Need Help With Infection

tiburonpilot · March 28, 2011

I'm strugling with an infection and need some expert help please.

Symptoms are the computer is extremely slow running.

I've got a dialog box that says "LELA 3.1 Updater" (See attachment)

I've got a phony Windows Genuine Advantage dialog box (See attachment)

I've tried various online tools and scans which have removed a lot of malware/spyware and trojans, but this issue persists. I would greatly appreciate help cleaning up this problem.

Thank you.

David

Below is the information requested:

===============================

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6186

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

3/27/2011 1:48:28 PM

mbam-log-2011-03-27 (13-48-28).txt

Scan type: Quick scan

Objects scanned: 214482

Time elapsed: 23 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

=====================================

DDS (Ver_11-03-05.01) - NTFSx86

Run by PA at 14:10:48.75 on Sun 03/27/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.402 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS.0\system32\Ati2evxx.exe

C:\WINDOWS.0\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS.0\System32\svchost.exe -k netsvcs

C:\WINDOWS.0\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS.0\System32\WLTRYSVC.EXE

C:\WINDOWS.0\System32\bcmwltry.exe

C:\WINDOWS.0\system32\spoolsv.exe

C:\WINDOWS.0\system32\KB905474\wgasetup.exe

C:\WINDOWS.0\Explorer.EXE

svchost.exe

C:\WINDOWS.0\system32\KB905474\wgasetup.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS.0\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\WINDOWS.0\system32\SearchIndexer.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS.0\system32\WLTRAY.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\WINDOWS.0\system32\spool\drivers\w32x86\3\hpztsb06.exe

C:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe

C:\WINDOWS.0\system32\ctfmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\All Users.WINDOWS.0\Application Data\WeCareReminder\ReminderHelper.exe

C:\WINDOWS.0\system32\msiexec.exe

C:\Program Files\AVG\AVG10\avgtray.exe

C:\WINDOWS.0\system32\wscntfy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS.0\system32\SearchProtocolHost.exe

C:\Documents and Settings\PA\Local Settings\Temporary Internet Files\Content.IE5\AZ0RJ3O3\dds[1].scr

.

============== Pseudo HJT Report ===============

.

uSearchMigratedDefaultURL = hxxp://search.mywebsearch.com/mywebsearch/cfg_redir2.jhtml?id=ZRxdm4291SUS&ptb=5ZcdaaVPDmfs8MKF7THBpg&psa=&ind=2010032713&ptnrS=ZRxdm4291SUS&si=&st=sb&n=77ceaa49&url=GGmain.jhtml&searchfor={searchTerms}

uStart Page = hxxp://www.yahoo.com/?ilc=1

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.6209.1142\swg.dll

BHO: WeCareReminder Class: {d824f0de-3d60-4f57-9eb1-66033ecd8abb} - c:\documents and settings\all users.windows.0\application data\wecarereminder\IEHelperv2.5.0.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [installIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorun

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [ctfmon.exe] c:\windows.0\system32\ctfmon.exe

mRun: [iMJPMIG8.1] "c:\windows.0\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [PHIME2002ASync] c:\windows.0\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows.0\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [broadcom Wireless Manager UI] c:\windows.0\system32\WLTRAY.exe

mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"

mRun: [HPDJ Taskbar Utility] c:\windows.0\system32\spool\drivers\w32x86\3\hpztsb06.exe

mRun: [LELA] "c:\program files\linksys\linksys easylink advisor\Linksys EasyLink Advisor.exe" /minimized

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg"&"inst=NzctNTcyMjI0NTU5LUZQOSs2LUJBUjlHKzEtVEI5KzItRkwrOS1YTzM2KzEtRjlNN0MrNS1GOU0xMEIrMS1YTzEwKzEy"&"prod=90"&"ver=10.0.1204

dRun: [CTFMON.EXE] c:\windows.0\system32\CTFMON.EXE

dRunOnce: [FlashPlayerUpdate] c:\windows.0\system32\macromed\flash\FlashUtil10i_ActiveX.exe -update activex

IE: Google Sidewiki...

IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe

IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}

IE: {925DAB62-F9AC-4221-806A-057BFB1014AA}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {2FF8D282-F78A-4A33-ABC2-49E72A341482} - hxxp://riteaid.storefront.com/images/global/activex/SFImageUpload1_10.CAB

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6886.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://fredmeyer.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows.0\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

============= SERVICES / DRIVERS ===============

.

R0 atiide;atiide;c:\windows.0\system32\drivers\atiide.sys [2009-10-12 3456]

R4 AVGIDSDriver;AVGIDSDriver;c:\windows.0\system32\drivers\avgidsdriver.sys --> c:\windows.0\system32\drivers\AVGIDSDriver.Sys [?]

R4 AVGIDSEH;AVGIDSEH;c:\windows.0\system32\drivers\avgidseh.sys --> c:\windows.0\system32\drivers\AVGIDSEH.Sys [?]

R4 AVGIDSFilter;AVGIDSFilter;c:\windows.0\system32\drivers\avgidsfilter.sys --> c:\windows.0\system32\drivers\AVGIDSFilter.Sys [?]

R4 AVGIDSShim;AVGIDSShim;c:\windows.0\system32\drivers\avgidsshim.sys --> c:\windows.0\system32\drivers\AVGIDSShim.Sys [?]

R4 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows.0\system32\drivers\avgrkx86.sys --> c:\windows.0\system32\drivers\avgrkx86.sys [?]

R4 Avgtdix;AVG TDI Driver;c:\windows.0\system32\drivers\avgtdix.sys --> c:\windows.0\system32\drivers\avgtdix.sys [?]

S2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-4-18 204800]

S2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2010-3-19 55016]

.

=============== Created Last 30 ================

.

2011-03-27 19:03:41 -------- dc----w- C:\10059d1206157c3831

2011-03-27 14:48:10 102400 ----a-w- c:\windows.0\RegBootClean.exe

2011-03-27 10:36:37 189520 ----a-w- c:\windows.0\system32\drivers\tmcomm.sys

2011-03-26 00:32:11 -------- dc----w- C:\Combo-Fix1909C

2011-03-25 03:22:06 -------- d-----w- c:\windows.0\system32\KB905474

2011-03-25 02:23:30 -------- dc----w- C:\Combo-Fix

2011-03-24 04:19:48 -------- d-----w- c:\docume~1\pa\applic~1\AVG10

2011-03-24 04:05:52 -------- d-----w- c:\docume~1\alluse~1.0\applic~1\AVG10

2011-03-24 03:19:07 -------- dcsha-r- C:\cmdcons

2011-03-24 03:13:10 89088 ----a-w- c:\windows.0\MBR.exe

2011-03-24 03:13:10 256512 ----a-w- c:\windows.0\PEV.exe

2011-03-24 03:13:10 161792 ----a-w- c:\windows.0\SWREG.exe

2011-03-24 03:13:09 98816 ----a-w- c:\windows.0\sed.exe

2011-03-23 23:40:53 -------- d-----w- c:\program files\ESET

2011-03-23 22:58:16 -------- d-----w- c:\docume~1\pa\applic~1\Malwarebytes

2011-03-23 22:57:53 38224 ----a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys

2011-03-23 22:57:51 -------- d-----w- c:\docume~1\alluse~1.0\applic~1\Malwarebytes

2011-03-23 22:57:48 20952 ----a-w- c:\windows.0\system32\drivers\mbam.sys

2011-03-23 22:57:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-03-23 13:54:52 221184 ----a-w- c:\windows.0\system32\wmpns.dll

