Possible infection, directions followed

[gonlaz]

Hello, the last two days my system has been acting screwy on a couple of websites, not connecting to be specific. Google and facebook only at this point. It's not all the time, just sometimes. Also tonight for a brief time I was unable to update MWB with the error stating "PROGRAM_UPDATING_ERROR (2, 0, I/O)". Anyway I ran all my anti virus scans (AVG, MWB, Spy Bot, Ad Aware) and there were "no malicious items found". So I found the directions and have updated the two log files here. I hoped it could be analyzed, I'd greatly appreciate it.

ark.zip

attach.zip

[screen317]

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

[gonlaz]

Hi and welcome to Malwarebytes.

In the future, please post all logs directly into your reply instead of attaching them unless otherwise indicated. With that said, please update MBAM, run a Quick Scan, and post its log.

Next, run DDS again and post DDS.txt directly in your reply.

Oh, I'm sorry about that, I could have sworn the instructions I read said to attach, sorry, here goes:

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7587

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/27/2011 12:56:28 PM

mbam-log-2011-08-27 (12-56-28).txt

Scan type: Quick scan

Objects scanned: 266262

Time elapsed: 4 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Owner at 13:00:47 on 2011-08-27

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2298 [GMT -4:00]

.

AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

svchost.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

svchost.exe

C:\Program Files\98614 Thin-Profile Keyboard & Mouse\Wireless KeyboardKM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.my.yahoo.com/

uInternet Connection Wizard,ShellNext = hxxp://thepiratebay.org/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome frame\application\13.0.782.215\npchrome_frame.dll

TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NUSB3MON] "c:\program files\nec electronics\usb 3.0 host controller driver\application\nusb3mon.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [98614 Wireless Keyboard and Mouse Combo] c:\program files\98614 thin-profile keyboard & mouse\Wireless KeyboardKM.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1257973540671

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257973534406

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

TCP: DhcpNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{4309B31F-4BB4-48C1-90DC-81E75F5C3615} : DhcpNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{B7C0CD40-89A2-4F30-9819-1A71CDC62CB7} : DhcpNameServer = 65.32.5.111 65.32.5.112

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\13.0.782.215\npchrome_frame.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: avgrsstarter - avgrsstx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

============= SERVICES / DRIVERS ===============

.

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-3-4 64512]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-11-21 216400]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-11-21 29584]

R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-11-21 243152]

R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-18 308136]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-5-25 2151640]

R3 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-7-18 921952]

R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-5-25 15232]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2010-2-24 60544]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2010-2-24 141568]

R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2010-10-23 30392]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-25 136176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-10-23 1691480]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-25 136176]

S3 MSICDSetup;MSICDSetup;\??\d:\cdriver.sys --> d:\CDriver.sys [?]

.

=============== Created Last 30 ================

.

2011-08-27 06:00:13 -------- d-----w- C:\14915ad5f07afd0a97b8b8068c

2011-08-27 04:33:35 -------- d-----w- c:\program files\Audacity

2011-08-20 20:29:35 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys

2011-08-20 20:29:14 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-18 23:16:14 39424 ----a-w- c:\windows\system32\sens32.dll

2011-08-14 20:29:27 -------- d-----w- c:\windows\system32\custom matrices

2011-08-14 01:08:54 -------- d-----w- c:\windows\system32\QuickTime

2011-08-14 01:08:54 -------- d-----w- c:\windows\system32\C2MP

2011-08-13 03:35:05 -------- d-----w- c:\documents and settings\all users.windows\application data\DivX

2011-08-09 16:01:58 -------- d-----w- c:\program files\Pando Networks

2011-08-02 20:52:49 -------- d-----w- C:\WoW screens

2011-07-31 18:47:46 3577856 ----a-w- c:\windows\system32\ffdshow.ax

2011-07-31 18:31:38 3854848 ----a-w- c:\windows\system32\ffmpeg.dll

.

==================== Find3M ====================

.

