Google Redirect

KonaDog · September 10, 2011

Hello I can't remove a Google redirect malware. I have tried Malwarebytes several times and the symptoms keep reappearing.

Suspicious clues Trojan.BHO, ui.mevio.com (keeps appearing in my LSO manager despite deleting) and I have doubts about helpupdt32.exe.

Thanks for your help!

***DDS.txt contents***

.

DDS (Ver_2011-08-26.01) - FAT32x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Run by Chuck at 11:34:26 on 2011-09-10

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.324 [GMT -5:00]

.

AV: Trend Micro Titanium Internet Security *Enabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

FW: Trend Micro Firewall Booster *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

SVCHOST.EXE

C:\WINDOWS\System32\svchost.exe -k netsvcs

SVCHOST.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\acer\epm\epm-dm.exe

C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Documents and Settings\Chuck\Application Data\Help\HelpUpdate\Helpupdt32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN

SVCHOST.EXE

C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe

C:\Acer\eManager\anbmServ.exe

C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

SVCHOST.EXE

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\Pen_Tablet.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\Pen_Tablet.exe

C:\Program Files\Mozilla Firefox\firefox.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/

BHO: {038197c3-4c61-44eb-ad2d-31ea01aedda7} - c:\windows\system32\wscui32.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1081\TmIEPlg.dll

BHO: TmBpIeBHO Class: {bbacbafd-fa5e-4079-8b33-00eb9f13d4ac} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [HelpUpdate] c:\documents and settings\chuck\application data\help\helpupdate\Helpupdt32.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [LaunchApp] Alaunch

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [EPM-DM] c:\acer\epm\epm-dm.exe

mRun: [ePowerManagement] c:\acer\epm\ePM.exe boot

mRun: [Logitech Utility] Logi_MwX.Exe

mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe

mRun: [MMTray] c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"

mRun: [Trend Micro Titanium] "c:\program files\trend micro\titanium\uiframework\uiWinMgr.exe" -set Silent "1" SplashURL ""

mRun: [Trend Micro Client Framework] "c:\program files\trend micro\uniclient\uifrmwrk\UIWatchDog.exe"

dRun: [HelpUpdate] c:\documents and settings\chuck\application data\help\helpupdate\Helpupdt32.exe

StartupFolder: c:\docume~1\chuck\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 2.4\program\quickstart.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\Hotsync.exe

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272210401840

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272210391726

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

TCP: Interfaces\{2C481061-1C9B-4471-B281-7828F9FEA274} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - c:\program files\trend micro\amsp\module\20002\6.6.1010\6.6.1010\TmBpIe32.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\amsp\module\20004\1.5.1464\6.6.1081\TmIEPlg.dll

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\chuck\application data\mozilla\firefox\profiles\9yqavl2q.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60531.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

.

============= SERVICES / DRIVERS ===============

.

R1 SMBHC;Microsoft SM Bus Host Controller Driver;c:\windows\system32\drivers\smbhc.sys [2004-8-30 6784]

R2 Amsp;Trend Micro Solution Platform;c:\program files\trend micro\amsp\coreServiceShell.exe [2011-1-17 188272]

R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2010-1-16 3032360]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2011-1-17 64080]

R3 SMBBATT;Microsoft Smart Battery Driver;c:\windows\system32\drivers\smbbatt.sys [2004-8-30 16000]

R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2011-1-17 341072]

S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2010-1-16 15144]

.

=============== Created Last 30 ================

.

2011-09-10 15:36:57 -------- d-sh--w- C:\Recycled

2011-09-10 06:20:34 0 ---ha-w- c:\documents and settings\chuck\yylwzsqdqu.tmp

2011-09-09 19:46:51 282112 ----a-w- c:\windows\system32\wscui32.dll

.

==================== Find3M ====================

.

2011-08-14 04:10:32 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-07-07 00:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-07 00:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-26 06:45:56 256000 ----a-w- c:\windows\PEV.exe

.

============= FINISH: 11:35:21.76 ===============

***mbam log***

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Database version: 7685

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 8.0.6001.18702

9/10/2011 10:48:09 AM

mbam-log-2011-09-10 (10-48-08).txt

Scan type: Quick scan

Objects scanned: 174302

Time elapsed: 5 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

screen317 · September 13, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

KonaDog · September 14, 2011

First thanks for your help.

I think I am virus clear. I copied many of the kill sequences mentioned in other posts, but the virus kept coming back. Sometimes I think I had it cleared only to see it come back. Finally, I read a post that said to start with rkill. For me, the rkill was the difference maker.

