Dropper Trojan won't go away :(

YvesAdeleHarlow · March 27, 2011

I have the full version of Malwarebytes' which is doing a grand job of keeping me safe, but it's having to "[block] access to a potentially malicious website" every few seconds!

I've attached zipped versions of attach.txt and ark.txt (the DDS/GMER log files?)in "Attach.zip".

I've also attached a zipped version of the Malwarebytes' protection-log "mbam-protection-log-2011-03-27.zip", in case that helps.

The contents of 'DDS.txt' is posted below, as is the the most recent Malwarebytes' Anti-Malware log file.

Am I doing this right??

I'd really appreciate someone helping me get rid of this

Yves

--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by John Moulsher at 16:34:00.70 on 26/03/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1535.572 [GMT 0:00]

.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: ZoneAlarm Firewall *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Webroot\Washer\WasherSvc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Webroot\Washer\wwDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\TimeLeft3\TimeLeft.exe

C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\John Moulsher\Desktop\Defogger.exe

C:\Documents and Settings\John Moulsher\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = https://vle.dmu.ac.uk/webapps/login/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZon1.dll

uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZon1.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll

BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome frame\application\10.0.648.204\npchrome_frame.dll

TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll

TB: ZoneAlarm Toolbar: {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - c:\program files\zonealarm\tbZon1.dll

TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll

TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

uRun: [Window Washer] c:\program files\webroot\washer\wwDisp.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

mRun: [soundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe

mRun: [soundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray

mRun: [Easy-PrintToolBox] c:\program files\canon\easy-printtoolbox\BJPSMAIN.EXE /logon

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"

mRun: [iSW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon="hidden"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\johnmo~1\startm~1\programs\startup\timeleft.lnk - c:\program files\timeleft3\TimeLeft.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/download/ipixx.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155661744578

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\10.0.648.204\npchrome_frame.dll

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\johnmo~1\applic~1\mozilla\firefox\profiles\v1blcinb.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Thesaurus - Reference.com

FF - prefs.js: browser.startup.homepage - hxxp://uk.weather.com/weather/hourByHour-Bedworth-CV12|http://news.bbc.co.uk/weather/forecast/4277?area=CV12|http://www.metoffice.gov.uk/weather/uk/wm/nuneaton_forecast_weather.html|http://www.google.co.uk/

FF - component: c:\program files\checkpoint\zaforcefield\trustchecker\components\TrustCheckerMozillaPlugin.dll

FF - component: c:\program files\mozilla firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}\components\TextAloud3Adapter.dll

FF - plugin: c:\documents and settings\john moulsher\application data\mozilla\firefox\profiles\v1blcinb.default\extensions\{195a3098-0bd5-4e90-ae22-ba1c540afd1e}\plugins\npGarmin.dll

FF - plugin: c:\documents and settings\john moulsher\application data\mozilla\firefox\profiles\v1blcinb.default\extensions\turntoolviewer@turntool.com\plugins\nptnt.dll

FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NpIpx32.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPZoneSB.dll

FF - plugin: c:\program files\musicnotes\npmusicn.dll

FF - plugin: c:\program files\musicnotes\NPSibelius.dll

FF - plugin: c:\program files\real\realplayer enterprise\netscape6\nprjplug.dll

FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: TextAloud 3 Toolbar: {99a0337c-6303-4879-b72e-500fd9aaca8c} - c:\program files\mozilla firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\checkpoint\zaforcefield\TrustChecker

FF - Ext: XULRunner: {65FA47D9-2181-49F6-9870-36CD6655535B} - c:\documents and settings\john moulsher\local settings\application data\{65FA47D9-2181-49F6-9870-36CD6655535B}

FF - Ext: Black Stratini: {b41cb5f0-2e52-11de-8c30-0800200c9a66} - %profile%\extensions\{b41cb5f0-2e52-11de-8c30-0800200c9a66}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: AthensToolbar: {B22E157D-283C-498f-9554-C3A80E841E91} - %profile%\extensions\{B22E157D-283C-498f-9554-C3A80E841E91}

FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF - Ext: TurnTool Viewer: turntoolviewer@turntool.com - %profile%\extensions\turntoolviewer@turntool.com

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-4 64288]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 165264]

R1 MpKsl5c185230;MpKsl5c185230;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{589510c5-8b6d-48e3-8923-a31a3f82f942}\MpKsl5c185230.sys [2011-3-26 28752]

R1 MpKslbba5ab7e;MpKslbba5ab7e;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{589510c5-8b6d-48e3-8923-a31a3f82f942}\MpKslbba5ab7e.sys [2011-3-26 28752]

R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-5-6 532224]

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2010-5-26 26352]

R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2010-5-26 493032]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-8-12 1405384]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-3-26 363344]

R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2007-8-14 598856]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-3-26 20952]

S0 78456144;78456144;c:\windows\system32\drivers\78456144.sys --> c:\windows\system32\drivers\78456144.sys [?]

