windows\system32\w32toplm.dll

2010-10-08 00:17 . 2010-10-08 00:17 -------- d-----w- c:\documents and settings\Ron\Local Settings\Application Data\CANON_INC

2010-10-08 00:05 . 2010-10-08 00:05 -------- d-----w- c:\program files\Common Files\Canon

2010-10-04 03:00 . 2010-10-04 03:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\PeerNetworking

2010-09-23 00:10 . 2010-09-23 00:10 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2008-01-03 67128]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

"PhotoshopElements8SyncAgent"="c:\program files\Adobe\Elements Organizer 8.0\ElementsOrganizerSyncAgent.exe" [2009-09-06 1893728]

"Upromise Update"="c:\program files\Upromise\dca-ua.exe" [2010-08-04 171704]

"Upromise Tray"="c:\program files\Upromise\UpromiseTray.exe" [2010-08-06 237264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ShowLOMControl"="" [X]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-30 761947]

"SigmatelSysTrayApp"="stsystra.exe" [2005-11-17 397312]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]

"WD Button Manager"="WDBtnMgr.exe" [2009-12-08 364544]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-11-07 122940]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392]

"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2010-01-19 1392640]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-01-19 1206544]

"AmazonGSDownloaderTray"="c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]

"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2010-06-07 2605424]

"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2010-06-07 362488]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-04-29 437584]

"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-11 1193848]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

c:\documents and settings\Ron\Start Menu\Programs\Startup\

Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2010-9-29 1712696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2010-3-31 604008]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Windows Home Server\\Discovery.exe"=

"c:\\Program Files\\Adobe\\Elements Organizer 8.0\\AdobePhotoshopElementsMediaServer.exe"=

"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping

"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [10/15/2010 1:51 AM 84072]

R2 esClient;Windows Media Center Client Service;c:\program files\Windows Home Server\esClient.exe [10/7/2009 1:48 PM 97128]

R2 HPMSSConnectorSvc;HPMSSConnectorService;c:\program files\Hewlett-Packard\HP MediaSmart Server\MSSConnectorService.exe [10/26/2009 11:29 AM 20992]

R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [8/25/2008 1:30 PM 14336]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [10/12/2010 9:46 PM 304464]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [10/15/2010 1:51 AM 271480]

R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [10/15/2010 1:51 AM 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [10/15/2010 1:51 AM 271480]

R2 MediaCollectorService;MediaCollectorService;c:\program files\Hewlett-Packard\HP MediaSmart Server\MediaCollectorClient.exe [10/26/2009 11:29 AM 81920]

R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [10/15/2010 1:51 AM 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [10/15/2010 1:42 AM 141792]

R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [9/17/2010 10:04 PM 583640]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe --start-service --> c:\program files\Secunia\PSI\sua.exe --start-service [?]

R2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [9/8/2010 10:41 AM 237056]

R2 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [9/8/2010 10:45 AM 1034752]

R2 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [9/8/2010 10:44 AM 484352]

R2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [10/7/2009 1:48 PM 376680]

R3 BackupReader;BackupReader;c:\windows\system32\drivers\BackupReader.sys [4/20/2009 9:49 PM 44776]

R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [10/15/2010 1:51 AM 55840]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [10/12/2010 9:46 PM 20952]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [10/15/2010 1:51 AM 312904]

R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [10/15/2010 1:51 AM 88544]

R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [9/1/2010 2:30 AM 15544]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [11/1/2009 8:51 PM 27632]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/8/2009 8:12 PM 133104]

S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [4/6/2010 5:56 PM 401920]

S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 10:58 AM 11336]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [6/8/2008 9:24 AM 13224]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [10/15/2010 1:51 AM 88544]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [10/15/2010 1:51 AM 84264]

S3 RemoteControl-USBLAN;RemoteControl-USBLAN;c:\windows\system32\drivers\rcblan.sys [3/1/2010 6:37 PM 39704]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [10/14/2010 5:57 PM 11520]

S4 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [9/6/2009 6:06 AM 169312]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SECUNIA_UPDATE_AGENT

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

.