I think these are the steps I took (you may have a better sequence):

1.rkill.exe

2.mbam

3.defogger disable

4.ATFcleaner.exe

5.tdsskiller.exe

6.GooredFix.exe

7.Combofix.exe

8.Eset-Esetonline Scanner (enable scripts in IE)

9.Spybot-Search and Destroy

10. defogger enable

What should I run so your expert eye can say I am clear? Also, what are you looking for in our log posts beside no virus found.

Thanks for your time!

KonaDog · September 14, 2011

Do I need to worry about being "back doored" like the forum post "I can not remove browser hijacker"

My mbam symptom was...

Registry Keys Infected:

HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

screen317 · September 16, 2011

Please post the ComboFix report so I may make a better estimate of the situation at hand.

KonaDog · September 18, 2011

ComboFix 11-09-18.03 - Chuck 09/18/2011 16:03:52.12.1 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1006.623 [GMT -5:00]

Running from: c:\documents and settings\Chuck\My Documents\Downloads\AntiMalware\ComboFix.exe

AV: Trend Micro Titanium Internet Security *Disabled/Updated* {7D2296BC-32CC-4519-917E-52E652474AF5}

FW: Trend Micro Firewall Booster *Disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Microsoft Office\OFFICE11\OSA.exe

c:\windows\$MSI31Uninstall_KB893803v2$

c:\windows\$MSI31Uninstall_KB893803v2$\msi.dll

c:\windows\$MSI31Uninstall_KB893803v2$\msiexec.exe

c:\windows\$MSI31Uninstall_KB893803v2$\msihnd.dll

c:\windows\$MSI31Uninstall_KB893803v2$\msimsg.dll

c:\windows\$MSI31Uninstall_KB893803v2$\msisip.dll

c:\windows\$MSI31Uninstall_KB893803v2$\reg00013

c:\windows\$MSI31Uninstall_KB893803v2$\reg00014

c:\windows\$MSI31Uninstall_KB893803v2$\reg00015

c:\windows\$MSI31Uninstall_KB893803v2$\reg00016

c:\windows\$MSI31Uninstall_KB893803v2$\reg00017

c:\windows\$MSI31Uninstall_KB893803v2$\reg00018

c:\windows\$MSI31Uninstall_KB893803v2$\reg00019

c:\windows\$MSI31Uninstall_KB893803v2$\reg00020

c:\windows\$MSI31Uninstall_KB893803v2$\reg00021

c:\windows\$MSI31Uninstall_KB893803v2$\reg00022

c:\windows\$MSI31Uninstall_KB893803v2$\reg00023

c:\windows\$MSI31Uninstall_KB893803v2$\reg00024

c:\windows\$MSI31Uninstall_KB893803v2$\reg00025

c:\windows\$MSI31Uninstall_KB893803v2$\reg00026

c:\windows\$MSI31Uninstall_KB893803v2$\reg00027

c:\windows\$MSI31Uninstall_KB893803v2$\reg00028

c:\windows\$MSI31Uninstall_KB893803v2$\reg00029

c:\windows\$MSI31Uninstall_KB893803v2$\reg00030

c:\windows\$MSI31Uninstall_KB893803v2$\reg00031

c:\windows\$MSI31Uninstall_KB893803v2$\reg00032

c:\windows\$MSI31Uninstall_KB893803v2$\reg00033

c:\windows\$MSI31Uninstall_KB893803v2$\reg00034

c:\windows\$MSI31Uninstall_KB893803v2$\reg00035

c:\windows\$MSI31Uninstall_KB893803v2$\reg00036

c:\windows\$MSI31Uninstall_KB893803v2$\reg00037

c:\windows\$MSI31Uninstall_KB893803v2$\reg00038

c:\windows\$MSI31Uninstall_KB893803v2$\reg00039

c:\windows\$MSI31Uninstall_KB893803v2$\reg00040

c:\windows\$MSI31Uninstall_KB893803v2$\reg00041

c:\windows\$MSI31Uninstall_KB893803v2$\reg00042

c:\windows\$MSI31Uninstall_KB893803v2$\reg00043

c:\windows\$MSI31Uninstall_KB893803v2$\reg00044

c:\windows\$MSI31Uninstall_KB893803v2$\reg00045

c:\windows\$MSI31Uninstall_KB893803v2$\reg00046

c:\windows\$MSI31Uninstall_KB893803v2$\reg00047

c:\windows\$MSI31Uninstall_KB893803v2$\reg00048

c:\windows\$MSI31Uninstall_KB893803v2$\reg00051

c:\windows\$MSI31Uninstall_KB893803v2$\reg00052