S1 bcbus;BestCrypt bus driver;c:\windows\system32\drivers\bcbus.sys --> c:\windows\system32\drivers\bcbus.sys [?]

S1 MpKsl4108c99f;MpKsl4108c99f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2da09fb4-ddab-4afd-bbfb-2c5e98575f61}\mpksl4108c99f.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2da09fb4-ddab-4afd-bbfb-2c5e98575f61}\MpKsl4108c99f.sys [?]

S1 MpKsl4112c33c;MpKsl4112c33c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\mpksl4112c33c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\MpKsl4112c33c.sys [?]

S1 MpKslc95ddd29;MpKslc95ddd29;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\mpkslc95ddd29.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\MpKslc95ddd29.sys [?]

S1 MpKslf18ef027;MpKslf18ef027;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\mpkslf18ef027.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b1f100a7-510c-43ed-9505-fc173df6ffb6}\MpKslf18ef027.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-10-13 136176]

S2 lcodk;Windows Autenthification Service;c:\windows\system32\lcodk.exe [2011-3-26 18944]

S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [2010-6-8 25728]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-12 15232]

S3 qcusbser;Huawei USB Device for Legacy Serial Communication;c:\windows\system32\drivers\hwusbser.sys [2010-6-8 105856]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\screamingbaudio.sys [2008-5-16 23064]

.

=============== File Associations ===============

.

scrfile="%1" %*

.txt=

.

=============== Created Last 30 ================

.

2011-03-26 16:12:16 18944 ----a-w- c:\windows\system32\lcodk.exe

2011-03-26 16:05:11 28752 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{589510c5-8b6d-48e3-8923-a31a3f82f942}\MpKsl5c185230.sys

2011-03-26 15:51:02 28752 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{589510c5-8b6d-48e3-8923-a31a3f82f942}\MpKslbba5ab7e.sys

2011-03-26 09:55:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-26 09:55:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-03-21 19:58:15 -------- d-----w- c:\windows\tmp

2011-03-20 23:44:55 5943120 ----a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{589510c5-8b6d-48e3-8923-a31a3f82f942}\mpengine.dll

2011-03-18 16:01:19 0 ----a-w- c:\windows\Yzeretuguze.bin

2011-03-18 16:01:17 -------- d-----w- c:\docume~1\johnmo~1\locals~1\applic~1\{65FA47D9-2181-49F6-9870-36CD6655535B}

2011-03-12 12:28:40 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2011-03-12 12:28:40 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2011-03-12 12:02:03 -------- d-----w- c:\docume~1\johnmo~1\locals~1\applic~1\Spotify

2011-03-12 12:02:03 -------- d-----w- c:\docume~1\johnmo~1\applic~1\Spotify

2011-03-12 12:01:36 -------- d-----w- c:\program files\Spotify

2011-03-08 17:58:32 -------- d-----w- c:\docume~1\johnmo~1\applic~1\GrabIt

2011-03-08 17:56:57 -------- d-----w- c:\program files\GrabIt

2011-03-04 11:51:54 -------- d-----w- c:\program files\NPL

2011-03-04 11:51:29 299520 ----a-w- c:\windows\uninst.exe

2011-03-04 11:50:53 -------- d-----w- c:\documents and settings\john moulsher\WINDOWS

2011-02-27 18:01:31 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-02-26 12:58:41 -------- d-----w- c:\docume~1\johnmo~1\locals~1\applic~1\PhoenixViewer

2011-02-26 12:55:56 -------- d-----w- c:\program files\Phoenix Viewer

.

==================== Find3M ====================

.