Contents of the 'Scheduled Tasks' folder

2010-10-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2010-10-21 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-27 17:44]

2010-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-09 02:11]

2010-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-09 02:11]

2010-10-21 c:\windows\Tasks\RMSmartUpdate.job

- c:\program files\Registry Mechanic\Update.exe [2010-09-18 14:46]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

Trusted Zone: ameritrade.com

Trusted Zone: internet

Trusted Zone: intuit.com\ttlc

Trusted Zone: mcafee.com

Trusted Zone: tdameritrade.com

Trusted Zone: turbotax.com

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

.

- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-gSyncit - c:\program files\gSyncit\gsyncit.exe

HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe

SafeBoot-klmdb.sys

AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1720)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\netprovcredman.dll

- - - - - - - > 'explorer.exe'(2036)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\windows\system32\netprovcredman.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Intel\WiFi\bin\EvtEng.exe

c:\program files\Intel\WiFi\bin\S24EvMon.exe

c:\program files\Intel\WiFi\bin\WLKeeper.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Acronis\Schedule2\schedul2.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Cisco Systems\VPN Client\cvpnd.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\eHome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe

c:\program files\Retrospect\Retrospect 7.5\retrorun.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\tcpsvcs.exe

c:\program files\Dell Support Center\bin\sprtsvc.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\SearchIndexer.exe

c:\windows\ehome\mcrdsvc.exe

c:\windows\stsystra.exe

c:\windows\system32\WDBtnMgr.exe

c:\program files\Windows Media Player\WMPNetwk.exe

c:\windows\system32\rundll32.exe

c:\windows\eHome\ehmsas.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\program files\Windows Home Server\WHSTrayApp.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Secunia\PSI\sua.exe

.

**************************************************************************

.

Completion time: 2010-10-21 14:08:16 - machine was rebooted

ComboFix-quarantined-files.txt 2010-10-21 20:08

Pre-Run: 11,990,835,200 bytes free

Post-Run: 12,469,981,184 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 4FBEDF301A1A903DC187B9606F512130

Gammo · October 22, 2010

Hi,

Please go to: VirusTotal

Click the Browse button and search for the following file: c:\windows\system32\w32toplm.dll
Click Open
Then click Send File
Please be patient while the file is scanned.
Once the scan results appear, please provide them in your next reply.

If it says already scanned -- click "reanalyze now"

Please post the results in your next reply.

rniemeyer · October 22, 2010

Sorry it took me awhile, the file was protected and I could not open it.

Here are the results:

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: w32toplm.dll

Submission date: 2010-10-22 21:32:55 (UTC)

Current status: queued queued analysing finished

Result: 13/ 43 (30.2%)