c:\windows\$MSI31Uninstall_KB893803v2$\reg00053

c:\windows\$MSI31Uninstall_KB893803v2$\reg00054

c:\windows\$MSI31Uninstall_KB893803v2$\reg00055

c:\windows\$MSI31Uninstall_KB893803v2$\reg00056

c:\windows\$MSI31Uninstall_KB893803v2$\reg00057

c:\windows\$MSI31Uninstall_KB893803v2$\reg00058

c:\windows\$MSI31Uninstall_KB893803v2$\reg00059

c:\windows\$MSI31Uninstall_KB893803v2$\reg00060

c:\windows\$MSI31Uninstall_KB893803v2$\reg00061

c:\windows\$MSI31Uninstall_KB893803v2$\reg00062

c:\windows\$MSI31Uninstall_KB893803v2$\reg00063

c:\windows\$MSI31Uninstall_KB893803v2$\reg00064

c:\windows\$MSI31Uninstall_KB893803v2$\reg00065

c:\windows\$MSI31Uninstall_KB893803v2$\reg00066

c:\windows\$MSI31Uninstall_KB893803v2$\reg00067

c:\windows\$MSI31Uninstall_KB893803v2$\reg00068

c:\windows\$MSI31Uninstall_KB893803v2$\reg00069

c:\windows\$MSI31Uninstall_KB893803v2$\reg00070

c:\windows\$MSI31Uninstall_KB893803v2$\reg00071

c:\windows\$MSI31Uninstall_KB893803v2$\reg00072

c:\windows\$MSI31Uninstall_KB893803v2$\reg00073

c:\windows\$MSI31Uninstall_KB893803v2$\reg00074

c:\windows\$MSI31Uninstall_KB893803v2$\reg00075

c:\windows\$MSI31Uninstall_KB893803v2$\reg00076

c:\windows\$MSI31Uninstall_KB893803v2$\reg00077

c:\windows\$MSI31Uninstall_KB893803v2$\reg00078

c:\windows\$MSI31Uninstall_KB893803v2$\reg00079

c:\windows\$MSI31Uninstall_KB893803v2$\reg00080

c:\windows\$MSI31Uninstall_KB893803v2$\reg00081

c:\windows\$MSI31Uninstall_KB893803v2$\reg00082

c:\windows\$MSI31Uninstall_KB893803v2$\reg00083

c:\windows\$MSI31Uninstall_KB893803v2$\reg00084

c:\windows\$MSI31Uninstall_KB893803v2$\reg00085

c:\windows\$MSI31Uninstall_KB893803v2$\reg00086

c:\windows\$MSI31Uninstall_KB893803v2$\reg00087

c:\windows\$MSI31Uninstall_KB893803v2$\reg00088

c:\windows\$MSI31Uninstall_KB893803v2$\reg00089

c:\windows\$MSI31Uninstall_KB893803v2$\reg00090

c:\windows\$MSI31Uninstall_KB893803v2$\reg00091

c:\windows\$MSI31Uninstall_KB893803v2$\reg00092

c:\windows\$MSI31Uninstall_KB893803v2$\reg00093

c:\windows\$MSI31Uninstall_KB893803v2$\reg00094

c:\windows\$MSI31Uninstall_KB893803v2$\reg00095

c:\windows\$MSI31Uninstall_KB893803v2$\reg00096

c:\windows\$MSI31Uninstall_KB893803v2$\reg00097

c:\windows\$MSI31Uninstall_KB893803v2$\reg00098

c:\windows\$MSI31Uninstall_KB893803v2$\reg00099

c:\windows\$MSI31Uninstall_KB893803v2$\reg00100

c:\windows\$MSI31Uninstall_KB893803v2$\reg00101

c:\windows\$MSI31Uninstall_KB893803v2$\reg00102

c:\windows\$MSI31Uninstall_KB893803v2$\reg00103

c:\windows\$MSI31Uninstall_KB893803v2$\reg00104

c:\windows\$MSI31Uninstall_KB893803v2$\reg00105

c:\windows\$MSI31Uninstall_KB893803v2$\reg00106

c:\windows\$MSI31Uninstall_KB893803v2$\reg00107

c:\windows\$MSI31Uninstall_KB893803v2$\reg00108

c:\windows\$MSI31Uninstall_KB893803v2$\reg00109

c:\windows\$MSI31Uninstall_KB893803v2$\reg00110

c:\windows\$MSI31Uninstall_KB893803v2$\reg00111

c:\windows\$MSI31Uninstall_KB893803v2$\reg00112

c:\windows\$MSI31Uninstall_KB893803v2$\reg00113

c:\windows\$MSI31Uninstall_KB893803v2$\reg00114

c:\windows\$MSI31Uninstall_KB893803v2$\reg00115

c:\windows\$MSI31Uninstall_KB893803v2$\reg00116

c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe

c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.inf

c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.txt

c:\windows\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll

.

