Need help removing ROOTKIT.BUBNIX

bluegem · October 20, 2010

My computer has been running slow and IE locks up several times a day. When I restart IE if I select to restore previous session then it opens a lot of IE screens. I have a up to date and paid for subscription to McAfee and scan occasionaly with Malwarebytes. The last Malwarebytes scan found several items but could not remove ROOTKIT.BUBNIX. Please help me get ride of this. Thanks.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4880

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

10/20/2010 9:02:39 AM

mbam-log-2010-10-20 (09-02-39).txt

Scan type: Quick scan

Objects scanned: 168299

Time elapsed: 11 minute(s), 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\acqlbob.sys (Rootkit.Bubnix) -> No action taken.

DDS (Ver_10-10-10.03) - NTFSx86

Run by Gregg McAlvey at 10:10:19.06 on Wed 10/20/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2359 [GMT -4:00]

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

C:\WINDOWS\system32\ICO.EXE

C:\WINDOWS\system32\Pmxmiced.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\DivX\DivX Update\DivXUpdate.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

"C:\WINDOWS\System32\svchost.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe

C:\PROGRA~1\HP\DIGITA~1\bin\hpqusgl.exe

C:\Documents and Settings\Gregg McAlvey\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

mURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll

BHO: AdvBHO: {2ed2390a-e6f6-f895-fe75-013e2d97184a} - c:\program files\common files\AdvBHO.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20100914220735.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: {577EBCA9-8ED3-45FC-A514-55B3817D4BCF} - No File

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Visual Subst] "c:\documents and settings\gregg mcalvey\desktop\VSubst.exe" /startup

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [PMX Daemon] ICO.EXE

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [D-Link Wireless G WUA-1340] c:\program files\d-link\wireless g wua-1340\AirGCFG.exe

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW

dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10i_ActiveX.exe -update activex

IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {5E638779-1818-4754-A595-EF1C63B87A56} - c:\program files\norton systemworks\norton cleanup\WCQuick.lnk

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

Trusted Zone: archerytalk.com\www

Trusted Zone: markelcorp.com\maicapps

Trusted Zone: watchtvsitcoms.com\www

DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab

DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} - hxxps://agents.helmsmanyacht.com/Documents/smsx.cab

DPF: {3BB1D69B-A780-4BE1-876E-F3D488877135} - hxxp://download.microsoft.com/download/3/B/E/3BE57995-8452-41F1-8297-DD75EF049853/VirtualEarth3D.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1208565249859

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

TCP: {24542F70-8752-4DD9-A02E-FA468BB75FB0} = 192.168.1.205

Filter: text/html - {2846cfad-ac10-4dd2-a770-96f0542df4c6} -

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Notify: LMIinit - LMIinit.dll

Notify: PCANotify - PCANotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-4-17 386712]

R1 AW_HOST;AW_HOST;c:\windows\system32\drivers\AW_HOST5.sys [2007-3-30 18232]

R1 awlegacy;awlegacy;c:\windows\system32\drivers\AWLEGACY.sys [2007-3-30 17848]

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-4-17 84072]

R1 SASDIFSV;SASDIFSV;c:\docume~1\admini~1\locals~1\temp\sas_selfextract\SASDIFSV.SYS [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\docume~1\admini~1\locals~1\temp\sas_selfextract\SASKUTIL.SYS [2010-5-10 67656]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-12-22 47640]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-11-30 88176]

R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-17 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-17 271480]

R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-4-17 271480]

R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-4-17 171168]

R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-4-17 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\common files\mcafee\systemcore\mfevtps.exe [2010-4-17 141792]

R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-4-17 55840]

R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-4-17 152992]

R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-4-17 52104]

R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-4-17 312904]

R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-4-17 88544]

R3 pmxmouse;PMXMOUSE;c:\windows\system32\drivers\pmxmouse.sys [2008-4-30 18432]

R3 pmxusblf;PMXUSBLF;c:\windows\system32\drivers\pmxusblf.sys [2008-4-30 14336]

S1 efqbfwas;efqbfwas;\??\c:\windows\system32\drivers\efqbfwas.sys --> c:\windows\system32\drivers\efqbfwas.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-18 136176]

S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys --> c:\program files\logmein\x86\RaInfo.sys [?]

