Random tabs

xSKULLx · May 5, 2011

When I am using the internet the browser opens tabs to random sites. I also have the XP Security Antivirus 2011 virus...

DDS

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Maximiliano at 16:23:56.90 on 04/05/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1013.459 [GMT 1:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Launch Manager\dsiwmis.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\PROGRA~1\Eraser\Eraser.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Maximiliano\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0809&m=em350&r=0xph0910n925l0444wum5r46n2r32p

uDefault_Page_URL = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0809&m=em350&r=0xph0910n925l0444wum5r46n2r32p

uInternet Connection Wizard,ShellNext = iexplore

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [AdobeBridge]

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [AzMixerSel] c:\program files\realtek\audio\drivers\AzMixerSel.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Eraser] "c:\progra~1\eraser\Eraser.exe" --atRestart

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10e.exe

StartupFolder: c:\docume~1\maximi~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\maximi~1\applic~1\mozilla\firefox\profiles\6yq2bz5c.default\

FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll

FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

FF - plugin: c:\documents and settings\maximiliano\local settings\application data\unity\webplayer\loader\npUnity3D32.dll

FF - plugin: c:\program files\byond\bin\npbyond.dll

FF - plugin: c:\program files\google\update\1.3.21.53\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;c:\docume~1\maximi~1\locals~1\temp\sas_selfextract\SASDIFSV.SYS [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\docume~1\maximi~1\locals~1\temp\sas_selfextract\SASKUTIL.SYS [2010-5-10 67656]

R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-3-5 22504]

R2 DsiWMIService;Dritek WMI Service;c:\program files\launch manager\dsiwmis.exe [2010-5-4 312400]

R2 Updater Service;Updater Service;c:\program files\emachines\emachines updater\UpdaterService.exe [2010-5-4 243232]

R3 L1c;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [2010-5-4 60456]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-9-20 135664]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-5-4 1691480]

S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-3-1 183560]

S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [2010-5-4 108752]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-9-20 135664]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 XDva380;XDva380;\??\c:\windows\system32\xdva380.sys --> c:\windows\system32\XDva380.sys [?]

.

=============== Created Last 30 ================

.

2011-05-03 07:21:16 -------- dcsha-r- C:\cmdcons

2011-05-03 07:17:21 89088 ----a-w- c:\windows\MBR.exe

2011-05-03 07:17:20 98816 ----a-w- c:\windows\sed.exe

2011-05-03 07:17:20 256512 ----a-w- c:\windows\PEV.exe

2011-05-03 07:17:20 161792 ----a-w- c:\windows\SWREG.exe

2011-05-01 11:26:13 -------- dc----w- c:\docume~1\maximi~1\applic~1\SUPERAntiSpyware.com

2011-05-01 11:26:13 -------- dc----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2011-04-30 17:55:22 -------- dc----w- c:\docume~1\alluse~1\applic~1\dP31002LmHaH31002

2011-04-30 08:52:09 -------- d-----w- c:\program files\LucasArts

2011-04-29 21:39:53 -------- d-----w- c:\program files\GAMBIT

2011-04-28 20:01:59 4200896 ----a-w- c:\program files\microsoft games\age of empires ii\patches\Age2XPatch.exe

2011-04-28 20:01:59 2643424 ----a-w- c:\program files\microsoft games\age of empires ii\patches\Age2upA.exe

2011-04-28 19:42:37 -------- d-----w- c:\program files\Microsoft Games

2011-04-24 00:38:44 -------- d-----w- c:\program files\CMBO

2011-04-23 23:27:18 -------- d-----w- c:\program files\Codemasters

2011-04-19 23:06:18 -------- d-----w- c:\program files\LispWorks Personal

2011-04-15 23:23:44 -------- d-----w- c:\program files\Sierra

2011-04-15 23:20:40 -------- d-----w- c:\program files\Sierra On-Line

2011-04-12 17:13:40 118784 --sha-r- c:\windows\system32\trafficg.dll

2011-04-11 11:31:59 -------- dc----w- c:\docume~1\alluse~1\applic~1\AVAST Software

2011-04-11 11:31:59 -------- d-----w- c:\program files\AVAST Software

2011-04-10 23:38:51 0 ----a-w- c:\windows\Qhupu.bin

2011-04-10 23:38:49 -------- d-----w- c:\docume~1\maximi~1\locals~1\applic~1\{0ACD3826-E980-44FC-822F-A35D00FED734}

2011-04-09 23:16:07 378880 ----a-w- c:\windows\acumifixe.dll

2011-04-08 23:38:09 -------- d-----w- c:\program files\directx

2011-04-08 23:38:06 516173 ------w- c:\windows\system32\MSVCP60D.DLL

2011-04-07 20:31:02 -------- dc----w- C:\DeusEx

2011-04-07 17:10:12 -------- d-----w- c:\docume~1\maximi~1\locals~1\applic~1\nMars

2011-04-07 17:06:03 -------- d-----w- c:\program files\nMars

.