((((((((((((((((((((((((( Files Created from 2011-08-18 to 2011-09-18 )))))))))))))))))))))))))))))))

.

2011-09-14 20:04 . 2011-09-14 20:04 -------- d-----w- c:\documents and settings\Chuck\Local Settings\Application Data\NPE

2011-09-14 20:04 . 2011-09-14 20:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

2011-09-12 12:35 . 2011-09-12 12:35 -------- d-----w- C:\WTablet

2011-09-11 15:41 . 2011-09-11 15:41 -------- d-----w- c:\program files\ESET

2011-09-11 05:07 . 2011-09-11 05:07 388096 ----a-r- c:\documents and settings\Chuck\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-09-11 04:22 . 2011-09-11 04:22 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-09-11 04:22 . 2011-09-11 04:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-09-11 02:45 . 2011-07-19 10:05 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

2011-09-11 02:45 . 2011-07-19 10:05 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-10 21:24 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys

2011-09-10 21:24 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys

2011-09-10 21:23 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys

2011-09-10 19:43 . 2011-09-10 20:16 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-09-03 10:17 . 2011-09-03 10:17 599040 ------w- c:\windows\system32\dllcache\crypt32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-03 10:17 . 1980-01-01 05:00 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-07-19 07:40 . 2007-04-13 14:56 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-07-15 13:29 . 1980-01-01 05:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 1980-01-01 05:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-07-07 00:52 . 2011-01-17 19:16 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-07-07 00:52 . 2011-01-17 19:16 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-24 14:10 . 2004-08-30 16:44 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:36 . 1980-01-01 05:00 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:36 . 1980-01-01 05:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:36 . 1980-01-01 05:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 1980-01-01 05:00 385024 ----a-w- c:\windows\system32\html.iec

2009-12-08 22:41 . 2009-12-08 22:41 27960 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2009-12-08 22:41 . 2009-12-08 22:41 126344 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2009-12-08 22:42 . 2009-12-08 22:42 46392 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

2011-02-01 16:08 . 2011-02-01 16:08 98696 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

2011-09-08 14:13 . 2011-05-06 03:42 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LaunchApp"="Alaunch" [X]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-21 98304]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-21 532480]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-21 40960]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-11 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-02-11 118784]

"EPM-DM"="c:\acer\epm\epm-dm.exe" [2004-07-14 151552]

"ePowerManagement"="c:\acer\ePM\ePM.exe" [2004-09-01 2876416]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]

"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-01 53248]

"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2003-10-01 114688]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2011-02-17 1111568]

"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-02-10 116752]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

.

c:\documents and settings\Chuck\Start Menu\Programs\Startup\

OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-6-9 471040]

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

.

R1 SMBHC;Microsoft SM Bus Host Controller Driver;c:\windows\system32\drivers\smbhc.sys [8/30/2004 11:42 AM 6784]

R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [1/16/2010 9:27 AM 3032360]

R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [1/17/2011 2:01 PM 64080]

R3 SMBBATT;Microsoft Smart Battery Driver;c:\windows\system32\drivers\smbbatt.sys [8/30/2004 11:42 AM 16000]

R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [1/17/2011 2:09 PM 341072]

S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe [1/17/2011 1:59 PM 188272]

S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [1/16/2010 9:27 AM 15144]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

FF - ProfilePath - c:\documents and settings\Chuck\Application Data\Mozilla\Firefox\Profiles\9yqavl2q.default\

FF - prefs.js: network.proxy.type - 0

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-09-18 16:09

Windows 5.1.2600 Service Pack 3 FAT NTAPI

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2\Parameters]

@DACL=(02 0000)

@SACL=

"WinSock_Registry_Version"="2.0"

"Current_Protocol_Catalog"="Protocol_Catalog9"

"Current_NameSpace_Catalog"="NameSpace_Catalog5"

.

Completion time: 2011-09-18 16:10:20

ComboFix-quarantined-files.txt 2011-09-18 21:10

ComboFix2.txt 2011-09-16 14:54

ComboFix3.txt 2011-09-15 13:13

ComboFix4.txt 2011-09-14 13:45

ComboFix5.txt 2011-09-18 21:03

.

Pre-Run: 21,279,866,880 bytes free

Post-Run: 21,261,025,280 bytes free

.