S2 NProtectService;Norton UnErase Protection;c:\progra~1\norton~1\norton~1\nprotect.exe --> c:\progra~1\norton~1\norton~1\NPROTECT.EXE [?]

S3 awhost32;Symantec pcAnywhere Host Service;c:\program files\symantec\pcanywhere\awhost32.exe [2007-5-11 132728]

S3 cpuz132;cpuz132;\??\c:\docume~1\greggm~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\greggm~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?]

S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2008-2-18 106624]

S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2008-2-8 59648]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-4-17 88544]

S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-4-17 84264]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-10-3 18688]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-10-3 8320]

S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2009-10-3 23680]

S3 PTDLBus;PANTECH UM175AL Composite Device Driver;c:\windows\system32\drivers\PTDLBus.sys [2009-7-2 32256]

S3 PTDLMdm;PANTECH UM175AL Drivers;c:\windows\system32\drivers\PTDLMdm.sys [2009-7-2 41344]

S3 PTDLVsp;PANTECH UM175AL Diagnostic Port;c:\windows\system32\drivers\PTDLVsp.sys [2009-7-2 39936]

S3 PTDLWWAN;PANTECH UM175AL WWAN Driver;c:\windows\system32\drivers\PTDLWWAN.sys [2009-7-2 59776]

S3 Symantec Core LC;Symantec Core LC;c:\progra~1\common~1\symant~1\ccpd-lc\symlcsvc.exe [2008-4-19 1251720]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2010-10-14 13:09:26 974848 ------w- c:\windows\system32\dllcache\mfc42.dll

2010-10-14 13:09:26 954368 ------w- c:\windows\system32\dllcache\mfc40.dll

2010-10-14 13:09:26 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll

2010-10-14 13:08:08 617472 ------w- c:\windows\system32\dllcache\comctl32.dll

2010-10-06 22:49:21 299536 ----a-w- c:\program files\common files\AdvBHO.dll

2010-09-29 15:43:14 -------- d-----w- c:\program files\Viewpoint

2010-09-29 15:42:54 10368 ------w- c:\windows\system32\drivers\pfc.sys

2010-09-29 14:30:08 -------- d-----w- c:\program files\PDFtoBMP

2010-09-29 14:30:08 -------- d-----w- c:\program files\PDF to BMP

2010-09-29 14:20:43 -------- d-----w- c:\program files\PDF to JPEG

==================== Find3M ====================

2010-09-18 16:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll

2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll

2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll

2010-09-18 06:53:25 953856 ------w- c:\windows\system32\mfc40u.dll

2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll

2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-10 05:58:06 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll

2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys

2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll

2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2010-08-23 16:12:04 617472 ------w- c:\windows\system32\comctl32.dll

2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-08-14 22:27:31 398744 ----a-r- c:\windows\system32\cpnprt2.cid

2010-08-03 15:25:19 0 ----a-w- c:\windows\Obibuyan.bin

============= FINISH: 10:11:08.84 ===============

ark.zip

Attach.zip

Elise · October 21, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the Quick Scan button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

Double-click on RKUnhookerLE to run it
Click the Report tab, then click Scan
Check Drivers, Stealth and uncheck the rest
Click OK
Wait until it's finished and then go to File > Save Report
Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
RKU log

Thanks and again sorry for the delay.

bluegem · October 21, 2010

I get the following message when I click on your mirror link.

Gateway Anti-Virus Alert

This request is blocked by the SonicWALL Gateway Anti-Virus Service. Name: Emold.U (Worm)

What do I do about this? Thanks, Gregg

Elise · October 21, 2010

Which link? The OTL link or the Rootkit Unhooker link?

bluegem · October 21, 2010

The OTL

Elise · October 21, 2010

I just verified, the download is okay.

