Infected by XP Total Security

catdrvr · May 9, 2011

Cant run Malwarebytes. Cant get online so have to use USB drive and other laptop. Why do things like this occur???

Thanks for all the help.

DDSDDS (Ver_11-03-05.01) - NTFSx86

Run by rrissetto at 16:03:35.09 on Mon 05/09/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3536.2820 [GMT -4:00]

.

AV: F-PROT Antivirus for Windows *Enabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}

.

============== Running Processes ===============

.

C:\WINDOWS\System32\Novell\XTAgent.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

c:\drivers\audio\r213367\stacsv.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Panda USB Vaccine\USBVaccine.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Intel\ASF Agent\ASFAgent.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\USBDLM\USBDLM.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\WINDOWS\system32\dpmw32.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\DellTPad\HidFind.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Documents and Settings\rrissetto\Desktop\dds\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.weather.com/weather/local/12918?lswe=12918&lwsa=WeatherLocalUndeclared&from=searchbox_localwx

uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [iSUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Octoshape Streaming Services] "c:\documents and settings\rrissetto\application data\octoshape\octoshape streaming services\OctoshapeClient.exe" -inv:bootrun

mRun: [Apoint] c:\program files\delltpad\Apoint.exe

mRun: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe

mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12

mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"

mRun: [F-PROT Antivirus Tray application] c:\program files\frisk software\f-prot antivirus for windows\FProtTray.exe

mRun: [NDPS] c:\windows\system32\dpmw32.exe

mRun: [NWTRAY] NWTRAY.EXE

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRunOnce: [RunNarrator] Narrator.exe

StartupFolder: c:\docume~1\rrisse~1\startm~1\programs\startup\launch~1.lnk - c:\docume~1\rrisse~1\applic~1\microsoft\installer\{d8e363a7-88b7-446d-b2c0-e26ce4dc8e54}\_294823.exe

StartupFolder: c:\docume~1\rrisse~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

mPolicies-system: CompatibleRUPSecurity = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: igfxcui - igfxdev.dll

Notify: NetIdentity Notification - c:\windows\system32\novell\XtNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

LSA: Authentication Packages = msv1_0 nwv1_0

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\rrisse~1\applic~1\mozilla\firefox\profiles\dgd9ehpc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.pressrepublican.com/

FF - plugin: c:\documents and settings\rrissetto\application data\mozilla\plugins\npoctoshape.dll

FF - plugin: c:\documents and settings\rrissetto\local settings\application data\unity\webplayer\loader\npUnity3D32.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

.

============= SERVICES / DRIVERS ===============

.

R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2009-6-18 700632]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-22 64160]

R2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968]

R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2009-1-22 808296]

R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2009-1-22 20840]

R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\frisk software\f-prot antivirus for windows\FPAVServer.exe [2010-11-3 83624]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 1029456]

R2 USBDLM;USBDLM;c:\program files\usbdlm\USBDLM.exe [2009-6-17 109568]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\novell\xtagent.exe [2005-9-8 61440]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-4-26 112512]

R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2009-4-26 32808]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2009-4-26 244368]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2009-4-26 109568]

R3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]

R3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

S3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [2007-4-19 42832]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\drivers\nvtsp50.sys --> c:\windows\system32\drivers\NvtSp50.sys [?]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]

.

=============== Created Last 30 ================

.

2011-05-09 14:52:05 235988 --sha-w- c:\docume~1\rrisse~1\locals~1\applic~1\ier.exe

2011-04-13 17:26:34 -------- d-----w- c:\windows\ServicePackFiles

.

==================== Find3M ====================

.

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:27:43 1866880 ----a-w- c:\windows\system32\win32k.sys

2011-02-26 13:27:15 0 ----a-w- c:\windows\Tzuwohazozah.bin

2011-02-22 23:06:29 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:06:29 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-22 23:06:29 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec

2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2011-02-15 12:56:39 290432 ----a-w- c:\windows\system32\atmfd.dll

2011-02-11 13:25:52 229888 ----a-w- c:\windows\system32\fxscover.exe

2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

.