2011-02-20 16:49:26 323624 ----a-w- c:\windows\system32\wiaaut.dll

2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-08 12:55:21 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 16:36:11.10 ===============

--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6173

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

26/03/2011 15:48:53

mbam-log-2011-03-26 (15-48-53).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 255550

Time elapsed: 1 hour(s), 55 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gregew (Trojan.Dropper) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\gregew.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\system volume information\_restore{c1db4b3b-0bcc-463c-8da2-52b9fa8499f1}\RP274\A0085416.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Attach.zip

mbam-protection-log-2011-03-27.zip

LDTate · March 27, 2011

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Looks like you're running 2 anti-virus programs.

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!

The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.

Also because more than one Antivirus and Firewall installed are not compatible with each other, it can cause system performance problems and a serious system slowdown.

Please do not delete anything unless instructed to.

1.Click Start > Settings > Control Panel.

2.Next, open Add/Remove Programs and remove either:

Lavasoft

Microsoft Security Essentials

Only after the above:

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

YvesAdeleHarlow · March 27, 2011

Please don't attach the scans / logs for these tools, use "copy/paste".
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")
Stay with this topic until I give you the all clean post.
You might want to print these instructions out.
Looks like you're running 2 anti-virus programs.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!
The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.
Also because more than one Antivirus and Firewall installed are not compatible with each other, it can cause system performance problems and a serious system slowdown.
Please do not delete anything unless instructed to.
1.Click Start > Settings > Control Panel.
2.Next, open Add/Remove Programs and remove either:
Lavasoft
Microsoft Security Essentials
Only after the above:
Download aswMBR.exe ( 511KB ) to your desktop.
Double click the aswMBR.exe to run it
Click the "Scan" button to start scan
On completion of the scan click save log, save it to your desktop and post in your next reply

Thanks LDTate - I'm grateful for your assistance,

I didn't realise that Lavasoft Ad-Watch Live was an antivirus, I just thought it was part of Ad-Aware anti-spyware. I've disabled the real-time protection (the antivirus bit) and according to Process Exporer there are now no Ad-Aware processes running - will that do the trick?

Please find the aswMBR scan log below...

Run date: 2011-03-27 17:22:37

-----------------------------

17:22:37.015 OS Version: Windows 5.1.2600 Service Pack 3

17:22:37.015 Number of processors: 2 586 0x209

17:22:37.015 ComputerName: MOULSHER UserName:

17:22:37.828 Initialize success

17:22:53.546 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

17:22:53.562 Disk 0 Vendor: Maxtor_6Y080L0 YAR41BW0 Size: 78167MB BusType: 3

17:22:55.562 Disk 0 MBR read successfully

17:22:55.562 Disk 0 MBR scan

17:22:57.578 Disk 0 scanning sectors +160071660

17:22:57.609 Disk 0 scanning C:\WINDOWS\system32\drivers

17:23:11.203 Service scanning

17:23:12.484 Disk 0 trace - called modules:

17:23:12.500 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys PCIIDEX.SYS

17:23:12.500 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a21dab8]

17:23:12.515 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000006f[0x8a254510]

17:23:12.531 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a21f940]

17:23:12.531 Scan finished successfully

LDTate · March 27, 2011

No RootKit present

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

YvesAdeleHarlow · March 28, 2011

Done that LDTate,

Scan results from Combofix pasted below...

As far as behaviour, Malwarebytes' is still having to block outgoing access to to a potentially malicious website, the ip address always being either 91.200.240.37 or 91.200.240.40. This is happening every few seconds, see Screen shot.png attached...

Also, and I've no idea if this is relevant, but I can't turn Windows Automatic Updates back on - it doesn't even appear in the Services window. Might this have something to do with rolling back use the XP SP2 package?

I'm starting to panic a bit now.

Yves

--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---

ComboFix 11-03-27.01 - John Moulsher 28/03/2011 16:27:40.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.1535.844 [GMT 1:00]

Running from: c:\documents and settings\John Moulsher\Desktop\ComboFix.exe

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

AV: Microsoft Security Essentials *Disabled/Outdated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Previous Run -------

.