2011-07-19 19:08:04 74752 ----a-w- c:\windows\system32\ff_vfw.dll

2011-07-19 19:06:48 259584 ----a-w- c:\windows\system32\TomsMoComp_ff.dll

2011-07-19 19:06:36 158208 ----a-w- c:\windows\system32\ff_unrar.dll

2011-07-19 19:06:34 96768 ----a-w- c:\windows\system32\ff_wmv9.dll

2011-07-19 19:06:34 1524224 ----a-w- c:\windows\system32\ff_samplerate.dll

2011-07-19 19:06:32 145920 ----a-w- c:\windows\system32\ff_libmad.dll

2011-07-19 19:06:30 136704 ----a-w- c:\windows\system32\libmpeg2_ff.dll

2011-07-19 19:06:30 113664 ----a-w- c:\windows\system32\ff_liba52.dll

2011-07-19 19:06:28 327680 ----a-w- c:\windows\system32\ff_libfaad2.dll

2011-07-19 19:06:28 211456 ----a-w- c:\windows\system32\ff_libdts.dll

2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-07-06 23:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 23:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-02 03:38:18 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:33:49 919552 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:33:49 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:33:49 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:19:29 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll

2011-06-13 13:34:09 16432 ----a-w- c:\windows\system32\lsdelete.exe

2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys

2011-05-30 13:42:50 240640 ----a-w- c:\windows\system32\xvidvfw.dll

2009-06-04 00:22:54 44 ---ha-w- c:\program files\3a7b80af.tmp

.

============= FINISH: 13:01:31.40 ===============

[screen317]

Hi,

I notice that you are using more than one antivirus program (AVG and Lavasoft). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[gonlaz]

Hi,

I notice that you are using more than one antivirus program (AVG and Lavasoft). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

AVG cannot fully unisntall leaving a registry key. I am wary of removing everything but mwb, sure that's ok?

[gonlaz]

Hi,

I notice that you are using more than one antivirus program (AVG and Lavasoft). This is very dangerous, as multiple AVs can interfere with one another and actually allow MORE viruses to get through. I strongly suggest you go to Start -> Control Panel -> Add or Remove Programs and uninstall all but one antivirus program.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

ok avg is gone, I am very nervous and combofix isn't producing a log, and a process called grep.3XE is running and won't stop. I didn't see that in the combofix instructions.

Please advise, and is MWB running alone going to be enough?

[screen317]

Hi,

Kill that process in Task Manager.

If a log isn't produced, reboot.

Delete your copy of ComboFix. Grab a fresh copy and save it to your Desktop, but do not run it yet. Before you download it, rename it to sega.com

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command exactly as shown:

"%userprofile%\desktop\sega.com" /killall /nombr

See if it will run successfully now. Stop it after half an hour of no activity.

[gonlaz]

thanks, so this time I was able to get a full report, just got a fresh combofix copy, here are the reports from combofix and dds

ComboFix 11-09-01.03 - Owner 09/01/2011 19:20:57.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2609 [GMT -4:00]

Running from: c:\documents and settings\Owner\My Documents\Downloads\ComboFix.exe

FW: AVG Firewall *Disabled* {8decf618-9569-4340-b34a-d78d28969b66}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\Owner\Application Data\41CA.786

C:\install.exe

C:\LOG3AB.tmp

C:\readme.txt

c:\windows\system32\Cache

c:\windows\system32\drivers\etc\hosts.txt

c:\windows\system32\sens32.dll

C:\xcrashdump.dat

.

.

((((((((((((((((((((((((( Files Created from 2011-08-01 to 2011-09-01 )))))))))))))))))))))))))))))))

.

.