2011-03-23 12:45:08 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2

2011-03-23 12:34:44 40960 -c----w- c:\windows.0\system32\dllcache\ndproxy.sys

2011-03-23 12:31:25 617472 -c----w- c:\windows.0\system32\dllcache\comctl32.dll

2011-03-23 00:13:27 56496 ----a-w- c:\windows.0\system32\wbhelp2.dll

2011-03-23 00:13:27 544768 ----a-w- c:\windows.0\system32\wbocx.ocx

2011-03-23 00:13:26 4608 ----a-w- c:\windows.0\system32\W95INF32.DLL

2011-03-23 00:13:26 33968 ----a-w- c:\windows.0\system32\anim.dll

2011-03-23 00:13:26 258352 ----a-w- c:\windows.0\system32\unicows.dll

2011-03-23 00:13:26 2272 ----a-w- c:\windows.0\system32\W95INF16.DLL

2011-03-23 00:13:26 1706800 ----a-w- c:\windows.0\system32\gdiplus.dll

2011-03-23 00:13:24 -------- d-----w- c:\program files\WinUtilities

2011-03-20 23:27:54 -------- d-----w- c:\docume~1\alluse~1.0\applic~1\MFAData

2011-03-16 17:53:50 -------- d-----w- c:\docume~1\alluse~1.0\applic~1\oGpObJg01804

2011-03-14 17:14:33 -------- d--h--w- c:\docume~1\alluse~1.0\applic~1\Common Files

2011-02-28 23:41:14 -------- d-----w- c:\docume~1\pa\applic~1\simppulltoolbar

.

==================== Find3M ====================

.

2011-02-09 13:53:52 270848 ----a-w- c:\windows.0\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows.0\system32\encdec.dll

2011-02-02 07:58:35 2067456 ----a-w- c:\windows.0\system32\mstscax.dll

2011-01-27 11:57:06 677888 ----a-w- c:\windows.0\system32\mstsc.exe

2011-01-21 14:44:37 439296 ----a-w- c:\windows.0\system32\shimgvw.dll

2011-01-07 14:09:02 290048 ----a-w- c:\windows.0\system32\atmfd.dll

2010-12-31 13:10:33 1854976 ----a-w- c:\windows.0\system32\win32k.sys

.

============= FINISH: 14:12:18.93 ===============

Attach.zip

Elise · March 28, 2011

Hello ,

And :welcome: My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

The WGA dialog is not fake as far as I can see. What happens if you run it?

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

tiburonpilot · March 28, 2011

Thank you so much for replying Elise .

Here is the data. I've attached the file as well.

ComboFix 11-03-28.01 - PA 03/28/2011 15:47:06.4.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.472 [GMT -7:00]

Running from: c:\documents and settings\PA\Desktop\Combo-Fix.exe

.

((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-28 )))))))))))))))))))))))))))))))

.

2011-03-27 19:03 . 2011-03-27 19:03 -------- dc----w- C:\10059d1206157c3831

2011-03-27 14:48 . 2011-03-27 14:48 102400 ----a-w- c:\windows.0\RegBootClean.exe

2011-03-27 10:36 . 2010-09-06 09:26 189520 ----a-w- c:\windows.0\system32\drivers\tmcomm.sys

2011-03-25 03:22 . 2011-03-25 03:22 -------- d-----w- c:\windows.0\system32\KB905474

2011-03-25 02:23 . 2011-03-25 02:23 -------- dc----w- C:\Combo-Fix

2011-03-24 04:19 . 2011-03-24 04:19 -------- d-----w- c:\documents and settings\PA\Application Data\AVG10

2011-03-24 04:05 . 2011-03-27 21:04 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\AVG10

2011-03-23 23:40 . 2011-03-23 23:40 -------- d-----w- c:\program files\ESET

2011-03-23 22:58 . 2011-03-23 22:58 -------- d-----w- c:\documents and settings\PA\Application Data\Malwarebytes

2011-03-23 22:57 . 2010-12-21 01:09 38224 ----a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys

2011-03-23 22:57 . 2011-03-23 22:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Malwarebytes

2011-03-23 22:57 . 2011-03-23 22:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-03-23 22:57 . 2010-12-21 01:08 20952 ----a-w- c:\windows.0\system32\drivers\mbam.sys

2011-03-23 13:54 . 2008-04-14 00:12 221184 ----a-w- c:\windows.0\system32\wmpns.dll

2011-03-23 12:45 . 2011-03-23 12:45 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2

2011-03-23 12:34 . 2010-11-02 15:17 40960 -c----w- c:\windows.0\system32\dllcache\ndproxy.sys

2011-03-23 12:31 . 2010-08-23 16:12 617472 -c----w- c:\windows.0\system32\dllcache\comctl32.dll