============= FINISH: 16:04:37.56 ===============

FIle

GMER 1.0.15.15627 - http://www.gmer.net

Rootkit scan 2011-05-09 17:42:16

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD80 rev.11.0

Running: gmer.exe; Driver: C:\DOCUME~1\RRISSE~1\LOCALS~1\Temp\kflyiaog.sys

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA0F887E]

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA0F8BFE]

---- Kernel code sections - GMER 1.0.15 ----

? nwfilter.sys The system cannot find the file specified. !

? system32\drivers\xpsec.sys The system cannot find the path specified. !

? system32\drivers\xcpip.sys The system cannot find the path specified. !

? C:\DOCUME~1\RRISSE~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[304] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 012D9E37

.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[304] WS2_32.dll!send 71AB4C27 5 Bytes JMP 012D99D4

.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[304] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 012D9CE9

.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[304] WS2_32.dll!recv 71AB676F 5 Bytes JMP 012D9AB5

.text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[304] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 012D9B88

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe[340] kernel32.dll!CreateThread + 1A 7C8106F1 4 Bytes CALL 0051E6E5 C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe (Icon in the taskbar notification area (F-PROT Antivirus)/FRISK Software International)

.text C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe[536] ws2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02DA9E37

.text C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe[536] ws2_32.dll!send 71AB4C27 5 Bytes JMP 02DA99D4

.text C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe[536] ws2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02DA9CE9

.text C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe[536] ws2_32.dll!recv 71AB676F 5 Bytes JMP 02DA9AB5

.text C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe[536] ws2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02DA9B88

.text C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[736] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00DF9E37

.text C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[736] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00DF99D4

.text C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[736] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00DF9CE9

.text C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[736] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00DF9AB5

.text C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe[736] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00DF9B88

.text C:\Program Files\DellTPad\Apoint.exe[740] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00EC9E37

.text C:\Program Files\DellTPad\Apoint.exe[740] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00EC99D4

.text C:\Program Files\DellTPad\Apoint.exe[740] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00EC9CE9

.text C:\Program Files\DellTPad\Apoint.exe[740] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00EC9AB5

.text C:\Program Files\DellTPad\Apoint.exe[740] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00EC9B88

.text C:\Program Files\iTunes\iTunesHelper.exe[764] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01A99E37

.text C:\Program Files\iTunes\iTunesHelper.exe[764] WS2_32.dll!send 71AB4C27 5 Bytes JMP 01A999D4

.text C:\Program Files\iTunes\iTunesHelper.exe[764] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 01A99CE9

.text C:\Program Files\iTunes\iTunesHelper.exe[764] WS2_32.dll!recv 71AB676F 5 Bytes JMP 01A99AB5

.text C:\Program Files\iTunes\iTunesHelper.exe[764] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01A99B88

.text C:\WINDOWS\system32\winlogon.exe[912] Secur32.dll!LsaLogonUser 77FE33F1 5 Bytes JMP 01AB2946

.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1016] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02029E37

.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1016] WS2_32.dll!send 71AB4C27 5 Bytes JMP 020299D4

.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1016] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02029CE9

.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1016] WS2_32.dll!recv 71AB676F 5 Bytes JMP 02029AB5

.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1016] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02029B88

.text C:\WINDOWS\System32\Novell\XTAgent.exe[1156] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01439E37

.text C:\WINDOWS\System32\Novell\XTAgent.exe[1156] WS2_32.dll!send 71AB4C27 5 Bytes JMP 014399D4

.text C:\WINDOWS\System32\Novell\XTAgent.exe[1156] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 01439CE9

.text C:\WINDOWS\System32\Novell\XTAgent.exe[1156] WS2_32.dll!recv 71AB676F 5 Bytes JMP 01439AB5

.text C:\WINDOWS\System32\Novell\XTAgent.exe[1156] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01439B88

.text C:\Program Files\Intel\WiFi\bin\S24EvMon.exe[1340] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 07779E37

.text C:\Program Files\Intel\WiFi\bin\S24EvMon.exe[1340] WS2_32.dll!send 71AB4C27 5 Bytes JMP 077799D4

.text C:\Program Files\Intel\WiFi\bin\S24EvMon.exe[1340] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 07779CE9

.text C:\Program Files\Intel\WiFi\bin\S24EvMon.exe[1340] WS2_32.dll!recv 71AB676F 5 Bytes JMP 07779AB5

.text C:\Program Files\Intel\WiFi\bin\S24EvMon.exe[1340] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 07779B88

.text C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe[1476] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02359E37