==================== Find3M ====================

.

2011-03-23 19:35:16 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2011-03-20 16:35:00 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2011-03-20 16:35:00 109080 ----a-w- c:\windows\system32\OpenAL32.dll

2011-02-15 00:55:04 21052 ----atw- c:\windows\system32\SIntfNT.dll

2011-02-15 00:55:04 15144 ----atw- c:\windows\system32\SIntf32.dll

2011-02-15 00:55:04 12067 ----atw- c:\windows\system32\SIntf16.dll

2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: TOSHIBA_ rev.GJ00 -> Harddisk0\DR0 -> \Device\Ide\iaStor0

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x865BF439]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x865c57d0]; MOV EAX, [0x865c584c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x865D35F0]

3 CLASSPNP[0xF76FFFD7] -> nt!IofCallDriver[0x804E13B9] -> \Device\00000093[0x86FC71D0]

5 ACPI[0xF75F6620] -> nt!IofCallDriver[0x804E13B9] -> [0x86FCD028]

\Driver\iaStor[0x86FCC0F0] -> IRP_MJ_CREATE -> 0x865BF439

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x147; MOV BP, 0x62a; ROR BYTE [bP+0x0], CL; INC BP; }

detected disk devices:

\Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskTOSHIBA_MK1665GSX_______________________GJ002J__#4&36fb52f8&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

detected hooks:

user != kernel MBR !!!

copy of MBR has been found in sector 9 !

sectors 312581806 (+255): user != kernel

Warning: possible TDL4 rootkit infection !

TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

.

============= FINISH: 16:26:45.71 ===============

Malwarebytes' Log

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6484

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

01/05/2011 18:42:32

mbam-log-2011-05-01 (18-42-32).txt

Scan type: Full scan (C:\|E:\|)

Objects scanned: 318344

Time elapsed: 2 hour(s), 7 minute(s), 34 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 1

Registry Data Items Infected: 3

Folders Infected: 1

Files Infected: 12

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvc (TrojanProxy.Agent) -> Value: netsvc -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Maximiliano\Local Settings\Application Data\rnc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Maximiliano\Local Settings\Application Data\rnc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Maximiliano\Local Settings\Application Data\rnc.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.

Folders Infected:

c:\WINDOWS\$xntuninstall643$ (Adware.AdRotator) -> Quarantined and deleted successfully.

Files Infected:

c:\documents and settings\all users\application data\dp31002lmhah31002\dp31002lmhah31002.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\maximiliano\application data\Sun\Java\deployment\cache\6.0\35\64e4063-121b97bc (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\maximiliano\my documents\downloads\192\warcraft 3\warcraft3 keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\masm32\qeditor.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.

c:\masm32\examples\dialogs\calender\calender.exe (Malware.Packer) -> Quarantined and deleted successfully.

c:\masm32\examples\dialogs\simple\simple.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\masm32\examples\dialogs\tests\tests.exe (Malware.Packer) -> Quarantined and deleted successfully.

c:\masm32\examples\exampl05\qeplugin\qeplugin.dll (Spyware.Passwords) -> Quarantined and deleted successfully.

c:\masm32\examples\exampl06\regdemo\regdemo.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\masm32\tools\makecimp\vcrtdemo\vcrtdemo.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\masm32\tutorial\dlltute\dll\dlltute.dll (Spyware.Passwords) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.

Elise · May 6, 2011

Hi, unfortunately you have a nasty rootkit.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

xSKULLx · May 6, 2011

I will format&reinstall as soon as possible.. but at the time I can't. So I will try to clean it up to it for a little while...

ComboFix 11-05-06.02 - Maximiliano 06/05/2011 20:44:43.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1013.702 [GMT 1:00]

Running from: c:\documents and settings\Maximiliano\Desktop\ComboFix.exe

.

