Jump to content

Infected with Zentom virus


Recommended Posts

Hello All,

Last week someone in my family probably clicked on an ad while browsing the internet and later they told me that none of the websites were working properly. I realized immediately that this is some kinda infection and ran ad-aware, Spybot s&d and later MBAM. MB detected the virus as Zentom and total 35 objects (mostly Trojan Horses) were detected and removed. I ran AVG antivirus and was also clear. But after I removed the stuff detected by MB, the system became unstable as the files included Windows registry keys. Now i can't open IE browser, computer became very slow and all applications are taking a while to open and run. My AVG is run forever and finally computer hangs by the time i see the results after 8 or 10 hours.

I am running AVG now and found 10 Trojan Horse Generic24.AHK entries already in my C:\ drive.I see processes like hki283.exe, hki279.exe in my windows task manager. My Ad-Aware, Spy-bot and Zone Alarm applications got corrupted it seems. Can someone help me clear all these infections and get my computer back to normal? Thanks in advance. By the way I am using a different computer to write this as my infected computer is unable to open the browser. Thanks to everyone and the founders of this website.

Link to post
Share on other sites

Hi Larry, Thanks for your reply. I almost thought of giving up on this fix as nobody responded in 48 hours of posting here. But now I am confident that I can get my computer back to normal with your help. I have attached dds.txt and attach.zip (contains attach.txt, ark.txt and most recent mbm log.txt). I have also realized that my google search is being redirected to some rogue website. Thanks in advance.

dds.txt

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Run by Administrator at 13:21:48 on 2011-08-28

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.179 [GMT -7:00]

.

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

svchost.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\WINDOWS\System32\inetsrv\inetinfo.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com

uStart Page = hxxp://www.google.com/

uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Download Guard for Internet Explorer: {20c1a7f0-528e-444f-bac5-5804a61cca7f} - c:\program files\lavasoft\download guard for internet explorer\DownloadGuardBHO.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - No File

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll

BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll

TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [Wlawerocohuvili] rundll32.exe "c:\windows\wsarcf.dll",Startup

uRun: [naur700dlng.exe] "c:\documents and settings\administrator\application data\925208de5687f01f424207c466d2f101\naur700dlng.exe"

uRunOnce: [AutoLaunch] c:\program files\lavasoft\ad-aware\AutoLaunch.exe monthly

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [Zone Labs Client] "c:\program files\zone labs\zonealarm\zlclient.exe"

mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [soundMan] SOUNDMAN.EXE

mRun: [HydraVisionDesktopManager] c:\program files\ati technologies\ati hydravision\HydraDM.exe

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume

mRun: [QuickTime Task] "c:\program files\quicktime\qttask .exe" -atboottime

mRun: [Myemucipi] rundll32.exe "c:\windows\ecuxecabafo.dll",Startup

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: mswsock.dll

DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab

DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} - hxxp://aspglobal.ahnlab.com/asp/cab/AhnASP.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38182.8928356481

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.tvucricket.com/player/vjocx-en-black.cab

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg9\toolbar\IEToolbar.dll

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\xxgx9se6.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=

FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\xxgx9se6.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll

FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll

FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll

FF - component: c:\program files\avg\avg9\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll

FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\xxgx9se6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF - plugin: c:\documents and settings\administrator\my documents\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox

FF - Ext: AVG Security Toolbar em:version=6.103.018.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg9\toolbar\firefox\avg@igeared

FF - Ext: XULRunner: {2ADCD837-0C9F-4018-8245-DA758D3BB1AF} - c:\documents and settings\administrator\local settings\application data\{2ADCD837-0C9F-4018-8245-DA758D3BB1AF}

FF - Ext: XULRunner: {6212ACFE-076F-431B-87C0-5C8F7E92F1CE} - c:\documents and settings\networkservice\local settings\application data\{6212ACFE-076F-431B-87C0-5C8F7E92F1CE}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-8-21 64288]

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2004-7-16 77056]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-12-16 216400]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-12-16 29584]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-12-16 243152]

R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2004-7-14 392824]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-8-22 308136]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-8-15 366640]

R2 McTaskManager;Network Associates Task Manager;c:\program files\network associates\virusscan\vstskmgr.exe [2003-9-29 69706]

R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [2004-11-28 2368]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-8-14 22712]

S0 gixpydd;gixpydd;c:\windows\system32\drivers\enyklcf.sys --> c:\windows\system32\drivers\enyklcf.sys [?]

S2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

S3 ATICDSDr;ATICDSDr;\??\c:\docume~1\admini~1\locals~1\temp\aticdsdr.sys --> c:\docume~1\admini~1\locals~1\temp\ATICDSDr.sys [?]

S3 DIGIRPS;Digi PortServer Driver;c:\windows\system32\drivers\digirlpt.sys [2011-6-18 42432]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-5-8 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-5-8 3072]

S3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2003-9-29 83008]

S3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\drivers\OVCE.sys [2004-7-28 31872]

S3 RTL8192su;RNX-N150UBE Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8192su.sys --> c:\windows\system32\drivers\RTL8192su.sys [?]

S3 Tomcat5;Apache Tomcat; [x]

S4 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2011-1-24 947528]

S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-23 135664]

S4 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2005-1-26 106586]

S4 McShield;Network Associates McShield;c:\program files\network associates\virusscan\mcshield.exe [2003-9-29 237657]

S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-8-24 92008]

.

=============== Created Last 30 ================

.

2011-08-24 17:21:30 7152464 ----a-w- c:\documents and settings\all users\application data\microsoft\windows defender\definition updates\{b44e262e-04d1-4d49-a0dc-a76f9d6c1fa1}\mpengine.dll

2011-08-22 02:39:47 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll

2011-08-22 02:39:47 79872 ------w- c:\windows\system32\msxml6r.dll

2011-08-22 02:39:47 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll

2011-08-22 02:39:46 1372672 ------w- c:\windows\system32\msxml6.dll

2011-08-22 02:36:48 1327320 ------w- c:\program files\msn\msncorefiles\install\msnsusii.exe

2011-08-22 02:36:47 884712 ------w- c:\program files\msn\msncorefiles\install\msn9components\digcore.exe

2011-08-22 02:36:47 -------- d-----w- c:\windows\system32\scripting

2011-08-22 02:36:41 11053008 ------w- c:\program files\msn\msncorefiles\install\msn9components\msncli.exe

2011-08-22 02:36:37 -------- d-----w- c:\windows\l2schemas

2011-08-22 02:36:35 229376 ------w- c:\program files\msn\msncorefiles\oobe\obelog.dll

2011-08-22 02:36:33 966656 ------w- c:\program files\msn\msncorefiles\oobe\obemetal.dll

2011-08-22 02:36:33 77824 ------w- c:\program files\msn\msncorefiles\oobe\obemtllc.dll

2011-08-22 02:36:32 86016 ------w- c:\program files\msn\msncorefiles\oobe\obepopc.dll