2011-09-01 23:16 . 2011-09-01 23:16 -------- d-----w- c:\windows\LastGood.Tmp

2011-08-30 00:45 . 2011-08-30 00:45 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG10

2011-08-30 00:43 . 2011-09-01 23:23 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVG10

2011-08-30 00:43 . 2011-09-01 23:17 -------- d-----w- c:\windows\system32\drivers\AVG

2011-08-30 00:39 . 2011-09-01 23:18 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\MFAData

2011-08-27 06:00 . 2011-08-27 06:01 -------- d-----w- C:\14915ad5f07afd0a97b8b8068c

2011-08-27 04:33 . 2011-08-27 04:33 -------- d-----w- c:\program files\Audacity

2011-08-20 20:29 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys

2011-08-20 20:29 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-18 23:15 . 2011-08-18 23:15 -------- d-----w- c:\documents and settings\Administrator.HOMEPC\Local Settings\Application Data\ATI

2011-08-18 23:15 . 2011-08-18 23:15 -------- d-----w- c:\documents and settings\Administrator.HOMEPC\Application Data\ATI

2011-08-14 20:29 . 2011-08-14 20:29 -------- d-----w- c:\windows\system32\custom matrices

2011-08-14 01:08 . 2011-08-17 03:45 -------- d-----w- c:\windows\system32\C2MP

2011-08-14 01:08 . 2011-08-14 01:08 -------- d-----w- c:\windows\system32\QuickTime

2011-08-13 03:39 . 2011-08-14 01:44 -------- d-----w- c:\documents and settings\Owner\Application Data\DivX

2011-08-13 03:35 . 2011-08-13 03:43 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\DivX

2011-08-09 16:01 . 2011-08-17 03:45 -------- d-----w- c:\program files\Pando Networks

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-07-31 18:47 . 2011-07-31 18:47 3577856 ----a-w- c:\windows\system32\ffdshow.ax

2011-07-31 18:31 . 2011-07-31 18:31 3854848 ----a-w- c:\windows\system32\ffmpeg.dll

2011-07-19 19:08 . 2011-07-19 19:08 74752 ----a-w- c:\windows\system32\ff_vfw.dll

2011-07-19 19:06 . 2011-07-19 19:06 259584 ----a-w- c:\windows\system32\TomsMoComp_ff.dll

2011-07-19 19:06 . 2011-07-19 19:06 158208 ----a-w- c:\windows\system32\ff_unrar.dll

2011-07-19 19:06 . 2011-07-19 19:06 96768 ----a-w- c:\windows\system32\ff_wmv9.dll

2011-07-19 19:06 . 2011-07-19 19:06 1524224 ----a-w- c:\windows\system32\ff_samplerate.dll

2011-07-19 19:06 . 2011-07-19 19:06 145920 ----a-w- c:\windows\system32\ff_libmad.dll

2011-07-19 19:06 . 2011-07-19 19:06 136704 ----a-w- c:\windows\system32\libmpeg2_ff.dll

2011-07-19 19:06 . 2011-07-19 19:06 113664 ----a-w- c:\windows\system32\ff_liba52.dll

2011-07-19 19:06 . 2011-07-19 19:06 327680 ----a-w- c:\windows\system32\ff_libfaad2.dll

2011-07-19 19:06 . 2011-07-19 19:06 211456 ----a-w- c:\windows\system32\ff_libdts.dll

2011-07-15 13:29 . 2007-11-12 16:44 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2004-08-04 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-07-06 23:52 . 2009-12-24 04:20 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 23:52 . 2009-12-24 04:20 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-02 03:38 . 2010-04-17 13:08 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-24 14:10 . 2009-11-11 19:48 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:33 . 2007-12-12 09:51 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:33 . 2007-12-07 02:01 919552 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:33 . 2007-12-07 02:01 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:19 . 2007-12-12 09:51 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2007-12-13 04:42 293376 ----a-w- c:\windows\system32\winsrv.dll

2009-06-04 00:22 . 2009-06-05 12:22 44 ---ha-w- c:\program files\3a7b80af.tmp

2008-02-08 01:46 . 2008-02-08 01:46 13624 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll

2008-02-08 01:46 . 2008-02-08 01:46 87360 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll

2008-02-08 01:46 . 2008-02-08 01:46 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll

2008-02-08 01:46 . 2008-02-08 01:46 21824 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll

2008-02-08 01:46 . 2008-02-08 01:46 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll

2008-02-08 01:46 . 2008-02-08 01:46 31544 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll

2008-02-08 01:46 . 2008-02-08 01:46 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll

2007-03-16 21:27 . 2007-03-16 21:27 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll

2007-03-16 21:27 . 2007-03-16 21:27 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll

2007-03-16 21:27 . 2007-03-16 21:27 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll

2007-07-20 16:47 . 2007-07-20 16:47 981170 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll

2008-02-08 01:46 . 2008-02-08 01:46 24384 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]

"RTHDCPL"="RTHDCPL.EXE" [2010-04-30 19523616]

"NUSB3MON"="c:\program files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-03-30 113296]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-03-09 98304]

"98614 Wireless Keyboard and Mouse Combo"="c:\program files\98614 Thin-Profile Keyboard & Mouse\Wireless KeyboardKM.exe" [2010-12-16 45056]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=SUEzRjMtTUszQkstNE1CSFotUUg2TEYtVEZPSzctMg&inst=NzYtOTEwMDgzODI2LUZQOSs2LUJBUjlHKzEtVEI5KzItRkwrOS1YTzM2KzEtRjlNN0MrNS1GOU0xMEIrMS1YTzkrMS1GOU0yKzEtRERUKzU2NDQ4LUREOTBGKzEtU1Q5MEZBUFArMS1TVDEwQVBQKzEtREQxMCsx∏=94&ver=10.0.1392" [?]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\6to4]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^CurseClientStartup.ccip]

path=c:\documents and settings\Owner\Start Menu\Programs\Startup\CurseClientStartup.ccip

backup=c:\windows\pss\CurseClientStartup.ccipStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37 932288 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 09:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccleaner]

2010-12-21 21:42 2162488 ----a-w- c:\program files\CCleaner\CCleaner.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-03-26 05:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2009-11-10 20:39 5244216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 --sh--w- c:\program files\messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVMixerTray]

2004-10-07 22:53 131072 ----a-w- c:\program files\NVIDIA Corporation\NvMixer\NvMixerTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-18 01:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-10-29 19:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"JavaQuickStarterService"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=

"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=

"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=

"c:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Documents and Settings\\Owner\\Desktop\\utorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Documents and Settings\\Owner\\Local Settings\\Apps\\2.0\\MGHGC2AT.WYD\\J97J6RM5.92P\\curs..tion_eee711038731a406_0004.0000_0d453ed5fea2fe48\\CurseClient.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

"3389:TCP"= 3389:TCP:Remote Desktop

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

"4614:TCP"= 4614:TCP:Services

"7728:TCP"= 7728:TCP:Services

"6881:TCP"= 6881:TCP:Blizzard Downloader: 6881

.

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2/24/2010 11:09 AM 60544]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2/24/2010 11:09 AM 141568]

R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [10/23/2010 4:04 AM 30392]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/25/2010 5:59 PM 136176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [10/23/2010 3:55 AM 1691480]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/25/2010 5:59 PM 136176]

S3 MSICDSetup;MSICDSetup;\??\d:\cdriver.sys --> d:\CDriver.sys [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [11/11/2009 6:34 PM 691696]

.

Contents of the 'Scheduled Tasks' folder

.

2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-25 21:59]

.

2011-09-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-25 21:59]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.my.yahoo.com/

uInternet Connection Wizard,ShellNext = hxxp://thepiratebay.org/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 65.32.5.111 65.32.5.112

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

MSConfigStartUp-AVG9_TRAY - c:\progra~1\AVG\AVG9\avgtray.exe

MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\DTLite.exe

MSConfigStartUp-uTorrent - c:\program files\utorrent\utorrent.exe

MSConfigStartUp-ZoneAlarm Client - c:\program files\Zone Labs\ZoneAlarm\zlclient.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-09-01 19:25

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6to4]

"ServiceDll"="c:\windows\Offline Web Pages\cache.txt"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(772)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\atiadlxx.dll

.