PEV Error: PersonalFile

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Maximiliano\Application Data\Adobe\plugs

c:\documents and settings\Maximiliano\Application Data\Adobe\shed

c:\documents and settings\Maximiliano\Local Settings\Application Data\{0ACD3826-E980-44FC-822F-A35D00FED734}

c:\documents and settings\Maximiliano\Local Settings\Application Data\{0ACD3826-E980-44FC-822F-A35D00FED734}\chrome.manifest

c:\documents and settings\Maximiliano\Local Settings\Application Data\{0ACD3826-E980-44FC-822F-A35D00FED734}\chrome\content\_cfg.js

c:\documents and settings\Maximiliano\Local Settings\Application Data\{0ACD3826-E980-44FC-822F-A35D00FED734}\chrome\content\overlay.xul

c:\documents and settings\Maximiliano\Local Settings\Application Data\{0ACD3826-E980-44FC-822F-A35D00FED734}\install.rdf

c:\documents and settings\Maximiliano\WINDOWS

.

\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected

.

((((((((((((((((((((((((( Files Created from 2011-04-06 to 2011-05-06 )))))))))))))))))))))))))))))))

.

2011-05-01 19:08 . 2011-05-01 19:08 -------- dc----w- c:\documents and settings\Maria de fatima\Application Data\Malwarebytes

2011-05-01 14:05 . 2011-05-01 14:06 -------- dc----w- c:\documents and settings\Administrator

2011-05-01 11:26 . 2011-05-01 11:26 -------- dc----w- c:\documents and settings\Maximiliano\Application Data\SUPERAntiSpyware.com

2011-05-01 11:26 . 2011-05-01 11:26 -------- dc----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-04-30 23:22 . 2011-05-01 16:10 -------- d-----w- c:\program files\Warcraft III

2011-04-30 17:55 . 2011-05-01 17:42 -------- dc----w- c:\documents and settings\All Users\Application Data\dP31002LmHaH31002

2011-04-30 08:52 . 2011-04-30 08:52 -------- d-----w- c:\program files\LucasArts

2011-04-29 21:39 . 2011-04-29 21:39 -------- d-----w- c:\program files\GAMBIT

2011-04-28 19:42 . 2011-04-28 19:42 -------- d-----w- c:\program files\Microsoft Games

2011-04-26 23:13 . 2011-04-26 23:13 -------- dcsh--w- c:\documents and settings\LocalService\IECompatCache

2011-04-26 21:01 . 2011-04-26 21:01 -------- d-sh--w- c:\documents and settings\NetworkService\IECompatCache

2011-04-26 20:08 . 2011-04-26 20:08 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2011-04-24 00:38 . 2011-04-24 00:45 -------- d-----w- c:\program files\CMBO

2011-04-23 23:27 . 2011-04-23 23:32 -------- d-----w- c:\program files\Codemasters

2011-04-22 20:40 . 2011-04-22 20:40 -------- dc----w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple

2011-04-19 23:06 . 2011-04-19 23:09 -------- d-----w- c:\program files\LispWorks Personal

2011-04-15 23:23 . 2011-04-15 23:23 -------- d-----w- c:\program files\Sierra

2011-04-15 23:20 . 2011-04-27 09:59 -------- d-----w- c:\program files\Sierra On-Line

2011-04-12 17:13 . 2011-04-12 17:13 118784 --sha-r- c:\windows\system32\trafficg.dll

2011-04-11 11:31 . 2011-05-01 15:33 -------- dc----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-04-11 11:31 . 2011-04-11 11:31 -------- d-----w- c:\program files\AVAST Software

2011-04-10 23:58 . 2011-04-10 23:58 -------- dcsh--w- c:\documents and settings\LocalService\IETldCache

2011-04-10 23:38 . 2011-04-18 11:22 0 ----a-w- c:\windows\Qhupu.bin

2011-04-10 22:30 . 2011-05-01 21:00 -------- dc----w- c:\documents and settings\Maria de fatima\Application Data\Spyware Terminator

2011-04-09 23:16 . 2011-04-09 23:16 378880 ----a-w- c:\windows\acumifixe.dll

2011-04-08 23:38 . 2011-04-08 23:38 -------- d-----w- c:\program files\directx

2011-04-08 23:38 . 1998-06-16 22:00 516173 ------w- c:\windows\system32\MSVCP60D.DLL

2011-04-08 10:18 . 2011-04-08 10:18 -------- dc----w- c:\documents and settings\Maria de fatima\Application Data\Apple Computer