Can you temporary turn off your Antivirus before downloading this.

bluegem · October 21, 2010

Tried that and it didn't help.

bluegem · October 21, 2010

I don't think the download/link is ok. I just tried it on another computer - one with no virus or malware issues and no anitvirus turned on. I get the same response. On both computers it starts to download and when it gets to about 95% I get a red error message, then when I click on the link after that I get the message that I pasted above.

bluegem · October 21, 2010

I have attached a screen shot of the initial message that I get when I try to download OTL. After I get this message I then get the other message that I pasted in my previous response. I have searched the web for alternative links to OTL and I get the same results with all of them.

Screen_Shot.bmp

Elise · October 21, 2010

The link is okay, I can assure you, Its not recommended to try other links, since this is the only official mirror.

Can you download it on another computer and transfer it using a flashdrive?

bluegem · October 21, 2010

I tried to download it on my laptop and got the same error message.

bluegem · October 22, 2010

I have gone to another offsite computer and downloaded OTL onto a flash drive. When I try to run it off of a flas drive I get the message that OTL.EXE is not a valid win32 application.

Also I have tried to run the Rootkit Unhooker and get this message:

This site has been blocked by the network administrator.

URL: http://www.rootkit.com/vault/DiabloNova/RKUnhooker...

Block reason: Forbidden Category "Hacking/Proxy Avoidance Systems"

Please help. Thanks, Gregg

Elise · October 22, 2010

Who administers your network? If on a corporate network, best would be to ask permission before continuing here.

Many of our tools get detected by heuristic scanners because their scripting capabilities that make them extremely powerful.

Since we are dealing with bubnix, follow the steps below.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

bluegem · October 22, 2010

I downloaded and ran combofix. It never mentioned the Microsoft Recovery Console. Does that mean I already had it on my computer? There was a small box that said something about preparing backup files, then it went right to a blue screen and started the scan. After scaning for several minutes it said that it was preparing a log. Then the blue screen / program shut down. I ran it three times and still can not find a log. There is no .txt file. The last time I ran it my computer completly locked up.

Elise · October 22, 2010

Please try it like this:

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Rootkit::
C:\WINDOWS\system32\drivers\acqlbob.sys

Driver::
acqlbob

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

bluegem · October 25, 2010

Here is the combofix log. Thanks, Gregg

ComboFix 10-10-22.03 - Gregg McAlvey 10/25/2010 11:26:54.8.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2860 [GMT -4:00]

Running from: C:\Documents and Settings\Gregg McAlvey\Desktop\ComboFix.exe

Command switches used :: C:\Documents and Settings\Gregg McAlvey\Desktop\cfscript.txt

AV: McAfee Anti-Virus and Anti-Spyware *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

((((((((((((((((((((((((( Files Created from 2010-09-25 to 2010-10-25 )))))))))))))))))))))))))))))))

.

2010-10-14 13:09:26 . 2010-09-18 06:53:25 974848 ------w- C:\WINDOWS\system32\dllcache\mfc42.dll

2010-10-14 13:09:26 . 2010-09-18 06:53:25 954368 ------w- C:\WINDOWS\system32\dllcache\mfc40.dll

2010-10-14 13:09:26 . 2010-09-18 06:53:25 953856 ------w- C:\WINDOWS\system32\dllcache\mfc40u.dll

2010-10-14 13:08:08 . 2010-08-23 16:12:04 617472 ------w- C:\WINDOWS\system32\dllcache\comctl32.dll

2010-09-29 15:43:14 . 2010-09-29 15:43:15 -------- d-----w- C:\Program Files\Viewpoint

2010-09-29 15:42:54 . 2003-12-16 06:10:06 10368 ------w- C:\WINDOWS\system32\drivers\pfc.sys

