what do i do now

waj · March 22, 2011

DDS (Ver_11-03-05.01) - NTFSx86

Run by Antony Mann at 8:48:59.92 on 22/03/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1279.445 [GMT 0:00]

.

AV: Norton 360 Premier Edition *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton 360 Premier Edition *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AskBarDis\bar\bin\AskService.exe

C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Norton 360 Premier Edition\Engine\4.3.0.5\ccSvcHst.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE

C:\Program Files\ooVoo\oovoo.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Documents and Settings\Antony Mann\My Documents\Downloads\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.co.uk/

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: ooVoo Video Chat Toolbar: {e5a1e26f-0d1d-4307-868f-fbd9a374ab54} - c:\program files\oovoo_video_chat\tbooVo.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll

BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: UrlHelper Class: {474597c5-ab09-49d6-a4d5-2e8d7341384e} - c:\progra~1\imesha~1\mediabar\datamngr\IEBHO.dll

BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360 premier edition\engine\4.3.0.5\coIEPlg.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360 premier edition\engine\4.3.0.5\IPSBHO.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\progra~1\imesha~1\mediabar\toolbar\iMeshMediaBarDx.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: ooVoo Video Chat Toolbar: {e5a1e26f-0d1d-4307-868f-fbd9a374ab54} - c:\program files\oovoo_video_chat\tbooVo.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360 premier edition\engine\4.3.0.5\coIEPlg.dll

TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\progra~1\imesha~1\mediabar\toolbar\iMeshMediaBarDx.dll

TB: ooVoo Video Chat Toolbar: {e5a1e26f-0d1d-4307-868f-fbd9a374ab54} - c:\program files\oovoo_video_chat\tbooVo.dll

TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe

uRun: [setup meet] c:\docume~1\antony~1\applic~1\mediaj~1\platform blue.exe

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\WCESCOMM.EXE"

uRun: [ooVoo.exe] c:\program files\oovoo\oovoo.exe /minimized

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

mRun: [soundMan] SOUNDMAN.EXE

mRun: [NWEReboot]

mRun: [<NO NAME>]

mRun: [blackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\deskto~1.lnk - c:\program files\research in motion\blackberry\DesktopMgr.exe

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://magnet.2020.net/virtualplanner/Core/Player/2020PlayerAX_Win32.cab

DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-GB/a-UNO1/GAME_UNO1.cab

DPF: {63F5866B-A7C5-40B4-9A89-0CCA99726C8D} - hxxps://secure.logmeinrescue.com/Customer/x86/RescueDownloader.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\aatp.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll

WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll

WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll

WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll

WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll

WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll

AppInit_DLLs: c:\progra~1\imesha~1\mediabar\datamngr\datamngr.dll c:\progra~1\imesha~1\mediabar\datamngr\IEBHO.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\antony~1\applic~1\mozilla\firefox\profiles\jsbqiwm3.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1572363&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/firefox?client=firefox-a&rls=org.mozilla:en-GB:official

FF - prefs.js: keyword.URL - hxxp://search.imesh.com/web?src=ffb&systemid=1&q=

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\coffplgn\components\coFFPlgn.dll

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\ipsffplgn\components\IPSFFPl.dll

FF - component: c:\documents and settings\antony mann\application data\mozilla\firefox\profiles\jsbqiwm3.default\extensions\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\antony mann\application data\mozilla\firefox\profiles\jsbqiwm3.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - component: c:\program files\imesh applications\mediabar\datamngr\firefoxextension\components\DataMngrHlp.dll

FF - plugin: c:\documents and settings\antony mann\application data\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\documents and settings\antony mann\application data\mozilla\plugins\np-mswmp.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\Npgfxv.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: British English Dictionary: en-GB@dictionaries.addons.mozilla.org - %profile%\extensions\en-GB@dictionaries.addons.mozilla.org

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Ask Toolbar for Firefox: {E9A1DEE0-C623-4439-8932-001E7D17607D} - %profile%\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}

FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com

FF - Ext: ooVoo Video Chat Community Toolbar: {e5a1e26f-0d1d-4307-868f-fbd9a374ab54} - %profile%\extensions\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\IPSFFPlgn

FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\coFFPlgn

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

.