2011-04-08 10:16 . 2011-04-08 10:20 -------- dc----w- c:\documents and settings\Maria de fatima\.gimp-2.6

2011-04-08 10:16 . 2011-04-08 10:16 -------- dc----w- c:\documents and settings\Maria de fatima\Application Data\Wings3D

2011-04-08 10:15 . 2011-04-08 10:16 -------- dc----w- c:\documents and settings\Maria de fatima\Application Data\Notepad++

2011-04-07 20:31 . 2011-04-07 20:33 -------- dc----w- C:\DeusEx

2011-04-07 17:10 . 2011-04-07 17:10 -------- d-----w- c:\documents and settings\Maximiliano\Local Settings\Application Data\nMars

2011-04-07 17:06 . 2011-04-07 17:06 -------- d-----w- c:\program files\nMars

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-23 19:35 . 2010-11-13 19:51 43520 ----a-w- c:\windows\system32\CmdLineExt03.dll

2011-03-23 19:27 . 2011-03-23 19:27 15360 -c--a-r- c:\documents and settings\Maximiliano\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E910.exe

2011-03-23 19:27 . 2011-03-23 19:27 11264 -c--a-r- c:\documents and settings\Maximiliano\Application Data\Microsoft\Installer\{DD8408E9-9421-484F-979D-DB6361E3E828}\IconDD8408E96.exe

2011-03-20 16:35 . 2011-03-20 16:35 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2011-03-20 16:35 . 2011-03-20 16:35 109080 ----a-w- c:\windows\system32\OpenAL32.dll

2011-02-15 00:55 . 2010-11-11 18:08 21052 ----atw- c:\windows\system32\SIntfNT.dll

2011-02-15 00:55 . 2010-11-11 18:08 15144 ----atw- c:\windows\system32\SIntf32.dll

2011-02-15 00:55 . 2010-11-11 18:08 12067 ----atw- c:\windows\system32\SIntf16.dll

2011-02-09 13:53 . 2010-05-04 18:25 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2010-05-04 18:25 186880 ----a-w- c:\windows\system32\encdec.dll

2011-04-30 08:48 . 2011-03-30 22:01 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

.

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . 4AFB3B0919649F95C1964AA1FAD27D73 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((( SnapShot@2011-05-03_08.00.05 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-05-06 19:41 . 2011-05-06 19:41 16384 c:\windows\temp\Perflib_Perfdata_76c.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-03-31 399736]

"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2010-10-23 2937528]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-16 141336]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-16 173592]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"RTHDCPL"="RTHDCPL.EXE" [2010-03-12 19521056]

"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2009-12-11 59936]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-07-22 402432]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]

"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-04-10 979344]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10e.exe" [2010-01-27 256280]

.

c:\documents and settings\Maria de fatima\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

c:\documents and settings\Maximiliano\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 12:00 15360 ----a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2010-04-08 04:18 908368 ----a-w- c:\program files\Launch Manager\LManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]

2008-04-14 12:00 59392 ----a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2009-11-16 14:56 141336 ----a-w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetL]

2010-02-12 15:11 99712 ----a-w- c:\windows\PLFSetL.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snp2uvc]

2010-02-12 15:11 202112 ----a-w- c:\windows\system32\csnp2uvc.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snuvcdsm]

2010-02-12 15:11 30080 ----a-w- c:\windows\snuvcdsm.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"c:\\Program Files\\Starcraft\\StarCraft.exe"=

"c:\\Program Files\\REACTOR\\REACTOR.exe"=

"c:\\Program Files\\REACTOR\\ijjiOptimizer.exe"=

"c:\\Program Files\\mIRC\\mirc.exe"=

"c:\\CAVEDOG\\TOTALA\\TotalA.exe"=

"c:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56856:TCP"= 56856:TCP:Pando Media Booster

"56856:UDP"= 56856:UDP:Pando Media Booster

"2970:TCP"= 2970:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

"25513:TCP"= 25513:TCP:spport

"27325:TCP"= 27325:TCP:spport

"18123:TCP"= 18123:TCP:spport

"11989:TCP"= 11989:TCP:spport

"5929:TCP"= 5929:TCP:spport

"28459:TCP"= 28459:TCP:spport

"14322:TCP"= 14322:TCP:spport

"27482:TCP"= 27482:TCP:spport

"14483:TCP"= 14483:TCP:spport

"27960:TCP"= 27960:TCP:spport

"13270:TCP"= 13270:TCP:spport

"13576:TCP"= 13576:TCP:spport

"11670:TCP"= 11670:TCP:spport

"13451:TCP"= 13451:TCP:spport

"12122:TCP"= 12122:TCP:spport

"18830:TCP"= 18830:TCP:spport

"29163:TCP"= 29163:TCP:spport

"8929:TCP"= 8929:TCP:spport

"27784:TCP"= 27784:TCP:spport

.