2011-03-23 00:13 . 2010-07-26 05:23 56496 ----a-w- c:\windows.0\system32\wbhelp2.dll

2011-03-23 00:13 . 2010-07-26 05:23 544768 ----a-w- c:\windows.0\system32\wbocx.ocx

2011-03-23 00:13 . 2010-07-26 05:23 33968 ----a-w- c:\windows.0\system32\anim.dll

2011-03-23 00:13 . 2010-07-26 05:23 258352 ----a-w- c:\windows.0\system32\unicows.dll

2011-03-23 00:13 . 2010-07-26 05:23 1706800 ----a-w- c:\windows.0\system32\gdiplus.dll

2011-03-23 00:13 . 2010-07-26 05:23 4608 ----a-w- c:\windows.0\system32\W95INF32.DLL

2011-03-23 00:13 . 2010-07-26 05:23 2272 ----a-w- c:\windows.0\system32\W95INF16.DLL

2011-03-23 00:13 . 2011-03-23 01:13 -------- d-----w- c:\program files\WinUtilities

2011-03-20 23:30 . 2011-03-23 00:54 -------- d---a-w- c:\documents and settings\All Users.WINDOWS.0\Application Data\TEMP

2011-03-20 23:27 . 2011-03-26 21:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\MFAData

2011-03-16 17:53 . 2011-03-20 22:22 -------- d-----w- c:\documents and settings\All Users.WINDOWS.0\Application Data\oGpObJg01804

2011-03-14 17:14 . 2011-03-14 17:14 -------- d--h--w- c:\documents and settings\All Users.WINDOWS.0\Application Data\Common Files

2011-02-28 23:41 . 2011-02-28 23:41 -------- d-----w- c:\documents and settings\PA\Application Data\simppulltoolbar

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2004-08-03 22:56 270848 ----a-w- c:\windows.0\system32\sbe.dll

2011-02-09 13:53 . 2004-08-03 22:56 186880 ----a-w- c:\windows.0\system32\encdec.dll

2011-02-02 07:58 . 2009-10-13 01:39 2067456 ----a-w- c:\windows.0\system32\mstscax.dll

2011-01-27 11:57 . 2009-10-13 01:39 677888 ----a-w- c:\windows.0\system32\mstsc.exe

2011-01-21 14:44 . 2004-08-03 22:56 439296 ----a-w- c:\windows.0\system32\shimgvw.dll

2011-01-17 21:23 . 2011-01-17 21:23 18944 ----a-r- c:\documents and settings\PA\Application Data\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe

2011-01-07 14:09 . 2004-08-03 22:56 290048 ----a-w- c:\windows.0\system32\atmfd.dll

2010-12-31 13:10 . 2004-08-03 21:17 1854976 ----a-w- c:\windows.0\system32\win32k.sys

2009-04-01 05:47 . 2009-06-21 17:58 324976 -c--a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll

.

------- Sigcheck -------

.

[7] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows.0\$NtUninstallWMFDist11$\mspmsnsv.dll

[-] 2006-10-19 05:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows.0\system32\mspmsnsv.dll

[-] 2006-10-19 05:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows.0\system32\dllcache\mspmsnsv.dll

[-] 2004-08-03 22:56 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows.0\$NtServicePackUninstall$\mspmsnsv.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"InstallIQUpdater"="c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe" [2010-07-07 1008128]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-15 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows.0\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]

"PHIME2002ASync"="c:\windows.0\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"PHIME2002A"="c:\windows.0\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]

"Broadcom Wireless Manager UI"="c:\windows.0\system32\WLTRAY.exe" [2007-03-17 1392640]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]

"HPDJ Taskbar Utility"="c:\windows.0\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-07-11 188416]

"LELA"="c:\program files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe" [2008-05-01 131072]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows.0\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows.0\system32\Macromed\Flash\FlashUtil10i_ActiveX.exe" [2010-09-12 232912]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service

.

R0 atiide;atiide;c:\windows.0\system32\drivers\atiide.sys [10/12/2009 8:23 PM 3456]

S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [4/18/2008 2:30 AM 204800]

S2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [3/19/2010 3:48 PM 55016]

.