2010-09-29 14:30:08 . 2010-09-29 14:30:08 -------- d-----w- C:\Program Files\PDFtoBMP

2010-09-29 14:30:08 . 2010-09-29 14:30:08 -------- d-----w- C:\Program Files\PDF to BMP

2010-09-29 14:20:43 . 2010-09-29 14:20:44 -------- d-----w- C:\Program Files\PDF to JPEG

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-18 16:23:26 . 2004-08-11 22:00:19 974848 ----a-w- C:\WINDOWS\system32\mfc42u.dll

2010-09-18 06:53:25 . 2004-08-11 22:00:19 974848 ----a-w- C:\WINDOWS\system32\mfc42.dll

2010-09-18 06:53:25 . 2004-08-11 22:00:19 954368 ----a-w- C:\WINDOWS\system32\mfc40.dll

2010-09-18 06:53:25 . 2004-08-11 22:00:19 953856 ------w- C:\WINDOWS\system32\mfc40u.dll

2010-09-10 05:58:08 . 2004-08-11 22:00:37 916480 ----a-w- C:\WINDOWS\system32\wininet.dll

2010-09-10 05:58:06 . 2004-08-11 22:00:18 43520 ----a-w- C:\WINDOWS\system32\licmgr10.dll

2010-09-10 05:58:06 . 2004-08-11 22:00:17 1469440 ------w- C:\WINDOWS\system32\inetcpl.cpl

2010-09-01 11:51:14 . 2004-08-11 22:00:01 285824 ----a-w- C:\WINDOWS\system32\atmfd.dll

2010-08-31 13:42:52 . 2004-08-11 22:00:37 1852800 ----a-w- C:\WINDOWS\system32\win32k.sys

2010-08-27 08:02:29 . 2004-08-11 22:00:35 119808 ----a-w- C:\WINDOWS\system32\t2embed.dll

2010-08-27 05:57:43 . 2004-08-11 22:00:34 99840 ----a-w- C:\WINDOWS\system32\srvsvc.dll

2010-08-26 13:39:50 . 2004-08-11 22:00:34 357248 ----a-w- C:\WINDOWS\system32\drivers\srv.sys

2010-08-26 12:52:45 . 2009-04-16 16:17:12 5120 ----a-w- C:\WINDOWS\system32\xpsp4res.dll

2010-08-24 18:57:38 . 2010-04-17 22:25:28 9344 ----a-w- C:\WINDOWS\system32\drivers\mfeclnk.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:21 84072 ----a-w- C:\WINDOWS\system32\drivers\mfetdi2k.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 95600 ----a-w- C:\WINDOWS\system32\drivers\mfeapfk.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 88544 ----a-w- C:\WINDOWS\system32\drivers\mfendisk.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 84264 ----a-w- C:\WINDOWS\system32\drivers\mferkdet.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 55840 ----a-w- C:\WINDOWS\system32\drivers\cfwids.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 52104 ----a-w- C:\WINDOWS\system32\drivers\mfebopk.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 386712 ----a-w- C:\WINDOWS\system32\drivers\mfehidk.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 312904 ----a-w- C:\WINDOWS\system32\drivers\mfefirek.sys

2010-08-24 18:57:38 . 2010-04-17 22:25:20 152992 ----a-w- C:\WINDOWS\system32\drivers\mfeavfk.sys

2010-08-23 16:12:04 . 2004-08-11 22:00:03 617472 ------w- C:\WINDOWS\system32\comctl32.dll

2010-08-17 13:17:06 . 2004-08-11 22:00:34 58880 ----a-w- C:\WINDOWS\system32\spoolsv.exe

2010-08-16 08:45:00 . 2004-08-11 22:00:29 590848 ----a-w- C:\WINDOWS\system32\rpcrt4.dll

2010-08-14 22:27:31 . 2010-07-26 16:41:30 398744 ----a-r- C:\WINDOWS\system32\cpnprt2.cid