2011-08-22 02:36:31 -------- d-----w- c:\windows\system32\en

2011-08-22 02:10:03 37760 ------w- c:\windows\system32\drivers\amdk7.sys

2011-08-22 02:10:01 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys

2011-08-22 02:10:00 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys

2011-08-22 01:01:29 15880 ----a-w- c:\windows\system32\lsdelete.exe

2011-08-21 23:09:39 -------- d-----w- c:\documents and settings\administrator\local settings\application data\AVG Security Toolbar

2011-08-21 22:37:40 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-08-21 22:02:59 -------- dc-h--w- c:\documents and settings\all users\application data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2011-08-21 21:45:59 388096 ----a-r- c:\documents and settings\administrator\application data\microsoft\installer\{0761c9a8-8f3a-4216-b4a7-b7afbf24a24a}\HiJackThis.exe

2011-08-16 03:46:07 -------- d-----w- c:\documents and settings\administrator\application data\Malwarebytes

2011-08-16 03:43:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-16 03:43:41 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-08-15 03:12:05 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-15 03:07:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-15 02:58:35 -------- d-----w- c:\documents and settings\all users\application data\InstallMate

2011-08-09 05:55:10 0 ----a-w- c:\windows\Ynakaluheqi.bin

2011-08-09 03:51:55 -------- d-----w- c:\documents and settings\administrator\local settings\application data\{2ADCD837-0C9F-4018-8245-DA758D3BB1AF}

2011-08-09 03:50:22 -------- d-----w- c:\documents and settings\administrator\application data\925208DE5687F01F424207C466D2F101

.

==================== Find3M ====================

.

2011-06-27 21:19:05 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-27 01:52:20 243152 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2011-06-17 05:56:38 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST3120026A rev.3.01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x832844D0]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8328a7d0]; MOV EAX, [0x8328a84c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8337EAB8]

3 CLASSPNP[0xF8876FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\0000006a[0x83373F18]

5 ACPI[0xF87ED620] -> nt!IofCallDriver[0x804E37D5] -> [0x83389D98]

\Driver\atapi[0x83379E20] -> IRP_MJ_CREATE -> 0x832844D0

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { JMP 0x4a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x8328431B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 13:24:04.50 ===============

attach.zip

Link to post
Share on other sites

You have what looks like a RootKit infection infecting your MBR (Master Boot Record).

Please don't attach the scans / logs from these scans, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button.

  • If you use Firefox browser
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

  • Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download GooredFix from one of the locations below and save it to your Desktop

Download Mirror #1

Download Mirror #2

  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • It doesn't take long to run, once it is finished move onto the next step

Next:

Note: if the Cure option is not there, please select 'Skip'.

Please read carefully and follow these steps.

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    TDSSKillermain.png
  • If an infected file is detected, the default action will be Cure, click on Continue.
    TDSSKillerMal-1.png
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
    TDSSKillerSuspicious.png
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    TDSSKillerCompleted.png
  • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

please post the contents of that log TDSSKiller log.

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

Thanks for your reply Larry. I ran all your steps and below are the corresponding log files. I am using Windows XP SP3 and I have not tried a system restore.

After running ATF Cleaner, GooredFix and TDSSKiller, atleast I am able to open browser IE and reply back now. It looks like the google re-direct is not hapenning so far. My taskbar icons are missing and am not able to see Ad-Aware watch, AVG and Spy-Bot Teatimer in the taskbar. When I reboot, I see two dll errors (specified module could not be found) appearing on the screen: 1. Error Loading C:\windows\wsarcf.dll 2. Error Loading C:\windows\ecuxecabafo.dll

Overall system is still very slow and my CPU is running as if there are so many processes working at the same time. When I try to open "My Computer", it takes a while to identify the drives. Please let me know what else i need to do to get my computer back to normal. Thanks again for your help.

TDSSKiller.2.5.17.0_29.08.2011_21.11.18_log.txt

2011/08/29 21:11:18.0671 5136 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57

2011/08/29 21:11:19.0203 5136 ================================================================================

2011/08/29 21:11:19.0218 5136 SystemInfo:

2011/08/29 21:11:19.0218 5136

2011/08/29 21:11:19.0218 5136 OS Version: 5.1.2600 ServicePack: 3.0

2011/08/29 21:11:19.0218 5136 Product type: Workstation

2011/08/29 21:11:19.0218 5136 ComputerName: SERVER

2011/08/29 21:11:19.0218 5136 UserName: Administrator

2011/08/29 21:11:19.0218 5136 Windows directory: C:\WINDOWS

2011/08/29 21:11:19.0218 5136 System windows directory: C:\WINDOWS

2011/08/29 21:11:19.0218 5136 Processor architecture: Intel x86

2011/08/29 21:11:19.0218 5136 Number of processors: 1

2011/08/29 21:11:19.0218 5136 Page size: 0x1000

2011/08/29 21:11:19.0218 5136 Boot type: Normal boot

2011/08/29 21:11:19.0218 5136 ================================================================================

2011/08/29 21:11:22.0953 5136 Initialize success

2011/08/29 21:11:48.0562 1608 ================================================================================

2011/08/29 21:11:48.0562 1608 Scan started

2011/08/29 21:11:48.0562 1608 Mode: Manual;

2011/08/29 21:11:48.0562 1608 ================================================================================

2011/08/29 21:11:50.0046 1608 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys

2011/08/29 21:11:50.0453 1608 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/08/29 21:11:50.0578 1608 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/08/29 21:11:50.0718 1608 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/08/29 21:11:50.0875 1608 AegisP (023867b6606fbabcdd52e089c4a507da) C:\WINDOWS\system32\DRIVERS\AegisP.sys

2011/08/29 21:11:51.0218 1608 AFD (322d0e36693d6e24a2398bee62a268cd) C:\WINDOWS\System32\drivers\afd.sys

2011/08/29 21:11:51.0671 1608 ALCXSENS (1db5287e953772a6565f15689fcd575b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS

2011/08/29 21:11:51.0843 1608 ALCXWDM (956ebf830520263ca2d4137817ac5ef1) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2011/08/29 21:11:52.0031 1608 AmdK7 (8fce268cdbdd83b23419d1f35f42c7b1) C:\WINDOWS\system32\DRIVERS\amdk7.sys

2011/08/29 21:11:52.0437 1608 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/08/29 21:11:52.0671 1608 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/08/29 21:11:52.0937 1608 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/08/29 21:11:53.0062 1608 ati2mtag (5e3603e9fba29e01f5ffc108276b3005) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

2011/08/29 21:11:53.0375 1608 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/08/29 21:11:53.0703 1608 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/08/29 21:11:53.0828 1608 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys

2011/08/29 21:11:54.0140 1608 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\System32\Drivers\avgldx86.sys

2011/08/29 21:11:54.0265 1608 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\System32\Drivers\avgmfx86.sys

2011/08/29 21:11:54.0343 1608 AvgTdiX (9a7a93388f503a34e7339ae7f9997449) C:\WINDOWS\System32\Drivers\avgtdix.sys