Contents of the 'Scheduled Tasks' folder

.

2011-03-15 c:\windows.0\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

.

2011-03-28 c:\windows.0\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 02:16]

.

2011-03-28 c:\windows.0\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 02:16]

.

2011-03-28 c:\windows.0\Tasks\OGALogon.job

- c:\windows.0\system32\OGAEXEC.exe [2009-08-03 23:07]

.

2011-03-28 c:\windows.0\Tasks\WGASetup.job

- c:\windows.0\system32\KB905474\wgasetup.exe [2011-03-25 05:18]

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://search.mywebsearch.com/mywebsearch/cfg_redir2.jhtml?id=ZRxdm4291SUS&ptb=5ZcdaaVPDmfs8MKF7THBpg&psa=&ind=2010032713&ptnrS=ZRxdm4291SUS&si=&st=sb&n=77ceaa49&url=GGmain.jhtml&searchfor={searchTerms}

uStart Page = hxxp://www.yahoo.com/?ilc=1

uInternet Connection Wizard,ShellNext = iexplore

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki...

DPF: {2FF8D282-F78A-4A33-ABC2-49E72A341482} - hxxp://riteaid.storefront.com/images/global/activex/SFImageUpload1_10.CAB

DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://fredmeyer.pnimedia.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-03-28 15:58

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,8a,b2,48,5a,1a,17,42,95,2a,2e,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,87,8a,b2,48,5a,1a,17,42,95,2a,2e,\

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS.0\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS.0\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(844)

c:\windows.0\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(3632)

c:\windows.0\system32\WININET.dll

c:\windows.0\system32\ieframe.dll

c:\windows.0\system32\webcheck.dll

c:\windows.0\system32\WPDShServiceObj.dll

c:\windows.0\system32\PortableDeviceTypes.dll

c:\windows.0\system32\PortableDeviceApi.dll

.

Completion time: 2011-03-28 16:02:52

ComboFix-quarantined-files.txt 2011-03-28 23:02

ComboFix2.txt 2011-03-26 01:14

ComboFix3.txt 2011-03-25 03:15

ComboFix4.txt 2011-03-24 03:35

.

Pre-Run: 37,903,593,472 bytes free

Post-Run: 38,002,188,288 bytes free

.

- - End Of File - - 8016B82327C5F1A90D591990CD0143DE

Combofix.txt

Elise · March 29, 2011

Hi, do you still get the WGA dialog and did you try to run it (it is not a fake).

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:


FCopy::
c:\windows.0\$NtUninstallWMFDist11$\mspmsnsv.dll | c:\windows.0\system32\mspmsnsv.dll

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

tiburonpilot · March 29, 2011

Hi Elise,

I guess you were right about the WGA dialog box. When I ran it the first time I saw the LELA Updater dialog box appear and it didn't finish the install. I assumed it was bogus then. I ran it again today and seems to have installed just fine.

I followed your script instructions to the letter. Below is the CF report. I look forward to your next instructions.

David

===================================

ComboFix 11-03-29.03 - PA 03/29/2011 15:36:45.5.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.894.408 [GMT -7:00]

Running from: c:\documents and settings\PA\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\PA\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

--------------- FCopy ---------------

.

c:\windows.0\$NtUninstallWMFDist11$\mspmsnsv.dll --> c:\windows.0\system32\mspmsnsv.dll

.

((((((((((((((((((((((((( Files Created from 2011-02-28 to 2011-03-29 )))))))))))))))))))))))))))))))

.

2011-03-29 22:21 . 2011-03-29 22:21 -------- d-----w- c:\windows.0\LastGood

2011-03-27 19:03 . 2011-03-27 19:03 -------- dc----w- C:\10059d1206157c3831

2011-03-27 14:48 . 2011-03-27 14:48 102400 ----a-w- c:\windows.0\RegBootClean.exe

2011-03-27 10:36 . 2010-09-06 09:26 189520 ----a-w- c:\windows.0\system32\drivers\tmcomm.sys

2011-03-25 03:22 . 2011-03-29 22:24 -------- d-----w- c:\windows.0\system32\KB905474