.text C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe[1476] WS2_32.dll!send 71AB4C27 5 Bytes JMP 023599D4

.text C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe[1476] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02359CE9

.text C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe[1476] WS2_32.dll!recv 71AB676F 5 Bytes JMP 02359AB5

.text C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe[1476] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02359B88

.text C:\Program Files\Intel\ASF Agent\ASFAgent.exe[1768] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D19E37

.text C:\Program Files\Intel\ASF Agent\ASFAgent.exe[1768] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D199D4

.text C:\Program Files\Intel\ASF Agent\ASFAgent.exe[1768] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D19CE9

.text C:\Program Files\Intel\ASF Agent\ASFAgent.exe[1768] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D19AB5

.text C:\Program Files\Intel\ASF Agent\ASFAgent.exe[1768] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D19B88

.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[1880] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01E19E37

.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[1880] WS2_32.dll!send 71AB4C27 5 Bytes JMP 01E199D4

.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[1880] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 01E19CE9

.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[1880] WS2_32.dll!recv 71AB676F 5 Bytes JMP 01E19AB5

.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[1880] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01E19B88

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe[2076] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02779E37

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe[2076] WS2_32.dll!send 71AB4C27 5 Bytes JMP 027799D4

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe[2076] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02779CE9

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe[2076] WS2_32.dll!recv 71AB676F 5 Bytes JMP 02779AB5

.text C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe[2076] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02779B88

.text C:\WINDOWS\system32\hkcmd.exe[2304] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00E09E37

.text C:\WINDOWS\system32\hkcmd.exe[2304] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00E099D4

.text C:\WINDOWS\system32\hkcmd.exe[2304] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00E09CE9

.text C:\WINDOWS\system32\hkcmd.exe[2304] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00E09AB5

.text C:\WINDOWS\system32\hkcmd.exe[2304] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00E09B88

.text C:\WINDOWS\Explorer.EXE[2412] USER32.dll!DisplayExitWindowsWarnings 7E459F91 5 Bytes JMP 02DC2758

.text C:\WINDOWS\Explorer.EXE[2412] ws2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02DE9E37

.text C:\WINDOWS\Explorer.EXE[2412] ws2_32.dll!send 71AB4C27 5 Bytes JMP 02DE99D4

.text C:\WINDOWS\Explorer.EXE[2412] ws2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02DE9CE9

.text C:\WINDOWS\Explorer.EXE[2412] ws2_32.dll!recv 71AB676F 5 Bytes JMP 02DE9AB5

.text C:\WINDOWS\Explorer.EXE[2412] ws2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02DE9B88

.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2592] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00E79E37

.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2592] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00E799D4

.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2592] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00E79CE9

.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2592] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00E79AB5

.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2592] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00E79B88

.text C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe[2700] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F09E37

.text C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe[2700] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F099D4

.text C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe[2700] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00F09CE9

.text C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe[2700] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F09AB5

.text C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe[2700] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00F09B88

.text C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe[3116] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 017C9E37

.text C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe[3116] WS2_32.dll!send 71AB4C27 5 Bytes JMP 017C99D4

.text C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe[3116] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 017C9CE9

.text C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe[3116] WS2_32.dll!recv 71AB676F 5 Bytes JMP 017C9AB5

.text C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe[3116] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 017C9B88

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 0C2D9E37

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] WS2_32.dll!send 71AB4C27 5 Bytes JMP 0C2D99D4

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 0C2D9CE9

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] WS2_32.dll!recv 71AB676F 5 Bytes JMP 0C2D9AB5

.text C:\WINDOWS\system32\SearchIndexer.exe[3120] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 0C2D9B88

.text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[3276] ws2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 02439E37

.text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[3276] ws2_32.dll!send 71AB4C27 5 Bytes JMP 024399D4

.text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[3276] ws2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 02439CE9

.text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[3276] ws2_32.dll!recv 71AB676F 5 Bytes JMP 02439AB5

.text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[3276] ws2_32.dll!WSASend 71AB68FA 5 Bytes JMP 02439B88

.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3636] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 01799E37

.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3636] WS2_32.dll!send 71AB4C27 5 Bytes JMP 017999D4

.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3636] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 01799CE9

.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3636] WS2_32.dll!recv 71AB676F 5 Bytes JMP 01799AB5

.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3636] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 01799B88