- - - - - - - > 'explorer.exe'(3304)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\RTHDCPL.EXE

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2011-09-01 19:27:57 - machine was rebooted

ComboFix-quarantined-files.txt 2011-09-01 23:27

.

Pre-Run: 55,884,840,960 bytes free

Post-Run: 56,028,782,592 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

.

- - End Of File - - 6900F5A71DABB0162F0C0D9EAD6DA8E6

.

DDS (Ver_2011-06-23.01) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Owner at 19:34:29 on 2011-09-01

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3327.2782 [GMT -4:00]

.

FW: AVG Firewall *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files\98614 Thin-Profile Keyboard & Mouse\Wireless KeyboardKM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\wscntfy.exe

svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.my.yahoo.com/

uInternet Connection Wizard,ShellNext = hxxp://thepiratebay.org/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: ChromeFrame BHO: {ecb3c477-1a0a-44bd-bb57-78f9efe34fa7} - c:\program files\google\chrome frame\application\13.0.782.218\npchrome_frame.dll

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NUSB3MON] "c:\program files\nec electronics\usb 3.0 host controller driver\application\nusb3mon.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [98614 Wireless Keyboard and Mouse Combo] c:\program files\98614 thin-profile keyboard & mouse\Wireless KeyboardKM.exe

mRunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=SUEzRjMtTUszQkstNE1CSFotUUg2TEYtVEZPSzctMg"&"inst=NzYtOTEwMDgzODI2LUZQOSs2LUJBUjlHKzEtVEI5KzItRkwrOS1YTzM2KzEtRjlNN0MrNS1GOU0xMEIrMS1YTzkrMS1GOU0yKzEtRERUKzU2NDQ4LUREOTBGKzEtU1Q5MEZBUFArMS1TVDEwQVBQKzEtREQxMCsx"&"prod=94"&"ver=10.0.1392

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1257973540671

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1257973534406

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

TCP: DhcpNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{4309B31F-4BB4-48C1-90DC-81E75F5C3615} : DhcpNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{B7C0CD40-89A2-4F30-9819-1A71CDC62CB7} : DhcpNameServer = 65.32.5.111 65.32.5.112

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - c:\program files\google\chrome frame\application\13.0.782.218\npchrome_frame.dll

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

.

============= SERVICES / DRIVERS ===============

.

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2010-2-24 60544]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2010-2-24 141568]

R3 usbfilter;AMD USB Filter Driver;c:\windows\system32\drivers\usbfilter.sys [2010-10-23 30392]

S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-25 136176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-10-23 1691480]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-25 136176]

S3 MSICDSetup;MSICDSetup;\??\d:\cdriver.sys --> d:\CDriver.sys [?]

.

=============== Created Last 30 ================

.

2011-09-01 23:20:10 -------- d-sha-r- C:\cmdcons

2011-09-01 23:19:13 518144 ----a-w- c:\windows\SWREG.exe

2011-09-01 23:19:13 256000 ----a-w- c:\windows\PEV.exe

2011-09-01 23:19:13 208896 ----a-w- c:\windows\MBR.exe

2011-09-01 23:19:12 98816 ----a-w- c:\windows\sed.exe

2011-08-30 00:45:43 -------- d-----w- c:\documents and settings\owner\application data\AVG10

2011-08-30 00:43:29 -------- d-----w- c:\windows\system32\drivers\AVG

2011-08-30 00:43:29 -------- d-----w- c:\documents and settings\all users.windows\application data\AVG10

2011-08-30 00:39:01 -------- d-----w- c:\documents and settings\all users.windows\application data\MFAData

2011-08-27 06:00:13 -------- d-----w- C:\14915ad5f07afd0a97b8b8068c

2011-08-27 04:33:35 -------- d-----w- c:\program files\Audacity

2011-08-20 20:29:35 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys

2011-08-20 20:29:14 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-14 20:29:27 -------- d-----w- c:\windows\system32\custom matrices

2011-08-14 01:08:54 -------- d-----w- c:\windows\system32\QuickTime

2011-08-14 01:08:54 -------- d-----w- c:\windows\system32\C2MP

2011-08-13 03:35:05 -------- d-----w- c:\documents and settings\all users.windows\application data\DivX

2011-08-09 16:01:58 -------- d-----w- c:\program files\Pando Networks

.