2011/08/29 21:11:54.0453 1608 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/08/29 21:11:54.0546 1608 CA561 (50ded7c73e0fb40693edab8cad7c46e7) C:\WINDOWS\system32\Drivers\SPCA561.SYS

2011/08/29 21:11:54.0812 1608 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/08/29 21:11:54.0906 1608 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

2011/08/29 21:11:55.0250 1608 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/08/29 21:11:55.0328 1608 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/08/29 21:11:55.0437 1608 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/08/29 21:11:56.0031 1608 DIGIRPS (9ae322f68cb80e6b1681b3a650e93edd) C:\WINDOWS\system32\DRIVERS\digirlpt.sys

2011/08/29 21:11:56.0421 1608 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/08/29 21:11:56.0765 1608 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/08/29 21:11:57.0218 1608 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/08/29 21:11:57.0531 1608 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/08/29 21:11:57.0640 1608 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/08/29 21:11:57.0781 1608 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/08/29 21:11:57.0890 1608 epmntdrv (57cc1bf06c159dfbb989f5783c0e6a50) C:\WINDOWS\system32\epmntdrv.sys

2011/08/29 21:11:58.0281 1608 EuGdiDrv (5f779f5edab787f2d090c71a9051f365) C:\WINDOWS\system32\EuGdiDrv.sys

2011/08/29 21:11:58.0640 1608 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/08/29 21:11:58.0890 1608 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

2011/08/29 21:11:59.0171 1608 FETND5BV (cfc4cc73c903152a23e1db28eaba1f03) C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys

2011/08/29 21:11:59.0312 1608 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys

2011/08/29 21:11:59.0437 1608 FETNDISB (17ed59da290d5a25063265b3da08488e) C:\WINDOWS\system32\DRIVERS\fetnd5b.sys

2011/08/29 21:11:59.0687 1608 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/08/29 21:12:00.0015 1608 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

2011/08/29 21:12:00.0312 1608 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/08/29 21:12:00.0625 1608 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/08/29 21:12:00.0703 1608 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/08/29 21:12:00.0796 1608 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

2011/08/29 21:12:00.0953 1608 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/08/29 21:12:01.0281 1608 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/08/29 21:12:01.0640 1608 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/08/29 21:12:01.0859 1608 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/08/29 21:12:02.0203 1608 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/08/29 21:12:02.0406 1608 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/08/29 21:12:02.0687 1608 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/08/29 21:12:02.0796 1608 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/08/29 21:12:03.0187 1608 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/08/29 21:12:03.0375 1608 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/08/29 21:12:03.0656 1608 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/08/29 21:12:03.0921 1608 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/08/29 21:12:04.0171 1608 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/08/29 21:12:04.0406 1608 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/08/29 21:12:04.0656 1608 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/08/29 21:12:04.0781 1608 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/08/29 21:12:05.0328 1608 Lbd (713cd5267abfb86fe90a72e384e82a38) C:\WINDOWS\system32\DRIVERS\Lbd.sys

2011/08/29 21:12:05.0500 1608 lusbaudio (081caf42d5db1fcf8794fd77befd1b11) C:\WINDOWS\system32\drivers\OVSound2.sys

2011/08/29 21:12:05.0625 1608 MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\WINDOWS\system32\drivers\mbam.sys

2011/08/29 21:12:05.0750 1608 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/08/29 21:12:05.0875 1608 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/08/29 21:12:06.0109 1608 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/08/29 21:12:06.0390 1608 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/08/29 21:12:06.0468 1608 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/08/29 21:12:06.0859 1608 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/08/29 21:12:06.0968 1608 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/08/29 21:12:07.0359 1608 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys

2011/08/29 21:12:07.0656 1608 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/08/29 21:12:07.0921 1608 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/08/29 21:12:08.0187 1608 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/08/29 21:12:08.0484 1608 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/08/29 21:12:08.0734 1608 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/08/29 21:12:08.0843 1608 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys

2011/08/29 21:12:09.0109 1608 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/08/29 21:12:09.0406 1608 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

2011/08/29 21:12:09.0656 1608 NaiAvFilter1 (93941b922810f9dfa68dfffc6ad67a77) C:\WINDOWS\system32\drivers\naiavf5x.sys

2011/08/29 21:12:09.0812 1608 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/08/29 21:12:10.0109 1608 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

2011/08/29 21:12:10.0281 1608 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/08/29 21:12:10.0531 1608 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/08/29 21:12:10.0625 1608 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/08/29 21:12:10.0734 1608 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/08/29 21:12:11.0000 1608 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/08/29 21:12:11.0265 1608 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/08/29 21:12:11.0578 1608 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/08/29 21:12:11.0734 1608 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/08/29 21:12:12.0000 1608 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/08/29 21:12:12.0359 1608 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/08/29 21:12:12.0453 1608 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/08/29 21:12:12.0531 1608 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/08/29 21:12:12.0625 1608 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/08/29 21:12:12.0750 1608 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/08/29 21:12:13.0031 1608 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/08/29 21:12:13.0328 1608 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/08/29 21:12:13.0375 1608 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/08/29 21:12:13.0718 1608 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/08/29 21:12:14.0421 1608 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/08/29 21:12:14.0656 1608 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

2011/08/29 21:12:14.0921 1608 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/08/29 21:12:15.0250 1608 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/08/29 21:12:15.0359 1608 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys

2011/08/29 21:12:15.0468 1608 QCEmerald (90849934d37133e069f31f3e9a66c9bc) C:\WINDOWS\system32\DRIVERS\OVCE.sys

2011/08/29 21:12:15.0750 1608 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/08/29 21:12:15.0828 1608 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/08/29 21:12:16.0078 1608 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/08/29 21:12:16.0343 1608 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/08/29 21:12:16.0437 1608 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/08/29 21:12:16.0734 1608 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/08/29 21:12:16.0859 1608 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/08/29 21:12:17.0156 1608 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/08/29 21:12:17.0500 1608 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/08/29 21:12:17.0906 1608 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/08/29 21:12:18.0125 1608 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/08/29 21:12:18.0375 1608 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/08/29 21:12:18.0671 1608 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/08/29 21:12:19.0015 1608 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys

2011/08/29 21:12:19.0328 1608 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS

2011/08/29 21:12:19.0484 1608 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/08/29 21:12:19.0578 1608 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/08/29 21:12:19.0828 1608 srescan (333363879c7c619daa68e4dd6e3be31e) C:\WINDOWS\system32\ZoneLabs\srescan.sys

2011/08/29 21:12:19.0968 1608 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/08/29 21:12:20.0296 1608 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys

2011/08/29 21:12:20.0406 1608 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

2011/08/29 21:12:20.0703 1608 SVKP (f05028b163b92c302a74409d683ac9b0) C:\WINDOWS\system32\SVKP.sys