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3840] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00EF9E37

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3840] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00EF99D4

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3840] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00EF9CE9

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3840] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00EF9AB5

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3840] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00EF9B88

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3888] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00DC9E37

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3888] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00DC99D4

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3888] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00DC9CE9

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3888] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00DC9AB5

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3888] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00DC9B88

.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5044] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00E19E37

.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5044] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00E199D4

.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5044] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00E19CE9

.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5044] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00E19AB5

.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[5044] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00E19B88

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs FStopW.sys (FPAV - RealTime Protector/FRISK Software International)

AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat FStopW.sys (FPAV - RealTime Protector/FRISK Software International)

Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)

---- EOF - GMER 1.0.15 ----

ne one????

Attach.zip

screen317 · May 12, 2011

Hello and welcome to Malwarebytes.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

catdrvr · May 13, 2011

Here are the lates log files. Thanks for all your help. Y do these things occur is there some benefit for someone screwing up my computer. because as i type this my wife's other computer now looks to be infected.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6564

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

combofix log

ComboFix 11-05-11.04 - rrissetto 05/12/2011 21:11:06.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3536.2889 [GMT -4:00]

Running from: c:\documents and settings\rrissetto\Desktop\combofix\ComboFix.exe

AV: F-PROT Antivirus for Windows *Enabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\rrissetto\Local Settings\Application Data\{15A6403B-3ED4-4FAD-BF63-6C2AF20FBF62}

c:\documents and settings\rrissetto\Local Settings\Application Data\{15A6403B-3ED4-4FAD-BF63-6C2AF20FBF62}\chrome.manifest

c:\documents and settings\rrissetto\Local Settings\Application Data\{15A6403B-3ED4-4FAD-BF63-6C2AF20FBF62}\chrome\content\_cfg.js

c:\documents and settings\rrissetto\Local Settings\Application Data\{15A6403B-3ED4-4FAD-BF63-6C2AF20FBF62}\chrome\content\overlay.xul

c:\documents and settings\rrissetto\Local Settings\Application Data\{15A6403B-3ED4-4FAD-BF63-6C2AF20FBF62}\install.rdf

c:\documents and settings\rrissetto\Local Settings\Application Data\ier.exe

C:\Install.exe

.

((((((((((((((((((((((((( Files Created from 2011-04-13 to 2011-05-13 )))))))))))))))))))))))))))))))

.

2011-05-13 00:58 . 2011-05-13 00:58 -------- d-----w- c:\documents and settings\rrissetto\Application Data\FRISK Software

2011-05-09 14:52 . 2011-05-09 14:52 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2011-04-13 17:26 . 2011-04-13 17:26 -------- d-----w- c:\windows\ServicePackFiles

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-07 05:33 . 2008-04-25 21:27 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37 . 2008-04-25 16:16 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:27 . 2008-04-25 16:16 1866880 ----a-w- c:\windows\system32\win32k.sys

2011-02-22 23:06 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:06 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-22 23:06 . 2008-04-25 16:16 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:41 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec

2011-02-17 13:18 . 2008-04-25 16:16 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2008-04-25 16:16 357888 ----a-w- c:\windows\system32\drivers\srv.sys

2011-02-17 12:32 . 2009-06-17 18:01 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2011-02-15 12:56 . 2008-04-25 16:16 290432 ----a-w- c:\windows\system32\atmfd.dll

2011-05-07 11:55 . 2011-04-03 00:31 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

"Octoshape Streaming Services"="c:\documents and settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-22 200704]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-17 483420]

"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-03-17 729088]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-26 134656]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-26 166912]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-26 134656]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-05-23 128296]

"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]

"NDPS"="c:\windows\system32\dpmw32.exe" [2004-05-17 32859]

"NWTRAY"="NWTRAY.EXE" [2002-03-12 28672]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-01 524632]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

.

c:\documents and settings\rrissetto\Start Menu\Programs\Startup\

LaunchU3.exe.lnk - c:\documents and settings\rrissetto\Application Data\Microsoft\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe [2010-1-25 22486]

OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"= 1 (0x1)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NetIdentity Notification]

2005-09-08 20:14 24576 ----a-w- c:\windows\system32\Novell\xtnotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\dpmw32.exe"=

"c:\\Documents and Settings\\rrissetto\\Application Data\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=

"c:\\Program Files\\Microsoft Office\\Live Meeting 8\\Console\\PWConsole.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

"3389:TCP"= 3389:TCP:Remote Desktop

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

"7523:TCP"= 7523:TCP:Services

"7524:TCP"= 7524:TCP:Services

"1708:TCP"= 1708:TCP:Services

.