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\1.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\a.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\b.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\c.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\d.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\e.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\f.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\g.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\h.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\i.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\J.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\k.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\l.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\m.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\n.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\o.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\p.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\q.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\r.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\s.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\t.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\u.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\v.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\w.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\x.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\y.xml

c:\documents and settings\John Moulsher\Application Data\PriceGong\Data\z.xml

c:\documents and settings\John Moulsher\Local Settings\Application Data\{65FA47D9-2181-49F6-9870-36CD6655535B}\chrome.manifest

c:\documents and settings\John Moulsher\Local Settings\Application Data\{65FA47D9-2181-49F6-9870-36CD6655535B}\chrome\content\_cfg.js

c:\documents and settings\John Moulsher\Local Settings\Application Data\{65FA47D9-2181-49F6-9870-36CD6655535B}\chrome\content\overlay.xul

c:\documents and settings\John Moulsher\Local Settings\Application Data\{65FA47D9-2181-49F6-9870-36CD6655535B}\install.rdf

c:\documents and settings\John Moulsher\Local Settings\Application Data\mxy.exe

c:\documents and settings\John Moulsher\Start Menu\Programs\System Tool\System Tool 2011.lnk

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\system32\ccrpTmr6.dll

c:\windows\system32\Thumbs.db

.

((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-28 )))))))))))))))))))))))))))))))

.

2011-03-28 04:44 . 2011-03-28 04:44 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{589510C5-8B6D-48E3-8923-A31A3F82F942}\MpKslac292fdc.sys

2011-03-26 16:12 . 2011-03-26 16:12 18944 ----a-w- c:\windows\system32\lcodk.exe

2011-03-26 09:55 . 2010-12-20 18:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-26 09:55 . 2010-12-20 18:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-03-21 19:58 . 2011-03-21 19:58 -------- d-----w- c:\windows\tmp

2011-03-20 23:44 . 2011-02-11 06:54 5943120 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{589510C5-8B6D-48E3-8923-A31A3F82F942}\mpengine.dll

2011-03-18 16:01 . 2011-03-18 16:01 0 ----a-w- c:\windows\Yzeretuguze.bin

2011-03-12 12:28 . 2011-03-12 12:28 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2011-03-12 12:28 . 2011-03-12 12:28 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

2011-03-12 12:02 . 2011-03-26 18:23 -------- d-----w- c:\documents and settings\John Moulsher\Application Data\Spotify

2011-03-12 12:02 . 2011-03-26 18:19 -------- d-----w- c:\documents and settings\John Moulsher\Local Settings\Application Data\Spotify

2011-03-12 12:01 . 2011-03-12 12:02 -------- d-----w- c:\program files\Spotify

2011-03-08 17:58 . 2011-03-08 22:07 -------- d-----w- c:\documents and settings\John Moulsher\Application Data\GrabIt

2011-03-08 17:56 . 2011-03-08 17:57 -------- d-----w- c:\program files\GrabIt

2011-03-04 11:51 . 2011-03-04 11:51 -------- d-----w- c:\program files\NPL

2011-03-04 11:51 . 1997-01-18 11:40 299520 ----a-w- c:\windows\uninst.exe

2011-03-04 11:50 . 2011-03-04 11:50 -------- d-----w- c:\documents and settings\John Moulsher\WINDOWS

2011-02-27 18:01 . 2011-02-27 18:01 -------- d--h--w- c:\windows\system32\GroupPolicy

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-20 16:49 . 2011-02-20 16:49 323624 ----a-w- c:\windows\system32\wiaaut.dll

2011-02-11 06:54 . 2010-03-13 15:18 5943120 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-02-08 12:55 . 2009-08-04 19:53 16432 ----a-w- c:\windows\system32\lsdelete.exe

2000-06-05 16:47 . 2007-08-23 17:16 32768 ----a-w- c:\program files\mozilla firefox\plugins\AppSub32.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZon1.dll" [2010-08-23 2734688]

"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

.

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

2010-08-23 13:04 2734688 ----a-w- c:\program files\ZoneAlarm\tbZon1.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

2010-12-09 12:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTor.dll

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZon1.dll" [2010-08-23 2734688]

"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]

.

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

.