============= SERVICES / DRIVERS ===============

.

R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [2010-5-31 26248]

R0 EUFS;EUFS;c:\windows\system32\drivers\eufs.sys [2010-5-31 20616]

R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [2007-12-25 15172]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0403000.005\symds.sys [2010-9-21 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0403000.005\symefa.sys [2010-9-21 173104]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\definitions\bashdefs\20110309.001\BHDrvx86.sys [2011-3-10 800376]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0403000.005\cchpx86.sys [2010-9-21 501888]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0403000.005\ironx86.sys [2010-9-21 116784]

R2 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2009-11-16 464264]

R2 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2009-11-16 234888]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-3-10 54752]

R2 KodakDigitalDisplayService;KodakDigitalDisplayService;c:\program files\kodak\digital display\orbkodaklauncher\DllStartupService.exe [2008-3-6 81920]

R2 N360;Norton 360;c:\program files\norton 360 premier edition\engine\4.3.0.5\ccsvchst.exe [2010-9-21 126392]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-7-27 102448]

R3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\drivers\EuDisk.sys [2010-5-31 122504]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\definitions\ipsdefs\20110317.005\IDSXpx86.sys [2011-3-22 341944]

R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\definitions\virusdefs\20110321.033\NAVENG.SYS [2011-3-22 86008]

R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.1.0.32\definitions\virusdefs\20110321.033\NAVEX15.SYS [2011-3-22 1360760]

S2 gupdate1ca0bb398a63984;Google Update Service (gupdate1ca0bb398a63984);c:\program files\google\update\GoogleUpdate.exe [2009-7-23 133104]

S3 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [2010-5-31 14216]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2008-4-14 13352]

S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [2009-5-10 81832]

S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [2009-5-10 13864]

S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [2009-5-10 107304]

S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [2009-5-10 99112]

S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [2009-5-10 21928]

S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [2009-5-10 97320]

S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [2009-5-10 97704]

S3 TTDec;ATI WDM Teletext Decoder (Microsoft Corporation);c:\windows\system32\drivers\atinttxx.sys [2007-11-20 13824]

.

=============== Created Last 30 ================

.

2011-03-22 00:30:15 -------- d-----w- c:\windows\system32\scripting

2011-03-22 00:30:14 -------- d-----w- c:\windows\system32\en

2011-03-22 00:30:14 -------- d-----w- c:\windows\l2schemas

2011-03-22 00:30:13 -------- d-----w- c:\windows\system32\bits

2011-03-22 00:18:22 -------- d-----w- c:\windows\EHome

2011-03-21 23:25:45 -------- d-----w- c:\docume~1\antony~1\applic~1\Malwarebytes

2011-03-21 23:25:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-21 23:25:18 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-03-21 23:25:14 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-03-21 23:25:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-03-03 21:07:08 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll

2011-03-03 21:07:08 16856 ----a-w- c:\program files\mozilla firefox\plugin-container.exe

2011-03-03 21:07:08 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

2011-03-03 21:01:07 -------- d-----w- c:\docume~1\antony~1\locals~1\applic~1\ConduitEngine

2011-03-03 21:01:04 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-03 21:01:03 -------- d-----w- c:\program files\ConduitEngine

2011-03-03 21:00:23 -------- d-----w- c:\docume~1\antony~1\applic~1\PriceGong

2011-03-03 20:46:03 -------- dc-h--w- c:\windows\ie8

.

==================== Find3M ====================

.

2011-03-22 08:45:13 256 ----a-w- c:\windows\system32\pool.bin

2011-02-14 22:42:51 256 ----a-w- c:\documents and settings\antony mann\pool.bin

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST3250620A rev.3.AAF -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A367439]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a36d7d0]; MOV EAX, [0x8a36d84c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x8A396AB8]

3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000068[0x8A3A0F18]

5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x8A417940]

\Driver\atapi[0x8A38A030] -> IRP_MJ_CREATE -> 0x8A367439

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250620A______________________________3.AAF___#5&172970ab&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

detected hooks:

\Driver\atapi DriverStartIo -> 0x8A36727F

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 8:51:37.48 ===============

ark.zip

Attach.zip

mbam-log-2011-03-21 (23-36-28).zip

LDTate · March 22, 2011

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

waj · March 22, 2011

Run date: 2011-03-22 18:30:28

-----------------------------

18:30:28.093 OS Version: Windows 5.1.2600 Service Pack 3

18:30:28.093 Number of processors: 1 586 0x40A

18:30:28.093 ComputerName: MANN-PC UserName:

18:30:29.906 Initialize success

18:30:32.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort0

18:30:32.312 Disk 0 Vendor: ST3250620A 3.AAF Size: 238475MB BusType: 3

18:30:32.312 Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250620A______________________________3.AAF___#5&172970ab&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found

18:30:32.312 Device \Driver\atapi -> DriverStartIo 8a36727f

18:30:34.343 Disk 0 MBR read successfully

18:30:34.343 Disk 0 MBR scan

18:30:34.343 Disk 0 TDL4@MBR code has been found

18:30:34.343 Disk 0 MBR hidden

18:30:34.343 Disk 0 MBR [TDL4] **ROOTKIT**

18:30:34.343 Disk 0 trace - called modules:

18:30:34.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a367439]<<

18:30:34.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a396ab8]

18:30:34.343 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000068[0x8a3a0f18]

18:30:34.343 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> [0x8a417940]

18:30:34.671 \Driver\atapi[0x8a38a030] -> IRP_MJ_CREATE -> 0x8a367439

18:30:34.671 Scan finished successfully

LDTate · March 22, 2011

FIX

Re-Run aswMBR

Click Scan

On completion of the scan

Click the Fix for TDL4 or FIXMBR for Whistler Button Select as appropriate

Save the log as before and post in your next reply

waj · March 22, 2011

I pressed the fixmbr button, not sure if anything happened but this is the log

Run date: 2011-03-22 20:34:59

-----------------------------

20:34:59.093 OS Version: Windows 5.1.2600 Service Pack 3

20:34:59.093 Number of processors: 1 586 0x40A

20:34:59.093 ComputerName: MANN-PC UserName:

20:35:01.906 Initialze error - driver not loaded

LDTate · March 22, 2011

Try it again

waj · March 22, 2011

The same thing is happening or not happening when I press the button

LDTate · March 22, 2011

You have TDL4 so you need to use the Fix button, not the FixMBR button

waj · March 22, 2011

the fix button is not highlighted, I tried clicking it but nothing happens

LDTate · March 22, 2011

Run a new Scan

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

waj · March 22, 2011

sorry i was opening it up again rather than using the existing scan logs,

Here are the logs

Run date: 2011-03-22 18:30:28

-----------------------------

18:30:28.093 OS Version: Windows 5.1.2600 Service Pack 3

18:30:28.093 Number of processors: 1 586 0x40A

18:30:28.093 ComputerName: MANN-PC UserName:

18:30:29.906 Initialize success

18:30:32.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort0

18:30:32.312 Disk 0 Vendor: ST3250620A 3.AAF Size: 238475MB BusType: 3

18:30:32.312 Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskST3250620A______________________________3.AAF___#5&172970ab&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found

18:30:32.312 Device \Driver\atapi -> DriverStartIo 8a36727f

18:30:34.343 Disk 0 MBR read successfully

18:30:34.343 Disk 0 MBR scan

18:30:34.343 Disk 0 TDL4@MBR code has been found

18:30:34.343 Disk 0 MBR hidden

18:30:34.343 Disk 0 MBR [TDL4] **ROOTKIT**

18:30:34.343 Disk 0 trace - called modules:

18:30:34.343 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8a367439]<<

18:30:34.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a396ab8]

18:30:34.343 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\00000068[0x8a3a0f18]

18:30:34.343 5 ACPI.sys[b9f7f620] -> nt!IofCallDriver -> [0x8a417940]

18:30:34.671 \Driver\atapi[0x8a38a030] -> IRP_MJ_CREATE -> 0x8a367439

18:30:34.671 Scan finished successfully

20:50:20.750 Disk 0 fixing MBR

20:50:30.750 Disk 0 MBR restored successfully

20:50:30.750 Infection fixed successfully - please reboot ASAP

LDTate · March 22, 2011

Reboot and let me know how it's running.

waj · March 22, 2011

will do should i re enable the cd

LDTate · March 22, 2011

will do should i re enable the cd

Not yet.....

waj · March 22, 2011

it seems better at the moment

LDTate · March 22, 2011

What issues were you having?

waj · March 22, 2011

I am constantly getting a pop up alert message from norton telling me a recent attempt to attack your computer was blocked this is slowing up my computer, at one point the clock changed time and the appearance of the bar at the bottom of the screen had changed it also changed web pages that I was looking at and at one point the computer just re booted itself without me doing anything. When I went onto the details on norton it said IPS detection statistical submission and the 2 IP addresses were 194.60.205.232 and 68.168.212.18

I am really grateful for all your help

LDTate · March 22, 2011

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

waj · March 22, 2011

At the moment it all seems ok, can I reconnect my norton

ComboFix 11-03-22.03 - Antony Mann 22/03/2011 21:38:40.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1279.523 [GMT 0:00]

Running from: c:\documents and settings\Antony Mann\Desktop\ComboFix.exe

AV: Norton 360 Premier Edition *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton 360 Premier Edition *Disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Antony Mann\Application Data\Adobe\plugs

c:\documents and settings\Antony Mann\Application Data\PriceGong

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Antony Mann\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Antony Mann\Favorites\Download programs.url

c:\documents and settings\Antony Mann\Favorites\Games.url

c:\documents and settings\Antony Mann\Favorites\Translator.url

c:\documents and settings\Antony Mann\Favorites\Videos.url

c:\documents and settings\Antony Mann\g2mdlhlpx.exe

c:\documents and settings\Antony Mann\GoToAssistDownloadHelper.exe

c:\documents and settings\Antony Mann\Start Menu\Programs\Download programs.url

c:\documents and settings\Antony Mann\Start Menu\Programs\Games.url

c:\documents and settings\Antony Mann\Start Menu\Programs\Translator.url

c:\documents and settings\Antony Mann\Start Menu\Programs\Videos.url

.

((((((((((((((((((((((((( Files Created from 2011-02-22 to 2011-03-22 )))))))))))))))))))))))))))))))

.

2011-03-22 00:30 . 2011-03-22 00:30 -------- d-----w- c:\windows\system32\scripting

2011-03-22 00:30 . 2011-03-22 00:30 -------- d-----w- c:\windows\l2schemas

2011-03-22 00:30 . 2011-03-22 00:30 -------- d-----w- c:\windows\system32\en

2011-03-22 00:30 . 2011-03-22 00:30 -------- d-----w- c:\windows\system32\bits

2011-03-22 00:18 . 2011-03-22 00:18 -------- d-----w- c:\windows\EHome

2011-03-21 23:25 . 2011-03-21 23:25 -------- d-----w- c:\documents and settings\Antony Mann\Application Data\Malwarebytes

2011-03-21 23:25 . 2010-12-20 18:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-21 23:25 . 2011-03-21 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-03-21 23:25 . 2011-03-21 23:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-03-21 23:25 . 2010-12-20 18:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-03-21 19:37 . 2011-03-21 19:37 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer

2011-03-21 18:35 . 2011-03-21 18:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Identities

2011-03-21 00:50 . 2011-03-21 00:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2011-03-19 19:15 . 2011-03-19 19:15 -------- d-----w- c:\documents and settings\James Mann\Application Data\Research In Motion

2011-03-03 21:07 . 2011-03-05 17:39 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe

2011-03-03 21:07 . 2011-03-05 17:39 25048 ----a-w- c:\program files\Mozilla Firefox\components\browserdirprovider.dll

2011-03-03 21:07 . 2011-03-05 17:39 140248 ----a-w- c:\program files\Mozilla Firefox\components\brwsrcmp.dll

2011-03-03 21:01 . 2011-03-21 22:29 -------- d-----w- c:\documents and settings\Antony Mann\Local Settings\Application Data\ConduitEngine

2011-03-03 21:01 . 2011-03-03 21:01 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-03 21:01 . 2011-03-03 21:01 -------- d-----w- c:\program files\ConduitEngine

2011-03-03 20:46 . 2011-03-03 20:47 -------- dc-h--w- c:\windows\ie8

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-14 22:42 . 2011-02-02 22:52 256 ----a-w- c:\documents and settings\Antony Mann\pool.bin

2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

1997-07-25 17:11 . 2009-11-04 15:50 304128 ----a-w- c:\program files\mozilla firefox\plugins\Pngdll.dll

2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}"= "c:\program files\ooVoo_Video_Chat\tbooVo.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2009-04-02 12:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]

2010-09-07 06:23 585096 ----a-w- c:\progra~1\IMESHA~1\MediaBar\Datamngr\IEBHO.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}]

2009-11-20 17:34 87472 ----a-w- c:\progra~1\IMESHA~1\MediaBar\ToolBar\iMeshMediaBarDx.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}]

2010-12-09 12:51 3911776 ----a-w- c:\program files\ooVoo_Video_Chat\tbooVo.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

"{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\progra~1\IMESHA~1\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472]

"{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}"= "c:\program files\ooVoo_Video_Chat\tbooVo.dll" [2010-12-09 3911776]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

.

[HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}]

.

[HKEY_CLASSES_ROOT\clsid\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{E5A1E26F-0D1D-4307-868F-FBD9A374AB54}"= "c:\program files\ooVoo_Video_Chat\tbooVo.dll" [2010-12-09 3911776]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]

.

[HKEY_CLASSES_ROOT\clsid\{e5a1e26f-0d1d-4307-868f-fbd9a374ab54}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-28 68856]

"ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2011-01-25 22504120]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2003-08-05 57344]

"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-21 615696]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-28 68856]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2008-9-21 1545488]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=

"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"443:TCP"= 443:TCP:ooVoo TCP port 443

"443:UDP"= 443:UDP:ooVoo UDP port 443

"37674:TCP"= 37674:TCP:ooVoo TCP port 37674

"37674:UDP"= 37674:UDP:ooVoo UDP port 37674

"37675:UDP"= 37675:UDP:ooVoo UDP port 37675

.

R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [5/31/2010 8:42 PM 26248]

R0 EUFS;EUFS;c:\windows\system32\drivers\eufs.sys [5/31/2010 8:42 PM 20616]

R0 PzWDM;PzWDM;c:\windows\system32\drivers\PzWDM.sys [12/25/2007 8:26 AM 15172]

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0403000.005\symds.sys [9/21/2010 9:09 PM 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0403000.005\symefa.sys [9/21/2010 9:09 PM 173104]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\BASHDefs\20110309.001\BHDrvx86.sys [3/10/2011 9:17 PM 800376]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0403000.005\cchpx86.sys [9/21/2010 9:09 PM 501888]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0403000.005\ironx86.sys [9/21/2010 9:09 PM 116784]

R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [11/16/2009 6:45 PM 464264]

R2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11/16/2009 6:46 PM 234888]

R2 KodakDigitalDisplayService;KodakDigitalDisplayService;c:\program files\KODAK\Digital Display\OrbKodakLauncher\DllStartupService.exe [3/6/2008 12:49 PM 81920]

R2 N360;Norton 360;c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\ccsvchst.exe [9/21/2010 9:09 PM 126392]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/27/2010 8:18 AM 102448]

R3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\drivers\EuDisk.sys [5/31/2010 8:42 PM 122504]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\Definitions\IPSDefs\20110317.005\IDSXpx86.sys [3/22/2011 8:07 AM 341944]

S2 gupdate1ca0bb398a63984;Google Update Service (gupdate1ca0bb398a63984);c:\program files\Google\Update\GoogleUpdate.exe [7/23/2009 4:35 PM 133104]

S3 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [5/31/2010 8:42 PM 14216]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [4/14/2008 8:45 PM 13352]

S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\drivers\s816bus.sys [5/10/2009 3:20 PM 81832]

S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\drivers\s816mdfl.sys [5/10/2009 3:47 PM 13864]

S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\drivers\s816mdm.sys [5/10/2009 3:47 PM 107304]

S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s816mgmt.sys [5/10/2009 3:47 PM 99112]

S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\drivers\s816nd5.sys [5/10/2009 3:47 PM 21928]

S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\drivers\s816obex.sys [5/10/2009 3:47 PM 97320]

S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\drivers\s816unic.sys [5/10/2009 3:47 PM 97704]

S3 TTDec;ATI WDM Teletext Decoder (Microsoft Corporation);c:\windows\system32\drivers\atinttxx.sys [11/20/2007 11:30 AM 13824]

.