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Pando Media Booster"="C:\Program Files\Pando Networks\Media Booster\PMB.exe" [2010-03-25 15:06:51 2937528]

"Visual Subst"="C:\Documents and Settings\Gregg McAlvey\Desktop\VSubst.exe" [2008-04-23 17:37:42 139672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 12:07:00 8491008]

"PMX Daemon"="ICO.EXE" [2006-11-08 20:01:54 49152]

"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 18:37:40 932288]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 02:04:47 35760]

"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 15:43:18 248040]

"mcui_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2010-06-25 02:32:44 1193848]

"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 06:29:02 47392]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-03-18 01:53:36 421888]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-04-28 19:06:30 142120]

"D-Link Wireless G WUA-1340"="C:\Program Files\D-Link\Wireless G WUA-1340\AirGCFG.exe" [2005-12-15 16:19:16 2715648]

"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-11-30 14:35:36 49152]

"DivXUpdate"="C:\Program Files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 20:04:06 1164584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2009-09-29 00:34:30 87352 ----a-w- C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]

2007-04-27 16:10:00 18744 ----a-w- C:\WINDOWS\system32\PCANotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk

backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2010-09-22 22:11:26 640440 ----a-w- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]

2010-09-23 08:42:13 38840 ----a-w- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-06-20 02:04:47 35760 ----a-w- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

2007-07-22 20:27:04 69632 ----a-w- C:\WINDOWS\ALCMTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12:16 15360 ------w- C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 20:24:20 54840 ----a-w- C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]

2007-05-03 21:38:26 36864 ----a-w- C:\Program Files\HP\HP UT\bin\hppusg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]

2008-10-24 14:14:36 206112 ----a-w- C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2008-10-24 14:14:36 206112 ----a-w- C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2008-10-24 14:14:38 79136 ----a-w- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-04-28 19:06:30 142120 ----a-w- C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]

2010-06-25 02:32:44 1193848 ----a-w- C:\Program Files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2007-09-17 12:07:00 8491008 ----a-w- C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMX Daemon]

2006-11-08 20:01:54 49152 ----a-w- C:\WINDOWS\system32\ico.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-18 01:53:36 421888 ----a-w- C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

2006-08-17 14:00:00 1116920 ----a-w- C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2007-07-22 20:27:12 16132608 ----a-w- C:\WINDOWS\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]

2007-03-26 16:30:12 53248 ----a-w- C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Visual Subst]

2008-04-23 17:37:42 139672 ----a-w- C:\Documents and Settings\Gregg McAlvey\Desktop\VSubst.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"C:\\Program Files\\iTunes\\iTunes.exe"=

"C:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=

"C:\\Program Files\\BitTorrent\\BitTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56983:TCP"= 56983:TCP:Pando Media Booster

"56983:UDP"= 56983:UDP:Pando Media Booster

R1 mfetdi2k;McAfee Inc. mfetdi2k;C:\WINDOWS\system32\drivers\mfetdi2k.sys [4/17/2010 6:25:21 PM 84072]

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [11/30/2009 5:42:51 PM 88176]

R2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [4/17/2010 6:25:05 PM 271480]

R2 McNaiAnn;McAfee VirusScan Announcer;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [4/17/2010 6:25:05 PM 271480]

R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [4/17/2010 6:25:34 PM 188136]

R2 mfevtp;McAfee Validation Trust Protection Service;C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [4/17/2010 6:25:23 PM 141792]

R3 cfwids;McAfee Inc. cfwids;C:\WINDOWS\system32\drivers\cfwids.sys [4/17/2010 6:25:20 PM 55840]

R3 mfefirek;McAfee Inc. mfefirek;C:\WINDOWS\system32\drivers\mfefirek.sys [4/17/2010 6:25:20 PM 312904]

R3 mfendiskmp;mfendiskmp;C:\WINDOWS\system32\drivers\mfendisk.sys [4/17/2010 6:25:20 PM 88544]

R3 pmxmouse;PMXMOUSE;C:\WINDOWS\system32\drivers\pmxmouse.sys [4/30/2008 5:47:22 PM 18432]

R3 pmxusblf;PMXUSBLF;C:\WINDOWS\system32\drivers\pmxusblf.sys [4/30/2008 5:47:22 PM 14336]

S1 efqbfwas;efqbfwas;\??\C:\WINDOWS\system32\drivers\efqbfwas.sys --> C:\WINDOWS\system32\drivers\efqbfwas.sys [?]