- - End Of File - - 45A3B6940C0E2AA8D3F22014AF189868

screen317 · September 22, 2011

Hi,

I do not see any evidence of a backdoor trojan.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

KonaDog · September 26, 2011

Results of screen317's Security Check version 0.99.18

Windows XP Service Pack 3

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

Trend Micro Titanium Internet Security

Trend Micro™ Titanium™ Internet Security

Antivirus up to date!

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 27

Java SE Runtime Environment 6 Update 1

Java 6 Update 2

Java 6 Update 3

Java 6 Update 4

Java 6 Update 7

Out of date Java installed!

Adobe Flash Player 10.3.183.10

````````````````````````````````

Process Check:

objlist.exe by Laurent

Chuck My Documents Downloads AntiMalware\SecurityCheck.exe

Trend Micro AMSP coreServiceShell.exe

Trend Micro UniClient UiFrmWrk uiWatchDog.exe

Trend Micro AMSP coreFrameworkHost.exe

Trend Micro UniClient UiFrmWrk uiSeAgnt.exe

``````````End of Log````````````

KonaDog · September 26, 2011

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-11 04:54:18

# local_time=2011-09-11 11:54:18 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210244637 210244637 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=103297

# found=4

# cleaned=4

# scan_time=4079

C:\Documents and Settings\Chuck\Application Data\Mozilla\Firefox\Profiles\9yqavl2q.default\extensions\{3c4df743-f1d2-4e71-a598-773fb3ec973a}\chrome.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1687\A0246937.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1687\A0246938.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247030.manifest Win32/TrojanDownloader.Tracur.F trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=stopped

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-11 10:52:46

# local_time=2011-09-11 05:52:46 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210263888 210263888 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=65880

# found=1

# cleaned=1

# scan_time=6335

C:\WINDOWS\system32\wscui32.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-11 11:59:43

# local_time=2011-09-11 06:59:43 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210270297 210270297 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102049

# found=4

# cleaned=4

# scan_time=3946

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247113.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247114.exe a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247147.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1684\A0245048.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-12 01:04:30

# local_time=2011-09-11 08:04:30 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210274444 210274444 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102053

# found=0

# cleaned=0

# scan_time=3686

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-12 03:09:45

# local_time=2011-09-11 10:09:45 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210282013 210282013 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102118

# found=0

# cleaned=0

# scan_time=3630

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-12 02:11:36

# local_time=2011-09-12 09:11:36 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777191 100 0 210322122 210322122 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102497

# found=0

# cleaned=0

# scan_time=3231

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-13 02:32:16

# local_time=2011-09-13 09:32:16 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777191 100 0 210409753 210409753 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=103050

# found=0

# cleaned=0

# scan_time=3241

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-14 02:44:02

# local_time=2011-09-14 09:44:02 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777191 100 0 210497832 210497832 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=103495

# found=0

# cleaned=0

# scan_time=2267

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-15 01:55:42

# local_time=2011-09-15 08:55:42 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777191 100 0 210581372 210581372 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102430

# found=0

# cleaned=0

# scan_time=2229

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-16 02:10:53

# local_time=2011-09-16 09:10:53 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 210666964 210666964 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=102892

# found=0

# cleaned=0

# scan_time=3946

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-20 10:40:23

# local_time=2011-09-20 05:40:23 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 211036163 211036163 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=104699

# found=0

# cleaned=0

# scan_time=10919

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=cc11f0f246a1f74897ec207605f9c357

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-09-22 09:00:12

# local_time=2011-09-22 04:00:12 (-0600, Central Daylight Time)

# country="United States"

# lang=9

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777175 100 0 211209654 211209654 0 0

# compatibility_mode=8192 67108863 100 0 43682 43682 0 0

# scanned=104497

# found=0

# cleaned=0

# scan_time=4216

KonaDog · September 26, 2011

No problems or symptoms at this time. Thanks for your help.

These lines are from the ESET log. Do I need to worry about them? Can I delete them?

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247113.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247114.exe a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1688\A0247147.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\System Volume Information\_restore{05774A3F-854E-4C97-A185-5AFC203A9CBA}\RP1684\A0245048.dll a variant of Win32/Kryptik.SSB trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

esets_scanner_update returned -1 esets_gle=53251

screen317 · September 28, 2011

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program(s) (if present):

Java™ 6 Update 27

Adobe Reader 8.0

Restart your computer.

Get the latest version of Adobe Reader.

Let me know what issues remain.

-screen317

KonaDog · September 28, 2011

No issues. Thanks for your help!

screen317 · October 2, 2011

Great!

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

Green to go
Yellow for caution
Red to stop

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

AdvancedSetup · October 12, 2011

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Google Redirect

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information