2011/08/29 21:12:21.0125 1608 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/08/29 21:12:21.0421 1608 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/08/29 21:12:21.0671 1608 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/08/29 21:12:21.0796 1608 Tcpip (93ea8d04ec73a85db02eb8805988f733) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/08/29 21:12:22.0078 1608 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/08/29 21:12:22.0406 1608 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/08/29 21:12:22.0656 1608 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/08/29 21:12:22.0984 1608 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/08/29 21:12:23.0343 1608 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/08/29 21:12:23.0671 1608 USBAAPL (60a68a5ea173a97971ee9f1ff49eb2b3) C:\WINDOWS\system32\Drivers\usbaapl.sys

2011/08/29 21:12:23.0796 1608 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/08/29 21:12:24.0046 1608 USBCM (d21cde1c635bcc5053463579eee453cf) C:\WINDOWS\system32\DRIVERS\Sacm2A.sys

2011/08/29 21:12:24.0156 1608 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/08/29 21:12:24.0468 1608 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/08/29 21:12:24.0781 1608 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/08/29 21:12:25.0031 1608 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

2011/08/29 21:12:25.0281 1608 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/08/29 21:12:25.0562 1608 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/08/29 21:12:25.0812 1608 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/08/29 21:12:26.0093 1608 viaagp1 (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys

2011/08/29 21:12:26.0218 1608 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys

2011/08/29 21:12:26.0484 1608 viasraid (45469fa05947d75874316649a22878d4) C:\WINDOWS\system32\DRIVERS\viasraid.sys

2011/08/29 21:12:26.0593 1608 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/08/29 21:12:26.0875 1608 vsdatant (0b3dd9381fb9d83bc9dce8cd2459b14d) C:\WINDOWS\system32\vsdatant.sys

2011/08/29 21:12:27.0062 1608 w810bus (5e8b60606fc4173b69cdecd964f22d28) C:\WINDOWS\system32\DRIVERS\w810bus.sys

2011/08/29 21:12:27.0375 1608 w810mdfl (c0cc4f5a3c58b4c07ec4a82a5ae24714) C:\WINDOWS\system32\DRIVERS\w810mdfl.sys

2011/08/29 21:12:27.0703 1608 w810mdm (2aafeedc3bfe14419cbce7ceea59dd05) C:\WINDOWS\system32\DRIVERS\w810mdm.sys

2011/08/29 21:12:28.0015 1608 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/08/29 21:12:28.0328 1608 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/08/29 21:12:28.0546 1608 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

2011/08/29 21:12:28.0718 1608 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

2011/08/29 21:12:28.0984 1608 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/08/29 21:12:29.0093 1608 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/08/29 21:12:29.0234 1608 MBR (0x1B8) (6eda8e742e064b29f6bede3521cd143f) \Device\Harddisk0\DR0

2011/08/29 21:12:29.0250 1608 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)

2011/08/29 21:12:29.0265 1608 Boot (0x1200) (b7adec33dca6bde7f8ae0cf11fde1640) \Device\Harddisk0\DR0\Partition0

2011/08/29 21:12:29.0296 1608 Boot (0x1200) (e133159c361f28c72f72b741b5400046) \Device\Harddisk0\DR0\Partition1

2011/08/29 21:12:29.0328 1608 Boot (0x1200) (b5640d8c6f1be718ed0ec5262cc9cc17) \Device\Harddisk0\DR0\Partition2

2011/08/29 21:12:29.0359 1608 Boot (0x1200) (1df3a367165f3f9bdaae39e5711fbce3) \Device\Harddisk0\DR0\Partition3

2011/08/29 21:12:29.0375 1608 ================================================================================

2011/08/29 21:12:29.0375 1608 Scan finished

2011/08/29 21:12:29.0375 1608 ================================================================================

2011/08/29 21:12:29.0390 3860 Detected object count: 1

2011/08/29 21:12:29.0390 3860 Actual detected object count: 1

2011/08/29 21:12:49.0468 3860 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot

2011/08/29 21:12:49.0468 3860 \Device\Harddisk0\DR0 - ok

2011/08/29 21:12:49.0468 3860 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure

2011/08/29 21:13:25.0218 3732 Deinitialize success

GooredFix.txt

GooredFix by jpshortstuff (03.07.10.1)

Log created at 21:07 on 29/08/2011 (Administrator)

Firefox version 3.5.11 (en-US)

========== GooredScan ==========

Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{2ADCD837-0C9F-4018-8245-DA758D3BB1AF} -> Success!

Deleting C:\Documents and Settings\Administrator\Local Settings\Application Data\{2ADCD837-0C9F-4018-8245-DA758D3BB1AF} -> Success!

Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{6212ACFE-076F-431B-87C0-5C8F7E92F1CE} -> Success!

Deleting C:\Documents and Settings\NetworkService\Local Settings\Application Data\{6212ACFE-076F-431B-87C0-5C8F7E92F1CE} -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\

{3112ca9c-de6d-4884-a869-9855de68056c} [05:48 29/12/2005]

{972ce4c6-7e08-4474-a285-3208198ce6fd} [17:32 28/11/2008]

{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [02:51 06/06/2009]

{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [01:40 12/11/2009]

C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\xxgx9se6.default\extensions\

firefox@tvunetworks.com [05:44 25/12/2009]

{3112ca9c-de6d-4884-a869-9855de68056c} [06:54 25/12/2009]

{635abd67-4fe9-1b23-4f01-e679fa7484c1} [19:44 04/09/2010]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff" [02:50 06/06/2009]

"{3f963a5b-e555-4543-90e2-c3908898db71}"="C:\Program Files\AVG\AVG9\Firefox" [07:00 16/12/2009]

"avg@igeared"="C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared" [01:54 27/06/2011]

-=E.O.F=-

Link to post
Share on other sites

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  • Double click on ComboFix.exe & follow the prompts.
    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
    Note: If you have XP SP3, use the XP SP2 package.
    If Vista or Windows 7, skip the Recovery Console part
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC1.png

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

Hi Larry,

I ran ComboFix and below is the log. I still feel that there are so many startup programs running as my computer is taking forever to reboot and use any application after ComboFix. Hopefully all the malware is gone by now. My ad-aware and spy-bot are having conflict with either malware bytes or the registry is corrupted with malware. I don't see any icons except volume in my system tray. ALso, i see so many deletions by combofix, is it something to worry about as I may miss some important files/folders?

Thanks for the help again.