[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-11-26 1206600]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]

"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-03 13508608]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-03 86016]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]

"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2010-05-26 730600]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2004-08-03 53760]

.

c:\documents and settings\John Moulsher\Start Menu\Programs\Startup\

TimeLeft.lnk - c:\program files\TimeLeft3\TimeLeft.exe [2009-1-16 2022072]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ 'autocheck autochk *'\0lsdelete

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^tabtrax.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\tabtrax.lnk

backup=c:\windows\pss\tabtrax.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^John Moulsher^Start Menu^Programs^Startup^BBC iPlayer Desktop.lnk]

path=c:\documents and settings\John Moulsher\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk

backup=c:\windows\pss\BBC iPlayer Desktop.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-01-31 08:44 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 17:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [04/08/2009 20:05 64288]

R1 MpKslac292fdc;MpKslac292fdc;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{589510C5-8B6D-48E3-8923-A31A3F82F942}\MpKslac292fdc.sys [28/03/2011 05:44 28752]

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [26/05/2010 14:35 26352]

R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [26/05/2010 14:35 493032]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [26/03/2011 10:55 363344]

R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [14/08/2007 01:14 598856]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [26/03/2011 10:55 20952]

S0 78456144;78456144;c:\windows\system32\drivers\78456144.sys --> c:\windows\system32\drivers\78456144.sys [?]

S1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys --> c:\windows\system32\DRIVERS\bcbus.sys [?]

S1 MpKsl4108c99f;MpKsl4108c99f;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2DA09FB4-DDAB-4AFD-BBFB-2C5E98575F61}\MpKsl4108c99f.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2DA09FB4-DDAB-4AFD-BBFB-2C5E98575F61}\MpKsl4108c99f.sys [?]

S1 MpKsl4112c33c;MpKsl4112c33c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKsl4112c33c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKsl4112c33c.sys [?]

S1 MpKslc95ddd29;MpKslc95ddd29;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKslc95ddd29.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKslc95ddd29.sys [?]

S1 MpKslf18ef027;MpKslf18ef027;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKslf18ef027.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B1F100A7-510C-43ED-9505-FC173DF6FFB6}\MpKslf18ef027.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [13/10/2010 16:07 136176]

S2 lcodk;Windows Autenthification Service;c:\windows\system32\lcodk.exe [26/03/2011 17:12 18944]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 20:19 13592]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\androidusb.sys [08/06/2010 07:53 25728]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [12/08/2010 13:15 1405384]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [12/08/2010 13:15 15232]

S3 qcusbser;Huawei USB Device for Legacy Serial Communication;c:\windows\system32\drivers\hwusbser.sys [08/06/2010 07:53 105856]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\screamingbaudio.sys [16/05/2008 14:00 23064]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MPKSLAC292FDC

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

.

Contents of the 'Scheduled Tasks' folder

.

2011-03-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 13:06]

.

2011-03-22 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

2011-03-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-13 15:07]

.

2011-03-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-13 15:07]

.

2011-03-27 c:\windows\Tasks\SmartDefrag.job

- c:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-12-03 17:08]

.

------- Supplementary Scan -------

.

uStart Page = https://vle.dmu.ac.uk/webapps/login/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

FF - ProfilePath - c:\documents and settings\John Moulsher\Application Data\Mozilla\Firefox\Profiles\v1blcinb.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2611275&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Thesaurus - Reference.com

FF - prefs.js: browser.startup.homepage - hxxp://uk.weather.com/weather/hourByHour-Bedworth-CV12|http://news.bbc.co.uk/weather/forecast/4277?area=CV12|http://www.metoffice.gov.uk/weather/uk/wm/nuneaton_forecast_weather.html|http://www.google.co.uk/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: TextAloud 3 Toolbar: {99a0337c-6303-4879-b72e-500fd9aaca8c} - c:\program files\Mozilla Firefox\extensions\{99a0337c-6303-4879-b72e-500fd9aaca8c}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: ZoneAlarm Security Engine: {FFB96CC1-7EB3-449D-B827-DB661701C6BB} - c:\program files\CheckPoint\ZAForceField\TrustChecker

FF - Ext: Black Stratini: {b41cb5f0-2e52-11de-8c30-0800200c9a66} - %profile%\extensions\{b41cb5f0-2e52-11de-8c30-0800200c9a66}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: AthensToolbar: {B22E157D-283C-498f-9554-C3A80E841E91} - %profile%\extensions\{B22E157D-283C-498f-9554-C3A80E841E91}

FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF - Ext: TurnTool Viewer: turntoolviewer@turntool.com - %profile%\extensions\turntoolviewer@turntool.com

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

------- File Associations -------

.

.txt=

.

- - - - ORPHANS REMOVED - - - -

.