S1 SASDIFSV;SASDIFSV;\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS --> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS [?]

S2 gupdate;Google Update Service (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [5/18/2010 10:41:48 AM 136176]

S2 LMIInfo;LogMeIn Kernel Information Provider;\??\C:\Program Files\LogMeIn\x86\RaInfo.sys --> C:\Program Files\LogMeIn\x86\RaInfo.sys [?]

S2 NProtectService;Norton UnErase Protection;C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE --> C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE [?]

S3 GT72NDISIPXP;GT 72 IP NDIS;C:\WINDOWS\system32\drivers\Gt51Ip.sys [2/18/2008 4:14:38 PM 106624]

S3 GT72UBUS;GT 72 U BUS;C:\WINDOWS\system32\drivers\gt72ubus.sys [2/8/2008 12:00:22 PM 59648]

S3 mfendisk;McAfee Core NDIS Intermediate Filter;C:\WINDOWS\system32\drivers\mfendisk.sys [4/17/2010 6:25:20 PM 88544]

S3 mferkdet;McAfee Inc. mferkdet;C:\WINDOWS\system32\drivers\mferkdet.sys [4/17/2010 6:25:20 PM 84264]

S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\drivers\motccgp.sys [10/3/2009 11:28:46 AM 18688]

S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\drivers\motccgpfl.sys [10/3/2009 11:28:46 AM 8320]

S3 motport;Motorola USB Diagnostic Port;C:\WINDOWS\system32\drivers\motport.sys [10/3/2009 11:28:49 AM 23680]

S3 PTDLBus;PANTECH UM175AL Composite Device Driver;C:\WINDOWS\system32\drivers\PTDLBus.sys [7/2/2009 5:04:33 PM 32256]

S3 PTDLMdm;PANTECH UM175AL Drivers;C:\WINDOWS\system32\drivers\PTDLMdm.sys [7/2/2009 5:04:33 PM 41344]

S3 PTDLVsp;PANTECH UM175AL Diagnostic Port;C:\WINDOWS\system32\drivers\PTDLVsp.sys [7/2/2009 5:04:33 PM 39936]

S3 PTDLWWAN;PANTECH UM175AL WWAN Driver;C:\WINDOWS\system32\drivers\PTDLWWAN.sys [7/2/2009 5:04:33 PM 59776]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk01

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

.

Contents of the 'Scheduled Tasks' folder

2010-09-24 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34:12 . 2008-07-30 16:34:12]

2010-10-25 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-18 14:41:48 . 2010-05-18 14:41:43]

2010-10-25 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-05-18 14:41:48 . 2010-05-18 14:41:43]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: archerytalk.com\www

Trusted Zone: markelcorp.com\maicapps

Trusted Zone: watchtvsitcoms.com\www

TCP: {24542F70-8752-4DD9-A02E-FA468BB75FB0} = 192.168.1.205

DPF: {924B4927-D3BA-41EA-9F7E-8A89194AB3AC} - hxxp://panda-plugin.disney.go.com/plugin/win32/p3dactivex.cab

.

Elise · October 25, 2010

Hi, was that the complete log? It looks like the last half is missing.

bluegem · October 25, 2010

I double checked and that is all that is there.

Elise · October 25, 2010

Can you please rerun Combofix (without script) and post me the new log?

bluegem · October 25, 2010

ComboFix 10-10-24.06 - Gregg McAlvey 10/25/2010 17:52:29.9.4 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2773 [GMT -4:00]