ComboFix Log

ComboFix 11-08-30.02 - Administrator 08/30/2011 22:58:20.1.1 - x86

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

* Created a new restore point

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101

c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\enemies-names.txt

c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\local.ini

c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\lsrslt.ini

c:\documents and settings\Administrator\Application Data\Adobe\plugs

c:\documents and settings\Administrator\Application Data\Adobe\shed

c:\documents and settings\Gopi\WINDOWS

c:\progra~1\AVG\AVG9\avgtray.exe

c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe

c:\program files\Java\jre6\bin\jusched.exe

c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

c:\program files\messenger\msmsgsin.exe

c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe

c:\program files\QuickTime\qttask .exe

c:\program files\QuickTime\qttask.exe

c:\program files\Spybot - Search & Destroy\TeaTimer.exe

c:\program files\Windows Defender\MSASCui.exe

c:\program files\Zone Labs\ZoneAlarm\zlclient.exe

c:\windows\$NtUninstallKB27958$

c:\windows\$NtUninstallKB27958$\1601490365\@.dll

c:\windows\$NtUninstallKB27958$\1601490365\bckfg.tmp

c:\windows\$NtUninstallKB27958$\1601490365\cfg.ini

c:\windows\$NtUninstallKB27958$\1601490365\Desktop.ini

c:\windows\$NtUninstallKB27958$\1601490365\hivedp

c:\windows\$NtUninstallKB27958$\1601490365\keywords

c:\windows\$NtUninstallKB27958$\1601490365\L\akygdmgo

c:\windows\$NtUninstallKB27958$\1601490365\lsflt7.ver

c:\windows\$NtUninstallKB27958$\713400723

c:\windows\Downloaded Program Files\Quarantine

c:\windows\ehome\medctrro.exe

c:\windows\ehome\snchk.exe

c:\windows\secure32.html

c:\windows\system32\Cache

c:\windows\system32\Nagasoft

c:\windows\system32\Nagasoft\Codecs\asyncflt.ax

c:\windows\system32\Nagasoft\Codecs\atrc.dll

c:\windows\system32\Nagasoft\Codecs\cook.dll

c:\windows\system32\Nagasoft\Codecs\drvc.dll

c:\windows\system32\Nagasoft\Codecs\raac.dll

c:\windows\system32\Nagasoft\Codecs\RealMediaSplitter.ax

c:\windows\system32\Nagasoft\Codecs\WMFDemux.dll

c:\windows\system32\Nagasoft\GifShower.dll

c:\windows\system32\Nagasoft\vjocx.dll

c:\windows\system32\paytime.exe

c:\windows\system32\spool\prtprocs\w32x86\ppbiPr.dll

c:\windows\tool2.exe

.

c:\windows\system32\Drivers\OVCodek2.sys . . . is infected!! . . . Failed to find a valid replacement.

Infected copy of c:\windows\system32\user32.dll was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\user32.dll

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_vvdsvc

-------\Legacy_vvdsvc

-------\Service_vvdsvc

-------\Service_vvdsvc

.

.

((((((((((((((((((((((((( Files Created from 2011-07-28 to 2011-08-31 )))))))))))))))))))))))))))))))

.

.

2011-08-31 05:02 . 2011-08-16 15:48 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{E8C0FF0F-B387-4F6D-82E1-FF912B6E7739}\mpengine.dll

2011-08-30 04:52 . 2011-08-30 04:52 -------- d-----w- c:\program files\Apple Software Update

2011-08-30 04:45 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll

2011-08-30 04:45 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

2011-08-30 04:44 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2011-08-30 04:43 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys

2011-08-30 04:43 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys

2011-08-30 04:33 . 2010-12-09 15:15 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll

2011-08-30 04:32 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-30 04:32 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

2011-08-30 04:31 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2011-08-30 04:31 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2011-08-30 04:31 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll

2011-08-30 04:31 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2011-08-30 04:31 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe

2011-08-30 04:31 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2011-08-30 04:31 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll

2011-08-22 02:39 . 2009-07-31 16:05 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll

2011-08-22 02:39 . 2008-04-14 05:57 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll

2011-08-22 02:39 . 2008-04-14 05:57 79872 ------w- c:\windows\system32\msxml6r.dll

2011-08-22 02:39 . 2009-07-31 16:05 1372672 ------w- c:\windows\system32\msxml6.dll

2011-08-22 02:36 . 2007-04-03 07:12 1327320 ------w- c:\program files\MSN\MSNCoreFiles\install\msnsusii.exe

2011-08-22 02:36 . 2011-08-22 02:36 -------- d-----w- c:\windows\system32\scripting

2011-08-22 02:36 . 2007-04-03 07:04 884712 ------w- c:\program files\MSN\MSNCoreFiles\install\msn9components\digcore.exe

2011-08-22 02:36 . 2007-04-03 07:09 11053008 ------w- c:\program files\MSN\MSNCoreFiles\install\msn9components\msncli.exe

2011-08-22 02:36 . 2008-04-14 12:40 229376 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obelog.dll

2011-08-22 02:36 . 2008-04-14 12:40 966656 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obemetal.dll

2011-08-22 02:36 . 2007-04-03 07:14 77824 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obemtllc.dll

2011-08-22 02:36 . 2008-04-14 12:40 86016 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obepopc.dll

2011-08-22 02:36 . 2011-08-22 02:36 -------- d-----w- c:\windows\system32\en

2011-08-22 02:10 . 2008-04-14 07:01 37760 ------w- c:\windows\system32\drivers\amdk7.sys

2011-08-22 02:10 . 2008-04-14 05:06 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys

2011-08-22 02:10 . 2008-04-14 07:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys

2011-08-22 01:01 . 2011-08-21 22:32 15880 ----a-w- c:\windows\system32\lsdelete.exe

2011-08-21 23:09 . 2011-08-21 23:09 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar

2011-08-21 22:37 . 2009-12-02 13:19 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-08-21 22:02 . 2011-08-21 22:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2011-08-21 21:45 . 2011-08-21 21:45 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2011-08-18 17:17 . 2011-08-18 17:17 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2011-08-18 17:12 . 2011-08-18 17:12 -------- d-sh--w- c:\documents and settings\NetworkService\IECompatCache

2011-08-18 16:55 . 2011-08-18 16:55 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2011-08-16 03:46 . 2011-08-16 03:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-08-16 03:43 . 2011-07-07 02:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-16 03:43 . 2011-08-16 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-15 03:12 . 2011-07-07 02:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-15 03:07 . 2011-08-31 06:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-15 02:58 . 2011-08-15 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-16 15:48 . 2009-12-19 18:38 7152464 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-07-15 13:29 . 2001-08-23 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2001-08-23 12:00 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-27 21:19 . 2011-06-27 21:19 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-27 01:52 . 2009-12-16 07:01 243152 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2011-06-24 14:10 . 2004-07-15 04:01 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:36 . 2004-07-15 04:31 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:36 . 2004-07-15 04:29 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 18:36 . 2004-02-07 01:05 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 12:05 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2001-08-23 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-06-17 05:56 . 2011-06-17 05:56 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys

2011-06-02 14:02 . 2001-08-23 12:00 1858944 ------w- c:\windows\system32\win32k.sys

.