VT Community

not reviewed

Safety score: -

Compact Print results Antivirus Version Last Update Result

AhnLab-V3 2010.10.23.00 2010.10.22 -

AntiVir 7.10.13.27 2010.10.22 TR/Vundo.A.164

Antiy-AVL 2.0.3.7 2010.10.22 Trojan/Win32.Pirminay.gen

Authentium 5.2.0.5 2010.10.22 -

Avast 4.8.1351.0 2010.10.22 Win32:Trojan-gen

Avast5 5.0.594.0 2010.10.22 Win32:Trojan-gen

AVG 9.0.0.851 2010.10.22 -

BitDefender 7.2 2010.10.22 -

CAT-QuickHeal 11.00 2010.10.22 -

ClamAV 0.96.2.0-git 2010.10.22 -

Comodo 6479 2010.10.22 -

DrWeb 5.0.2.03300 2010.10.22 Trojan.Siggen2.6361

Emsisoft 5.0.0.50 2010.10.22 Trojan.Vundo!IK

eSafe 7.0.17.0 2010.10.21 -

eTrust-Vet 36.1.7929 2010.10.22 -

F-Prot 4.6.2.117 2010.10.22 -

F-Secure 9.0.16160.0 2010.10.22 -

Fortinet 4.2.249.0 2010.10.22 -

GData 21 2010.10.22 Win32:Trojan-gen

Ikarus T3.1.1.90.0 2010.10.22 Trojan.Vundo

Jiangmin 13.0.900 2010.10.22 -

K7AntiVirus 9.66.2813 2010.10.22 -

Kaspersky 7.0.0.125 2010.10.22 -

McAfee 5.400.0.1158 2010.10.22 -

McAfee-GW-Edition 2010.1C 2010.10.22 -

Microsoft 1.6301 2010.10.22 -

NOD32 5556 2010.10.22 a variant of Win32/Kryptik.HNY

Norman 6.06.10 2010.10.22 -

nProtect 2010-10-22.01 2010.10.22 Trojan/W32.Pirminay.104960

Panda 10.0.2.7 2010.10.22 Suspicious file

PCTools 7.0.3.5 2010.10.22 -

Prevx 3.0 2010.10.22 High Risk Cloaked Malware

Rising 22.70.03.04 2010.10.22 Trojan.Win32.Generic.523AF565

Sophos 4.58.0 2010.10.22 -

Sunbelt 7119 2010.10.22 -

SUPERAntiSpyware 4.40.0.1006 2010.10.22 -

Symantec 20101.2.0.161 2010.10.22 -

TheHacker 6.7.0.1.064 2010.10.21 -

TrendMicro 9.120.0.1004 2010.10.22 -

TrendMicro-HouseCall 9.120.0.1004 2010.10.22 -

VBA32 3.12.14.1 2010.10.22 -

ViRobot 2010.9.25.4060 2010.10.22 -

VirusBuster 12.69.14.0 2010.10.22 -

Additional informationShow all

MD5 : 154400469fc50eca153284ae1405c292

SHA1 : 3c206925d0514cc7f9995ca10f4aee651989f64e

SHA256: bed5a0c5e46a31de110f8648ffa5a68decc499f7bf903f896460364cc5a03f7e

ssdeep: 3072:yAb8WyX8YOG3530XifzSjx/WaFtOodo6Akf:yu8WyX8YdGqzSjxvw6n

File size : 104960 bytes

First seen: 2010-10-22 21:32:55

Last seen : 2010-10-22 21:32:55

TrID:

Win32 Executable Generic (42.3%)

Win32 Dynamic Link Library (generic) (37.6%)

Generic Win/DOS Executable (9.9%)

DOS Executable Generic (9.9%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

sigcheck:

publisher....: Microsoft Corporation

product......: Microsoft_ Windows_ Operating System

description..: Virtual WiFi Bus Driver

original name: VWiFiBus.sys

internal name: VWiFiBus.sys

file version.: 6.1.7000.0 (winmain_win7beta.081212-1400)

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

PEiD: Armadillo v1.xx - v2.xx

PEInfo: PE structure information

[[ basic data ]]

entrypointaddress: 0xF1CD

timedatestamp....: 0x454A267A (Thu Nov 02 17:10:18 2006)

machinetype......: 0x14c (I386)

[[ 5 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x1000, 0xE28C, 0xE400, 6.49, 9c48cb34c48c996aa6cd13a3790dbb24

.rdata, 0x10000, 0x13FE, 0x1400, 5.63, 6cc562c63ba5aeddf402b2e7ea59f402

.data, 0x12000, 0x110A4, 0x8A00, 5.48, c0e768d32ded044905d40bd2827f55c7

.rsrc, 0x24000, 0x600, 0x600, 3.36, 491329aa962ede5a866fca793701852d

.reloc, 0x25000, 0xDA0, 0xE00, 6.08, 9e1f9d5236b9e39779f9d793bead378a

[[ 7 import(s) ]]

KERNEL32.dll: Sleep, InterlockedCompareExchange, GetLocalTime, lstrcatW, lstrcpyW, lstrlenW, GetLocaleInfoA, RtlMoveMemory, LocalReAlloc, MulDiv, ReleaseSemaphore, GetCurrentThread, GetVersionExA, InterlockedIncrement, InterlockedDecrement, LCMapStringW, MultiByteToWideChar, InterlockedExchangeAdd, lstrlenA, WaitForMultipleObjects, DeleteFileA, SetFileTime, CreateFileA, CopyFileA, FindClose, FlushFileBuffers, VirtualProtect, CopyFileW, MoveFileA, WriteFile, PulseEvent, FindFirstFileA, FindNextFileA, EnterCriticalSection, LeaveCriticalSection, ExpandEnvironmentStringsW, LoadLibraryW, GetProcAddress, HeapAlloc, HeapFree, GetLastError, GetCurrentProcess, CloseHandle, GetSystemTimeAsFileTime, RaiseException, LoadLibraryA, InterlockedExchange, LocalFree, LocalAlloc, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetCurrentThreadId, QueryPerformanceCounter, GetSystemDirectoryW, DeleteCriticalSection, FreeLibrary, HeapDestroy, SetLastError, WaitForSingleObject, GetCurrentProcessId, GetTickCount, GetCommandLineA

USER32.dll: CharNextExA, wsprintfW, wsprintfA

ADVAPI32.dll: InitializeAcl, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegQueryInfoKeyW, CryptCreateHash, CryptVerifySignatureA, CryptImportKey, CryptExportKey, CryptHashData, CryptSignHashA, CryptDestroyKey, CryptGenKey, InitializeSecurityDescriptor, AllocateAndInitializeSid, GetLengthSid, SetThreadToken, OpenThreadToken, CryptSetProvParam, CryptReleaseContext, CryptAcquireContextA, AddAccessAllowedAce, RegQueryValueExA, RegSetValueExA, FreeSid, RegOpenKeyA, SetSecurityDescriptorDacl, RegEnumKeyExW

GDI32.dll: CloseEnhMetaFile, GetTextAlign, ExtTextOutA, GetRgnBox, CombineRgn, DeleteObject, MoveToEx, CreateDIBSection, GetDIBits, CreateFontIndirectA, GetCurrentPositionEx, LineTo, Polyline, Polygon, GetRandomRgn, GetRegionData, GetWinMetaFileBits, PlayEnhMetaFile, SetViewportOrgEx, SetViewportExtEx, SetWindowExtEx, SetMapMode, CreateEnhMetaFileA, SetEnhMetaFileBits, ExtSelectClipRgn, CreateRectRgn, SelectClipRgn, GetClipRgn, DeleteEnhMetaFile, ExcludeClipRect, ExtCreateRegion, OffsetClipRgn, IntersectClipRect

ole32.dll: CoRegisterClassObject

MSVCRT.dll: scanf, strncpy, swscanf, _stricmp, wcslen, _wcsicmp, wcsrchr, setlocale, _ultoa, strrchr, wcscspn, wcscat, _mbslen, _mbscspn, _ismbcprint, wcscmp, atol, memset, _adjust_fdiv, _amsg_exit, free, _XcptFilter, memcpy, _snprintf, _initterm, malloc, wcscpy, _except_handler3, __3@YAXPAX@Z, __CxxFrameHandler, iswprint

MSVCP60.dll: __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, __Grow@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAE_NI_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __Mstd@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z, __8std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@PBD@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@0@Z, __Ostd@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@0@Z

Prevx Info:

http://info.prevx.com/aboutprogramtext.asp...A60C100E52D2B64

ExifTool:

file metadata

CharacterSet: Unicode

CodeSize: 58368

CompanyName: Microsoft Corporation

EntryPoint: 0xf1cd

FileDescription: Virtual WiFi Bus Driver

FileFlagsMask: 0x003f

FileOS: Windows NT 32-bit

FileSize: 102 kB

FileSubtype: 7

FileType: Win32 DLL

FileVersion: 6.1.7000.0 (winmain_win7beta.081212-1400)

FileVersionNumber: 6.1.7000.0

ImageVersion: 6.0

InitializedDataSize: 82944

InternalName: VWiFiBus.sys

LanguageCode: English (U.S.)

LinkerVersion: 8.0

MIMEType: application/octet-stream

MachineType: Intel 386 or later, and compatibles

OSVersion: 4.0

ObjectFileType: Driver

OriginalFilename: VWiFiBus.sys

PEType: PE32

ProductName: Microsoft Windows Operating System

ProductVersion: 6.1.7000.0

ProductVersionNumber: 6.1.7000.0

Subsystem: Windows GUI

SubsystemVersion: 4.0

TimeStamp: 2006:11:02 18:10:18+01:00

UninitializedDataSize: 0

Symantec reputation:Suspicious.Insight

VT Community

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

Gammo · October 22, 2010

Hi,

Please download OTM

Save it to your desktop.
Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes

:Services

:Reg

:Files
ipconfig /flushdns /c
c:\windows\system32\w32toplm.dll

:Commands
[purity]
[resethosts]
[emptytemp]
[emptyflash]
[createrestorepoint]
[reboot]

Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Start Malwarebytes' Anti-Malware

Once the program has loaded, click the "Update" tab and click the "Check For updates" button.
Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'd like us to scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
2. Click on to download the ESET Smart Installer. Save it to your desktop.
3. Double click on the icon on your desktop.
4. Check
5. Click the button.
6. Accept any security warnings from your browser.
7. Check
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the button.
13. Push

rniemeyer · October 23, 2010

OTM log:

All processes killed

========== PROCESSES ==========

========== SERVICES/DRIVERS ==========

========== REGISTRY ==========

========== FILES ==========

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Documents and Settings\Ron\Desktop\cmd.bat deleted successfully.

C:\Documents and Settings\Ron\Desktop\cmd.txt deleted successfully.

DllUnregisterServer procedure not found in c:\windows\system32\w32toplm.dll

c:\windows\system32\w32toplm.dll moved successfully.

========== COMMANDS ==========

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 37514 bytes

->Flash cache emptied: 6146 bytes

User: Adobe

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 41085 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33050 bytes

->Flash cache emptied: 56545 bytes

User: Guest

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 41044 bytes

User: LocalService

->Temp folder emptied: 65748 bytes

->Temporary Internet Files folder emptied: 830622 bytes

->Flash cache emptied: 7338 bytes

User: NetworkService

->Temp folder emptied: 295124 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: Ron

->Temp folder emptied: 487220 bytes

->Temporary Internet Files folder emptied: 40041828 bytes

->Java cache emptied: 75106556 bytes

->Apple Safari cache emptied: 0 bytes

->Flash cache emptied: 107464 bytes

User: Test Elements

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 41568 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 82674 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67136 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 112.00 mb

Restore point Set: OTM Restore Point (0)

OTM by OldTimer - Version 3.1.16.1 log created on 10222010_154805

Files moved on Reboot...

File C:\Documents and Settings\Ron\Local Settings\Temp\~DF1D62.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DF1DD7.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DFA38.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DFA59.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DFE48C.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DFE52.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temp\~DFEA2.tmp not found!

File C:\Documents and Settings\Ron\Local Settings\Temporary Internet Files\Content.IE5\RPKBE8X9\index[3].php not found!

C:\Documents and Settings\Ron\Local Settings\Temporary Internet Files\Content.IE5\JS8TE34U\iframe[1].htm moved successfully.

C:\Documents and Settings\Ron\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4919

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

10/22/2010 4:13:49 PM

mbam-log-2010-10-22 (16-13-49).txt

Scan type: Quick scan

Objects scanned: 191122

Time elapsed: 14 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

ESET Log:

C:\_OTM\MovedFiles\10222010_154805\c_windows\system32\w32toplm.dll a variant of Win32/Kryptik.HNY trojan cleaned by deleting - quarantined

Gammo · October 23, 2010

Hi,

Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections.

Remove Combofix now that we're done with it.

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")
Please follow the prompts to uninstall Combofix.
You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download OTC to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep a backup of your important files

Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Make proper use of your anti-virus and firewall

You should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so.

Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Keep all your software updated

It is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.

It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use a safer web browser

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.

If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some other security programs

It is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.

A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.
SpywareBlaster to help prevent spyware from installing in the first place.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Be careful

Having security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.

Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.

Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Slow computer?

If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!

Cheers,

Gammo

rniemeyer · October 23, 2010

Thanks for all the help.

Gammo · October 24, 2010

Hi,

You're welcome. Glad I could help.

rniemeyer · October 25, 2010

Well it worked for one whole day, I switched to Firefox, am keeping everything up to date and using malwarebytes and McAfee security center. But today after my computer started everything locked up again. I re-started in safe mode and McAfee keeps shutting down the real-time scan. Is there possibly a conflict in how I have Malwarebytes and McAfee configured or is it still an infection:

Thanks.

rniemeyer · October 26, 2010

Gamma, I decided that when I uninstall MBAM that everything worked fine, so probably not a malware issue. I will perform some of the suggestion with mcafee or contact malwarebytes support for help with the configuration.

Thanks again.

Gammo · October 26, 2010

Hi,

Add these exclusions to McAfee: http://forums.malwarebytes.org/index.php?s...mp;#entry162098

MBAM should work fine then.

rniemeyer · October 26, 2010

That is what I looked at in the forums but there does not seem to be a way to add exclusive to the mcafee security center, or I can't seem to find it. It is version 10.5. Any suggestions?

Thanks

Gammo · October 26, 2010

Hi,

No, I suggest you contact Malwarebytes' help desk here: http://helpdesk.malwarebytes.org/home

link redirect and mcafee real-time scan issue

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information