Contents of the 'Scheduled Tasks' folder

.

2011-03-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]

.

2011-03-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-23 16:35]

.

2011-03-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-23 16:35]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.uk/

uInternet Settings,ProxyOverride = *.local

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

DPF: {63F5866B-A7C5-40B4-9A89-0CCA99726C8D} - hxxps://secure.logmeinrescue.com/Customer/x86/RescueDownloader.cab

FF - ProfilePath - c:\documents and settings\Antony Mann\Application Data\Mozilla\Firefox\Profiles\jsbqiwm3.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1572363&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/firefox?client=firefox-a&rls=org.mozilla:en-GB:official

FF - prefs.js: keyword.URL - hxxp://search.imesh.com/web?src=ffb&systemid=1&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: British English Dictionary: en-GB@dictionaries.addons.mozilla.org - %profile%\extensions\en-GB@dictionaries.addons.mozilla.org

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Ask Toolbar for Firefox: {E9A1DEE0-C623-4439-8932-001E7D17607D} - %profile%\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\IPSFFPlgn

FF - Ext: Norton Toolbar: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.1.0.32\coFFPlgn

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

HKCU-Run-setup meet - c:\docume~1\ANTONY~1\APPLIC~1\MEDIAJ~1\platform blue.exe

HKLM-Run-NWEReboot - (no file)

AddRemove-conduitEngine - c:\progra~1\CONDUI~1\ConduitEngineUninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-03-22 21:53

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360 Premier Edition\Engine\4.3.0.5\diMaster.dll\" /prefetch:1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(4028)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll

c:\program files\Common Files\Ahead\Lib\NeroSearchTrayHook.dll

c:\program files\Common Files\Ahead\Lib\MFC71U.DLL

c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\SOUNDMAN.EXE

c:\program files\Microsoft ActiveSync\WCESCOMM.EXE

c:\program files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe

c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2011-03-22 22:01:13 - machine was rebooted

ComboFix-quarantined-files.txt 2011-03-22 22:00

.

Pre-Run: 158,271,234,048 bytes free

Post-Run: 158,410,153,984 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 714927BAF6DEAEBAC74BBFB67CF13275

LDTate · March 22, 2011

1.Click Start > Settings > Control Panel.

2.Next, open Add/Remove Programs and remove if listed:

AskBarDis

ConduitEngine

MediaBar

After the above:

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7

Click START Search
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good

Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to Prompt
6. Change the Download unsigned ActiveX controls to Disable
7. Change the Initialize and script ActiveX controls not marked as safe to Disable
8. Change the Installation of desktop items to Prompt
9. Change the Launching programs and files in an IFRAME to Prompt
10. Change the Navigate sub-frames across different domains to Prompt
11. When all these settings have been made, click on the OK button.
12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
13. Next press the Apply button and then the OK to exit the Internet Properties page.
[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
[*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.
[*] JAVA Click this link and click on the Free JAVA Download
[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.

We use different ways of protecting your computer(s):

Dynamically Blocks Malware Sites & Servers
Malware Execution Prevention

Save yourself the hassle and get protected.

waj · March 22, 2011

after re enable the emulation devices in defogger it doesnt ask me to re boot should i do it manually

waj · March 22, 2011

the de fogger program does not say it is going to reboot it shows an error message should i re boot manually

defogger_enable by jpshortstuff (23.02.10.1)

Log created at 22:38 on 22/03/2011 (Antony Mann)

Parsing file...

-=E.O.F=-

LDTate · March 22, 2011

Please don't PM me every time you post to your topic. I get email notifications when you post

Download it again, install, then uninstall

waj · March 22, 2011

sorry about the PM's can you re send the defogger link please

LDTate · March 22, 2011

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

what do i do now

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information