<pre>
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Java\jre6\bin\jusched .exe
</pre>

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 13:11 2471240 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [N/A]

"Wlawerocohuvili"="c:\windows\wsarcf.dll" [N/A]

"naur700dlng.exe"="c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\naur700dlng.exe" [N/A]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-09 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [N/A]

"Zone Labs Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [N/A]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [N/A]

"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]

"HydraVisionDesktopManager"="c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [N/A]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [N/A]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [N/A]

"Myemucipi"="c:\windows\ecuxecabafo.dll" [N/A]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [N/A]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-08-23 06:08 12536 ----a-w- c:\windows\system32\avgrsstx.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RNX-N150UBE 11n USB Wireless LAN Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RNX-N150UBE 11n USB Wireless LAN Utility.lnk

backup=c:\windows\pss\RNX-N150UBE 11n USB Wireless LAN Utility.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 22:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]

2006-06-28 12:46 622592 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]

2006-06-29 17:18 77824 ----a-w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\delmsbb]

c:\windows\delmsbb.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]

2005-03-17 19:45 40960 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-06-16 13:03 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-06-16 13:03 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-12 22:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]

2003-09-10 11:11 135251 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 02:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 12:42 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

c:\program files\MSN Messenger\msnmsgr.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]

2005-03-17 19:25 57393 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]

2003-09-29 15:10 81990 ----a-w- c:\program files\Network Associates\VirusScan\shstat.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2003-10-14 15:22 155648 ----a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

c:\program files\Common Files\Real\Update_OB\realsched.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2010-08-24 09:38 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"vvdsvc"=2 (0x2)

"McShield"=2 (0x2)

"gusvc"=3 (0x3)

"gupdate"=2 (0x2)

"getPlus® Helper"=3 (0x3)

"AVG Security Toolbar Service"=3 (0x3)

"TomTomHOMEService"=2 (0x2)

"McAfeeFramework"=2 (0x2)

"lanmanworkstation"=2 (0x2)

"lanmanserver"=2 (0x2)

"iPod Service"=3 (0x3)

"Bonjour Service"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NetMeeting\\conf.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=

"c:\\Documents and Settings\\Gopi\\Application Data\\SopCast\\adv\\SopAdver.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot

"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot

"53:UDP"= 53:UDP:Realtek AP UDP Prot

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/21/2011 3:37 PM 64288]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/16/2009 12:01 AM 216400]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/16/2009 12:01 AM 243152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/14/2011 8:12 PM 22712]

S0 gixpydd;gixpydd;c:\windows\system32\drivers\enyklcf.sys --> c:\windows\system32\drivers\enyklcf.sys [?]

S3 ATICDSDr;ATICDSDr;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\ATICDSDr.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\ATICDSDr.sys [?]

S3 DIGIRPS;Digi PortServer Driver;c:\windows\system32\drivers\digirlpt.sys [6/18/2011 4:09 PM 42432]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [5/8/2009 12:10 AM 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [5/8/2009 12:10 AM 3072]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

vvdsvc REG_MULTI_SZ vvdsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-08-31 c:\windows\Tasks\Ad-Aware Update (Daily 1).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-31 c:\windows\Tasks\Ad-Aware Update (Daily 2).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-31 c:\windows\Tasks\Ad-Aware Update (Daily 3).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-31 c:\windows\Tasks\Ad-Aware Update (Daily 4).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-31 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]

.

2011-08-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-23 22:50]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-23 22:50]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

TCP: DhcpNameServer = 10.0.0.1

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\xxgx9se6.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\AVG\AVG9\Firefox

FF - Ext: AVG Security Toolbar em:version=6.103.018.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-08-30 23:21

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1482476501-2049760794-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,12,10,07,a7,4e,67,4b,a5,03,f6,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,be,28,98,3b,09,c7,47,4c,b9,d4,b2,\

"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,12,10,07,a7,4e,67,4b,a5,03,f6,\

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0A2C6EC6-E1BC-9BF5-B3F7D282645EFB0F}\{C08E0694-C5E1-48EE-3ACF6A24AC2BF796}\{A9549B8D-B7EF-15E1-4BD44DC35FFCD192}*]

"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,

c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{17739CC8-1062-40F7-1C3862585ABD2CDA}\{84278681-95F8-776A-6C175249145B2CFC}\{113E55B4-CE67-C34A-F065E12B6143C7DD}*]

"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,

c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{91EC4B89-4AF2-1685-8B077627C8A43419}\{2EE609D8-52A7-5ABD-6D921F70AFC106D5}\{F0CB3253-4F19-C88D-A2C81B3BBC751916}*]

"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,

c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A76448FF-EA59-23D3-98F3B9C94A7EC293}\{51B7BFF3-30C4-3859-72DBC6993BF1721D}\{60FC5D85-3D13-ED0E-8811CBE6817E353D}*]

"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,

c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F13\3&61aaa01&0\LogConf]

@DACL=(02 0000)

"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,

00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\

"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,

00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(724)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\WINSPOOL.DRV

.

- - - - - - - > 'explorer.exe'(3644)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\Ati2evxx.exe

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\program files\Lavasoft\Ad-Aware\AAWService.exe

c:\program files\AVG\AVG9\avgwdsvc.exe

c:\windows\System32\inetsrv\inetinfo.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

c:\program files\Network Associates\VirusScan\vstskmgr.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\System32\wbem\unsecapp.exe

c:\windows\SOUNDMAN.EXE

.

**************************************************************************

.

Completion time: 2011-08-30 23:39:34 - machine was rebooted

ComboFix-quarantined-files.txt 2011-08-31 06:39

.

Pre-Run: 10,374,590,464 bytes free

Post-Run: 10,315,976,704 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

.

- - End Of File - - 006FF3F16ACD37699A7142A7AC90A0F0

Link to post
Share on other sites

You still have infected files.

This one could be something like a webcam, that CF couldn't fix.

OVCodek2.sys

The item listed in <pre> are infected.

Notice the space before .exe.

We'll try to fix them

<pre>

c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe

c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM .exe

c:\program files\AVG\AVG9\avgtray .exe

c:\program files\Java\jre6\bin\jusched .exe

</pre>

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\windows\system32\Drivers\OVCodek2.sys
c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\naur700dlng.exe
c:\windows\wsarcf.dll
c:\windows\ecuxecabafo.dll
c:\windows\delmsbb.exe
c:\windows\system32\drivers\enyklcf.sys

Renv::
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx .exe
c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM .exe
c:\program files\AVG\AVG9\avgtray .exe
c:\program files\Java\jre6\bin\jusched .exe

Driver::
gixpydd

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"naur700dlng.exe"=-
"Wlawerocohuvili"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Myemucipi"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\delmsbb]

RegNull::
[HKEY_USERS\S-1-5-21-1482476501-2049760794-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{0A2C6EC6-E1BC-9BF5-B3F7D282645EFB0F}\{C08E0694-C5E1-48EE-3ACF6A24AC2BF796}\{A9549B8D-B7EF-15E1-4BD44DC35FFCD192}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{17739CC8-1062-40F7-1C3862585ABD2CDA}\{84278681-95F8-776A-6C175249145B2CFC}\{113E55B4-CE67-C34A-F065E12B6143C7DD}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{91EC4B89-4AF2-1685-8B077627C8A43419}\{2EE609D8-52A7-5ABD-6D921F70AFC106D5}\{F0CB3253-4F19-C88D-A2C81B3BBC751916}*]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A76448FF-EA59-23D3-98F3B9C94A7EC293}\{51B7BFF3-30C4-3859-72DBC6993BF1721D}\{60FC5D85-3D13-ED0E-8811CBE6817E353D}*]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

CFScriptB-4.gif

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

Link to post
Share on other sites

Hi Larry,

I am still with you guys...after all the help you are providing, I have the courtesy to let you know if I am gone...I just got a little busy with my work...anyways I followed your instructions and please find the ComboFix log file below. My computer still is slow (relatively faster than last time) at start up and now task bar shows AVG interface and Ad-Aware ad watch and volume icons. I hope the infections are all fixed by now. Please advice me the next steps..I appreciate your time. Thanks.

ComboFix Log.txt

ComboFix 11-08-30.02 - Administrator 09/02/2011 22:59:39.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.127 [GMT -7:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FW: ZoneAlarm Firewall *Disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

* Created a new restore point

.

FILE ::

"c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\naur700dlng.exe"

"c:\windows\delmsbb.exe"

"c:\windows\ecuxecabafo.dll"

"c:\windows\system32\drivers\enyklcf.sys"

"c:\windows\system32\Drivers\OVCodek2.sys"

"c:\windows\wsarcf.dll"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_gixpydd

.

.

((((((((((((((((((((((((( Files Created from 2011-08-03 to 2011-09-03 )))))))))))))))))))))))))))))))

.

.

2011-08-31 05:02 . 2011-08-16 15:48 7152464 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{E8C0FF0F-B387-4F6D-82E1-FF912B6E7739}\mpengine.dll

2011-08-30 04:52 . 2011-08-30 04:52 -------- d-----w- c:\program files\Apple Software Update

2011-08-30 04:45 . 2010-09-18 06:53 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll

2011-08-30 04:45 . 2010-08-23 16:12 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

2011-08-30 04:44 . 2010-11-02 15:17 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2011-08-30 04:43 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys

2011-08-30 04:43 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys

2011-08-30 04:33 . 2010-12-09 15:15 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll

2011-08-30 04:32 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-30 04:32 . 2010-10-11 14:59 45568 -c----w- c:\windows\system32\dllcache\wab.exe

2011-08-30 04:31 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2011-08-30 04:31 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2011-08-30 04:31 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll

2011-08-30 04:31 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2011-08-30 04:31 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe

2011-08-30 04:31 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2011-08-30 04:31 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll

2011-08-22 02:39 . 2009-07-31 16:05 1372672 -c----w- c:\windows\system32\dllcache\msxml6.dll

2011-08-22 02:39 . 2008-04-14 05:57 79872 -c----w- c:\windows\system32\dllcache\msxml6r.dll

2011-08-22 02:39 . 2008-04-14 05:57 79872 ------w- c:\windows\system32\msxml6r.dll

2011-08-22 02:39 . 2009-07-31 16:05 1372672 ------w- c:\windows\system32\msxml6.dll

2011-08-22 02:36 . 2007-04-03 07:12 1327320 ------w- c:\program files\MSN\MSNCoreFiles\install\msnsusii.exe

2011-08-22 02:36 . 2011-08-22 02:36 -------- d-----w- c:\windows\system32\scripting

2011-08-22 02:36 . 2007-04-03 07:04 884712 ------w- c:\program files\MSN\MSNCoreFiles\install\msn9components\digcore.exe

2011-08-22 02:36 . 2007-04-03 07:09 11053008 ------w- c:\program files\MSN\MSNCoreFiles\install\msn9components\msncli.exe

2011-08-22 02:36 . 2011-08-22 02:36 -------- d-----w- c:\windows\l2schemas

2011-08-22 02:36 . 2008-04-14 12:40 229376 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obelog.dll

2011-08-22 02:36 . 2008-04-14 12:40 966656 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obemetal.dll

2011-08-22 02:36 . 2007-04-03 07:14 77824 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obemtllc.dll

2011-08-22 02:36 . 2008-04-14 12:40 86016 ------w- c:\program files\MSN\MSNCoreFiles\oobe\obepopc.dll

2011-08-22 02:36 . 2011-08-22 02:36 -------- d-----w- c:\windows\system32\en

2011-08-22 02:10 . 2008-04-14 07:01 37760 ------w- c:\windows\system32\drivers\amdk7.sys

2011-08-22 02:10 . 2008-04-14 05:06 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys

2011-08-22 02:10 . 2008-04-14 07:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys

2011-08-22 01:01 . 2011-08-21 22:32 15880 ----a-w- c:\windows\system32\lsdelete.exe

2011-08-21 23:09 . 2011-08-21 23:09 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\AVG Security Toolbar

2011-08-21 22:37 . 2009-12-02 13:19 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys

2011-08-21 22:02 . 2011-08-21 22:03 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}

2011-08-21 21:45 . 2011-08-21 21:45 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2011-08-18 17:17 . 2011-08-18 17:17 -------- d-sh--w- c:\documents and settings\NetworkService\PrivacIE

2011-08-18 17:12 . 2011-08-18 17:12 -------- d-sh--w- c:\documents and settings\NetworkService\IECompatCache

2011-08-18 16:55 . 2011-08-18 16:55 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2011-08-16 03:46 . 2011-08-16 03:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2011-08-16 03:43 . 2011-07-07 02:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-08-16 03:43 . 2011-08-16 03:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-08-15 03:12 . 2011-07-07 02:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-08-15 03:07 . 2011-08-31 06:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-08-15 02:58 . 2011-08-15 02:58 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-08-16 15:48 . 2009-12-19 18:38 7152464 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2011-07-15 13:29 . 2001-08-23 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2001-08-23 12:00 10496 ------w- c:\windows\system32\drivers\ndistapi.sys

2011-06-27 21:19 . 2011-06-27 21:19 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-27 01:52 . 2009-12-16 07:01 243152 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2011-06-24 14:10 . 2004-07-15 04:01 139656 ------w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:36 . 2004-07-15 04:31 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:36 . 2004-07-15 04:29 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 18:36 . 2004-02-07 01:05 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 12:05 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2001-08-23 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-06-17 05:56 . 2011-06-17 05:56 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]

2011-03-18 13:11 2471240 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2011-03-18 2471240]

.