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22/10/2010 22:09 691696]

R1 SASDIFSV;SASDIFSV;\??\c:\docume~1\MAXIMI~1\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\MAXIMI~1\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]

R1 SASKUTIL;SASKUTIL;\??\c:\docume~1\MAXIMI~1\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS --> c:\docume~1\MAXIMI~1\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.SYS [?]

R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [05/03/2011 22:10 22504]

R2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [04/05/2010 19:26 312400]

R2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [04/05/2010 12:15 243232]

R3 L1c;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [04/05/2010 19:26 60456]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [20/09/2010 14:12 135664]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [04/05/2010 12:00 1691480]

S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [01/03/2011 21:23 183560]

S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [04/05/2010 12:03 108752]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [20/09/2010 14:12 135664]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [19/02/2010 13:37 517096]

S3 XDva380;XDva380;\??\c:\windows\system32\XDva380.sys --> c:\windows\system32\XDva380.sys [?]

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-04 c:\windows\Tasks\AdobeAAMUpdater-1.0-EMACHMKH-Maximiliano.job

- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-10-06 02:44]

.

2011-04-29 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-20 13:12]

.

2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-20 13:12]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0809&m=em350&r=0xph0910n925l0444wum5r46n2r32p

uInternet Connection Wizard,ShellNext = iexplore

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

FF - ProfilePath - c:\documents and settings\Maximiliano\Application Data\Mozilla\Firefox\Profiles\6yq2bz5c.default\

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-AdobeBridge - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-05-06 21:04

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: TOSHIBA_ rev.GJ00 -> Harddisk0\DR0 -> \Device\Ide\iaStor0

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8652F439]<<

c:\docume~1\MAXIMI~1\LOCALS~1\Temp\catchme.sys

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x865357d0]; MOV EAX, [0x8653584c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E13B9] -> \Device\Harddisk0\DR0[0x86551030]

3 CLASSPNP[0xF76FFFD7] -> nt!IofCallDriver[0x804E13B9] -> \Device\00000095[0x86F16848]

5 ACPI[0xF74EB620] -> nt!IofCallDriver[0x804E13B9] -> [0x86ED5028]

\Driver\iaStor[0x86ECA998] -> IRP_MJ_CREATE -> 0x8652F439

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; PUSHA ; MOV CX, 0x147; MOV BP, 0x62a; ROR BYTE [bP+0x0], CL; INC BP; }

detected disk devices:

\Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskTOSHIBA_MK1665GSX_______________________GJ002J__#4&36fb52f8&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

detected hooks:

user != kernel MBR !!!

copy of MBR has been found in sector 9 !

sectors 312581806 (+255): user != kernel

Warning: possible TDL4 rootkit infection !

TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(880)

c:\windows\system32\WININET.dll

.

- - - - - - - > 'lsass.exe'(940)

c:\windows\system32\WININET.dll

.

Completion time: 2011-05-06 21:11:01

ComboFix-quarantined-files.txt 2011-05-06 20:10

ComboFix2.txt 2011-05-03 08:08

.

Pre-Run: 5,262,979,072 bytes free

Post-Run: 5,879,345,152 bytes free

.

- - End Of File - - 2EB3FA09E6CDC53B8FA1BCA0343D269E

Elise · May 6, 2011

That sees the infection but it reappears afterwards.

Please run the following tool, then rerun combofix.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
Vista/Windows 7 users right-click and select Run As Administrator.
If TDSSKiller does not run, try renaming it.
To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
Click the Start Scan button.
Do not use the computer during the scan
If the scan completes with nothing found, click Close to exit.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
Copy and paste the contents of that file in your next reply.

xSKULLx · May 6, 2011

ComboFix 11-05-06.03 - Maximiliano 06/05/2011 22:51:12.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.1013.544 [GMT 1:00]

Running from: c:\documents and settings\Maximiliano\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Maximiliano\Desktop\Setup.exe

c:\program files\INSTALL.LOG

c:\windows\ST6UNST.000