==================== Find3M ====================

.

2011-07-31 18:47:46 3577856 ----a-w- c:\windows\system32\ffdshow.ax

2011-07-31 18:31:38 3854848 ----a-w- c:\windows\system32\ffmpeg.dll

2011-07-19 19:08:04 74752 ----a-w- c:\windows\system32\ff_vfw.dll

2011-07-19 19:06:48 259584 ----a-w- c:\windows\system32\TomsMoComp_ff.dll

2011-07-19 19:06:36 158208 ----a-w- c:\windows\system32\ff_unrar.dll

2011-07-19 19:06:34 96768 ----a-w- c:\windows\system32\ff_wmv9.dll

2011-07-19 19:06:34 1524224 ----a-w- c:\windows\system32\ff_samplerate.dll

2011-07-19 19:06:32 145920 ----a-w- c:\windows\system32\ff_libmad.dll

2011-07-19 19:06:30 136704 ----a-w- c:\windows\system32\libmpeg2_ff.dll

2011-07-19 19:06:30 113664 ----a-w- c:\windows\system32\ff_liba52.dll

2011-07-19 19:06:28 327680 ----a-w- c:\windows\system32\ff_libfaad2.dll

2011-07-19 19:06:28 211456 ----a-w- c:\windows\system32\ff_libdts.dll

2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-07-06 23:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-06 23:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-07-02 03:38:18 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:33:49 919552 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:33:49 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:33:49 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:19:29 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll

2009-06-04 00:22:54 44 ---ha-w- c:\program files\3a7b80af.tmp

.

============= FINISH: 19:34:43.98 ===============

[screen317]

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

[gonlaz]

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=6d7d4ca86e0c4c4788dc2c040b4a000c

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-07 03:02:41

# local_time=2011-09-06 11:02:41 (-0500, Eastern Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 45594451 45594451 0 0

# compatibility_mode=1024 16777175 100 0 354818 354818 0 0

# compatibility_mode=8192 67108863 100 0 61657166 61657166 0 0

# scanned=83895

# found=1

# cleaned=1

# scan_time=2323

C:\Documents and Settings\Owner\My Documents\Downloads\cnet_DTLite4402-0131_exe.exe a variant of Win32/InstallCore.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Results of screen317's Security Check version 0.99.18

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

AVG 2012

ESET Online Scanner v3

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

HijackThis 2.0.2

CCleaner

Java 6 Update 24

Out of date Java installed!

Flash Player Out of Date!

Adobe Flash Player 10.1.102.64

````````````````````````````````

Process Check:

objlist.exe by Laurent

AVG avgwdsvc.exe

AVG avgtray.exe

AVG avgrsx.exe

AVG avgnsx.exe

AVG avgemc.exe

``````````End of Log````````````

I appreciate your time - things seem to be going well, no issues that I can see. Can you tell me what you've found in these logs?

[screen317]

Hi,

Things are looking good.

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program(s) (if present):

ESET Online Scanner v3

HijackThis 2.0.2

Java™ 6 Update 24

Adobe Reader 9.0

Adobe Flash Player 10.1.102.64

Restart your computer.

Get the latest version of Java, Adobe Reader, and Adobe Flash Player.

Let me know what issues remain.

-screen317

[gonlaz]

No problems that I notice. Still curious as to what it was causing the facebook and google shut down. I appreciate the time you took for the issue, thank you

[screen317]

At this point it may have been a combination of factors including malware.

If there are no other issues, then I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[gonlaz]

At this point it may have been a combination of factors including malware.

If there are no other issues, then I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

awesome, thanks. I already run spyware blaster but will definitely upgrade my mbam and check out all the other information you've given me. thanks again!

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!