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-11 339968]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2011-06-27 2071904]

"SoundMan"="SOUNDMAN.EXE" [2003-10-08 57344]

"HydraVisionDesktopManager"="c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-16 270336]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2010-08-23 06:08 12536 ----a-w- c:\windows\system32\avgrsstx.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^RNX-N150UBE 11n USB Wireless LAN Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\RNX-N150UBE 11n USB Wireless LAN Utility.lnk

backup=c:\windows\pss\RNX-N150UBE 11n USB Wireless LAN Utility.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-27 22:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]

2006-06-28 12:46 622592 ------w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]

2006-06-29 17:18 77824 ----a-w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]

2005-03-17 19:45 40960 ----a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-06-16 13:03 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-06-16 13:03 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2009-11-12 22:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]

2003-09-10 11:11 135251 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-05-27 02:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 12:42 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 18:50 155648 ------w- c:\windows\system32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]

2005-03-17 19:25 57393 ----a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShStatEXE]

2003-09-29 15:10 81990 ----a-w- c:\program files\Network Associates\VirusScan\shstat.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]

2003-10-14 15:22 155648 ----a-r- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2009-06-09 03:30 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2010-08-24 09:38 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"vvdsvc"=2 (0x2)

"McShield"=2 (0x2)

"gusvc"=3 (0x3)

"gupdate"=2 (0x2)

"getPlus® Helper"=3 (0x3)

"AVG Security Toolbar Service"=3 (0x3)

"TomTomHOMEService"=2 (0x2)

"McAfeeFramework"=2 (0x2)

"lanmanworkstation"=2 (0x2)

"lanmanserver"=2 (0x2)

"iPod Service"=3 (0x3)

"Bonjour Service"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NetMeeting\\conf.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=

"c:\\Documents and Settings\\Gopi\\Application Data\\SopCast\\adv\\SopAdver.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"1542:TCP"= 1542:TCP:Realtek WPS TCP Prot

"1542:UDP"= 1542:UDP:Realtek WPS UDP Prot

"53:UDP"= 53:UDP:Realtek AP UDP Prot

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/21/2011 3:37 PM 64288]

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [7/16/2004 12:16 AM 77056]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/16/2009 12:01 AM 216400]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [12/16/2009 12:01 AM 243152]

R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [11/28/2004 11:35 PM 2368]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [8/14/2011 8:12 PM 22712]

S3 ATICDSDr;ATICDSDr;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\ATICDSDr.sys --> c:\docume~1\ADMINI~1\LOCALS~1\Temp\ATICDSDr.sys [?]

S3 DIGIRPS;Digi PortServer Driver;c:\windows\system32\drivers\digirlpt.sys [6/18/2011 4:09 PM 42432]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [5/8/2009 12:10 AM 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [5/8/2009 12:10 AM 3072]

S3 QCEmerald;Logitech QuickCam Web;c:\windows\system32\drivers\OVCE.sys [7/28/2004 11:47 AM 31872]

S3 RTL8192su;RNX-N150UBE Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys --> c:\windows\system32\DRIVERS\RTL8192su.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

vvdsvc REG_MULTI_SZ vvdsvc

.

Contents of the 'Scheduled Tasks' folder

.

2011-09-03 c:\windows\Tasks\Ad-Aware Update (Daily 1).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-09-03 c:\windows\Tasks\Ad-Aware Update (Daily 2).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-09-03 c:\windows\Tasks\Ad-Aware Update (Daily 3).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-09-03 c:\windows\Tasks\Ad-Aware Update (Daily 4).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-09-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 22:30]

.

2011-08-30 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]

.

2011-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-23 22:50]

.

2011-08-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-23 22:50]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

TCP: DhcpNameServer = 10.0.0.1

Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\xxgx9se6.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\program files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\AVG\AVG9\Firefox

FF - Ext: AVG Security Toolbar em:version=6.103.018.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe

HKLM-Run-Zone Labs Client - c:\program files\Zone Labs\ZoneAlarm\zlclient.exe

HKLM-Run-Microsoft Default Manager - c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe

HKLM-Run-Malwarebytes' Anti-Malware - c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe

MSConfigStartUp-Myemucipi - c:\windows\ecuxecabafo.dll

MSConfigStartUp-naur700dlng - c:\documents and settings\Administrator\Application Data\925208DE5687F01F424207C466D2F101\naur700dlng.exe

MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe

MSConfigStartUp-Wlawerocohuvili - c:\windows\wsarcf.dll

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-09-02 23:28

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1482476501-2049760794-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,12,10,07,a7,4e,67,4b,a5,03,f6,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,be,28,98,3b,09,c7,47,4c,b9,d4,b2,\

"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,88,12,10,07,a7,4e,67,4b,a5,03,f6,\

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F13\3&61aaa01&0\LogConf]

@DACL=(02 0000)

"BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,

00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\

"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,

00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(732)

c:\windows\system32\Ati2evxx.dll

.

- - - - - - - > 'explorer.exe'(3944)

c:\windows\system32\WININET.dll

c:\program files\ATI Technologies\ATI HYDRAVISION\HydraDMH.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\Ati2evxx.exe

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\program files\Lavasoft\Ad-Aware\AAWService.exe

c:\program files\AVG\AVG9\avgwdsvc.exe

c:\windows\System32\inetsrv\inetinfo.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe

c:\program files\Network Associates\VirusScan\vstskmgr.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\windows\System32\wbem\unsecapp.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\SOUNDMAN.EXE

.

**************************************************************************

.

Completion time: 2011-09-02 23:45:31 - machine was rebooted

ComboFix-quarantined-files.txt 2011-09-03 06:45

ComboFix2.txt 2011-08-31 06:39

.

Pre-Run: 10,246,930,432 bytes free

Post-Run: 10,275,979,264 bytes free

.

- - End Of File - - CF4D1A430F4AD2BD1A5955C480462F6C

Link to post
Share on other sites

Good job thumbup.gif

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7

  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good :D

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
    5. Change the Download signed ActiveX controls to Prompt
    6. Change the Download unsigned ActiveX controls to Disable
    7. Change the Initialize and script ActiveX controls not marked as safe to Disable
    8. Change the Installation of desktop items to Prompt
    9. Change the Launching programs and files in an IFRAME to Prompt
    10. Change the Navigate sub-frames across different domains to Prompt
    11. When all these settings have been made, click on the OK button.
    12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
    13. Next press the Apply button and then the OK to exit the Internet Properties page.

    [*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week

    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    [*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.

    Without a firewall your computer is succeptible to being hacked and taken over.

    I am very serious about this and see it happen almost every day with my clients.

    Simply using a Firewall in its default configuration can lower your risk greatly.

    [*]Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.

    •Free browser plug-in for Internet Explorer and Firefox

    •Real-time safety ratings

    •Ideal for Facebook, Twitter and LinkedIn

    [*] JAVA Click this link and click on the Free JAVA Download

    [*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.

    This will ensure your computer has always the latest security updates available installed on your computer.

    If there are new updates to install, install them immediately, reboot your computer, and revisit the site

    until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.

We use different ways of protecting your computer(s):

  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention

Save yourself the hassle and get protected.

Link to post
Share on other sites

Thank you Larry for all your help. I hope my computer is clean now. I will make sure I avoid any malicious websites. I still have the slow booting problem. It looks like Malware Bytes is having conflict with Spy Bot S&D, Zone Alarm and Ad-Aware softwares. Is there any solution for this? I had issue while re-enabling the Defogger. Below is the log file. Rest everything looks fine.Thanks again and you are awesome...

defogger_enable.txt

defogger_enable by jpshortstuff (23.02.10.1)

Log created at 15:38 on 03/09/2011 (Administrator)

Parsing file...

-=E.O.F=-

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.