Notify-dimsntfy - (no file)

Notify-NavLogon - (no file)

MSConfigStartUp-Acrobat Assistant 8 - c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-03-28 16:44

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Cryptography\RNG*]

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,

bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(824)

c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

.

- - - - - - - > 'lsass.exe'(880)

c:\windows\system32\wininet.dll

c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

.

- - - - - - - > 'explorer.exe'(3588)

c:\windows\system32\WININET.dll

c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

- - - - - - - > 'csrss.exe'(796)

c:\windows\system32\wininet.dll

.

Completion time: 2011-03-28 16:51:19

ComboFix-quarantined-files.txt 2011-03-28 15:51

.

Pre-Run: 13,961,678,848 bytes free

Post-Run: 13,909,532,672 bytes free

.

- - End Of File - - E93DC12D9E18083DD44E679844DA8D68

LDTate · March 28, 2011

That could be a false positive.

This is what that IP goes to.

Is that your ISP by chance?

IP Information for 91.200.240.37

IP Location: United Kingdom Didjief Internation Kulinari Koncept Llc

inetnum: 91.200.240.0 - 91.200.243.255

netname: DIGIEF-NET

Also I still see

AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

LDTate · March 28, 2011

It could also be uTorrent causing that

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\windows\system32\drivers\78456144.sys
c:\windows\Yzeretuguze.bin

Folder::
c:\program files\uTorrentBar

Driver::
78456144

Registry::

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

YvesAdeleHarlow · March 29, 2011

Hello LDTate

My ISP is Virgin Media (http://www.virginmedia.com/)

LDTate · March 30, 2011

Can you put those two IP addresses in Zone Alarm, so it blocks them?

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\windows\system32\lcodk.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

YvesAdeleHarlow · March 31, 2011

Hello Larry,

I have only the free version of Zone Alarm. While I can add IP addresses to the Trusted Zone, I don't seem to be able to block them.

Unfortunately the last MBAM scan quaranteed and removed c:\windows\system32\lcodk.exe.

However, I ran a scan today and it flagged up c:\WINDOWS\system32\molmm.exe.

I'm guessing an executable in the same place might be of interest, so I submitted that to http://www.virustotal.com instead. The results are posted immediately after the MBAM log below. I couldn't seem to find a way to format the report readably, so I've attached a png image of the screen...

--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6218

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

31/03/2011 22:08:35

mbam-log-2011-03-31 (22-08-12).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 254539

Time elapsed: 1 hour(s), 4 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\molmm (Trojan.Dropper) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\molmm.exe (Trojan.Dropper) -> No action taken.

c:\system volume information\_restore{c1db4b3b-0bcc-463c-8da2-52b9fa8499f1}\RP274\A0085514.exe (Trojan.Dropper) -> No action taken.

c:\system volume information\_restore{c1db4b3b-0bcc-463c-8da2-52b9fa8499f1}\RP274\A0086532.exe (Trojan.Dropper) -> No action taken.

c:\system volume information\_restore{c1db4b3b-0bcc-463c-8da2-52b9fa8499f1}\RP276\A0095203.exe (Trojan.Dropper) -> No action taken.

c:\system volume information\_restore{c1db4b3b-0bcc-463c-8da2-52b9fa8499f1}\RP277\A0095602.exe (Trojan.Dropper) -> No action taken.

--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---

Thanks for persevering with this one Larry

LDTate · March 31, 2011

Please run a new combofix

YvesAdeleHarlow · April 1, 2011

Thank you Larry, please find latest ComboFix pasted below...

ComboFix 11-03-31.03 - John Moulsher 01/04/2011 10:25:19.6.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.1535.826 [GMT 1:00]

Running from: c:\documents and settings\John Moulsher\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

.

((((((((((((((((((((((((( Files Created from 2011-03-01 to 2011-04-01 )))))))))))))))))))))))))))))))

.

2011-03-31 09:16 . 2011-03-31 09:16 28752 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{52ADF9F9-3B37-4FEE-8CB7-312D03F3B8B1}\MpKslc5c2afd2.sys

2011-03-30 22:10 . 2011-03-30 22:10 18944 ----a-w- c:\windows\system32\molmm.exe

2011-03-29 17:15 . 2011-03-15 04:05 6792528 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{52ADF9F9-3B37-4FEE-8CB7-312D03F3B8B1}\mpengine.dll