R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [6/18/2009 8:11 AM 700632]

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/22/2009 3:06 PM 64160]

R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]

R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [1/22/2009 11:19 AM 808296]

R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [1/22/2009 11:19 AM 20840]

R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [11/3/2010 5:40 PM 83624]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [1/18/2009 5:34 PM 1029456]

R2 USBDLM;USBDLM;c:\program files\USBDLM\USBDLM.exe [6/17/2009 2:22 PM 109568]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\Novell\xtagent.exe [9/8/2005 4:14 PM 61440]

R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [4/26/2009 5:46 PM 112512]

R3 AsfAlrt;AsfAlrt Service;c:\windows\system32\drivers\Asfalrt.sys [4/19/2007 6:28 AM 42832]

R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [4/26/2009 5:46 PM 32808]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [4/26/2009 5:46 PM 244368]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [4/26/2009 5:46 PM 109568]

R3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]

R3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]

S3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys --> c:\windows\system32\Drivers\NvtSp50.sys [?]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

WINRM REG_MULTI_SZ WINRM

.

Contents of the 'Scheduled Tasks' folder

.

2011-04-11 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 20:06]

.

2011-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]

.

2011-05-13 c:\windows\Tasks\PandaUSBVaccine.job

- c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2009-08-13 16:30]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.weather.com/weather/local/12918?lswe=12918&lwsa=WeatherLocalUndeclared&from=searchbox_localwx

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\rrissetto\Application Data\Mozilla\Firefox\Profiles\dgd9ehpc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.pressrepublican.com/

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-ChangeTPMAuth - c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-05-12 21:21

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(912)

c:\windows\system32\NETWIN32.DLL

.

- - - - - - - > 'Explorer.exe'(4660)

c:\windows\system32\WININET.dll

c:\windows\system32\igfxdo.dll

c:\program files\Windows Desktop Search\deskbar.dll

c:\program files\Windows Desktop Search\en-us\dbres.dll.mui

c:\program files\Windows Desktop Search\dbres.dll

c:\program files\Windows Desktop Search\wordwheel.dll

c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui

c:\program files\Windows Desktop Search\msnlExtRes.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\WiFi\bin\S24EvMon.exe

c:\drivers\audio\r213367\stacsv.exe

c:\windows\System32\SCardSvr.exe

c:\program files\Panda USB Vaccine\USBVaccine.exe

c:\windows\system32\igfxsrvc.exe

c:\program files\DellTPad\ApMsgFwd.exe

c:\windows\system32\NWTRAY.EXE

c:\program files\DellTPad\Apntex.exe

c:\program files\DellTPad\HidFind.exe

c:\documents and settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Intel\WiFi\bin\EvtEng.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe

c:\windows\system32\SearchIndexer.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2011-05-12 21:23:40 - machine was rebooted

ComboFix-quarantined-files.txt 2011-05-13 01:23

.

Pre-Run: 52,239,171,584 bytes free

Post-Run: 52,542,943,232 bytes free

.

- - End Of File - - 9423AC8D327FAB0C23353D73A1E6EB38

mbam log

5/12/2011 9:33:26 PM

mbam-log-2011-05-12 (21-33-26).txt

Scan type: Quick scan

Objects scanned: 200125

Time elapsed: 5 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\rrissetto\Local Settings\Application Data\ier.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

dds log

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by rrissetto at 21:48:01.39 on Thu 05/12/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3536.2669 [GMT -4:00]

.

AV: F-PROT Antivirus for Windows *Enabled/Updated* {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}

.

============== Running Processes ===============

.

C:\WINDOWS\System32\Novell\XTAgent.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

c:\drivers\audio\r213367\stacsv.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe

C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Panda USB Vaccine\USBVaccine.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\WINDOWS\system32\AESTFltr.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\dpmw32.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Documents and Settings\rrissetto\Application Data\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\WINDOWS\system32\ctfmon.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Intel\ASF Agent\ASFAgent.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\USBDLM\USBDLM.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe