Malware Takeover

lilgeezy24 · September 12, 2011

Hey Everyone

I seem to have the same problem as others with malware that is stopping mbam, symantec and other antivirus programs from scanning. When i try to do a scan it will scan for about 20 seconds and then automatically close.

(even in safe mode)

And when I try to re-open it I get this message...

"Windows cannot access the specified drive, path or file. You may not have the appropriate permissions to access the item."

The only thing that i have used to scan that completed is MGtools, but i dont know what to look for or how to remove it from my computer.

I would appreciate any help offered before i just re format my hardrive and instiall winXP again

I tried combofix and have a log.. it says it deleted and disinfected some things but the comp is still acting the same.

ComboFix.txt

lilgeezy24 · September 12, 2011

ComboFix 11-09-12.03 - Owner 09/12/2011 17:22:16.1.2 - x86 NETWORK

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.842 [GMT -4:00]

Running from: c:\documents and settings\Owner\Desktop\Bleeping computer downloads\ComboFix.exe

AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}

AV: Microsoft Security Essentials *Disabled/Outdated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory

c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini

c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\SL9C.tmp.5510cc53.ini

c:\documents and settings\Administrator\Start Menu\Programs\System Recovery

c:\documents and settings\Administrator\Start Menu\Programs\System Recovery\Application & Driver Recovery.lnk

c:\documents and settings\Administrator\Start Menu\Programs\System Recovery\Create my Drivers-Applications CD(s).lnk

c:\documents and settings\Administrator\Start Menu\Programs\System Recovery\System Recovery.lnk

c:\documents and settings\Administrator\WINDOWS

c:\documents and settings\All Users\Application Data\DisplayVerifierOnline.dll

c:\documents and settings\All Users\Application Data\jI09200GoNmM09200

c:\documents and settings\All Users\Application Data\jI09200GoNmM09200\jI09200GoNmM09200

c:\documents and settings\All Users\Application Data\jI09200GoNmM09200\jI09200GoNmM09200.exe

c:\documents and settings\All Users\Application Data\Tarma Installer

c:\documents and settings\All Users\Start Menu\Programs\System Recovery

c:\documents and settings\All Users\Start Menu\Programs\System Recovery\Recovery Help Manual.pdf

c:\documents and settings\Default User\WINDOWS

c:\documents and settings\Guest\WINDOWS

c:\documents and settings\NetworkService\Local Settings\Application Data\jifdorh.dll

c:\documents and settings\Owner\Application Data\2086498716582A7C3D45DF42784D1FCB

c:\documents and settings\Owner\Application Data\2086498716582A7C3D45DF42784D1FCB\enemies-names.txt

c:\documents and settings\Owner\Application Data\2086498716582A7C3D45DF42784D1FCB\hookdll.dll

c:\documents and settings\Owner\Application Data\2086498716582A7C3D45DF42784D1FCB\local.ini

c:\documents and settings\Owner\Application Data\2086498716582A7C3D45DF42784D1FCB\lsrslt.ini

c:\documents and settings\Owner\Application Data\46B4E172B37CD1CCDDD01D80B9E55993

c:\documents and settings\Owner\Application Data\46B4E172B37CD1CCDDD01D80B9E55993\enemies-names.txt

c:\documents and settings\Owner\Application Data\46B4E172B37CD1CCDDD01D80B9E55993\local.ini

c:\documents and settings\Owner\Application Data\46B4E172B37CD1CCDDD01D80B9E55993\lsrslt.ini

c:\documents and settings\Owner\Application Data\Adobe\plugs

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc101.exe

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc20.exe

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc83.exe

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc949656.txt

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc963187.txt

c:\documents and settings\Owner\Application Data\Adobe\plugs\mmc971406.txt

c:\documents and settings\Owner\Application Data\Adobe\shed

c:\documents and settings\Owner\Application Data\Adobe\shed\thr1.chm

c:\documents and settings\Owner\Application Data\hostactioncenter.exe

c:\documents and settings\Owner\Application Data\PriceGong

c:\documents and settings\Owner\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\j.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\ugyrioujvr.tmp

c:\documents and settings\Owner\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Owner\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\ehshell.exe.a87fcbb.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.2591de4.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\ngen.exe.89f695a3.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\ProcessDll.exe.cd116cf9.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\SL4D.tmp.86365231.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\SL9C.tmp.5510cc53.ini

c:\documents and settings\Owner\Local Settings\Application Data\ApplicationHistory\SVCD2DVD.exe.30e204de.ini

c:\documents and settings\Owner\Local Settings\Application Data\catcertcsc.exe

c:\documents and settings\Owner\Start Menu\Programs\System Recovery

c:\documents and settings\Owner\Start Menu\Programs\System Recovery\Application & Driver Recovery.lnk

c:\documents and settings\Owner\Start Menu\Programs\System Recovery\Create my Drivers-Applications CD(s).lnk

c:\documents and settings\Owner\Start Menu\Programs\System Recovery\System Recovery.lnk

c:\documents and settings\Owner\ugyrioujvr.tmp

c:\documents and settings\Owner\WINDOWS

c:\documents and settings\Tee\Local Settings\Application Data\ApplicationHistory

c:\documents and settings\Tee\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini

c:\documents and settings\Tee\Local Settings\Application Data\ApplicationHistory\SL9C.tmp.5510cc53.ini

c:\documents and settings\Tee\Start Menu\Programs\System Recovery

c:\documents and settings\Tee\Start Menu\Programs\System Recovery\Application & Driver Recovery.lnk

c:\documents and settings\Tee\Start Menu\Programs\System Recovery\Create my Drivers-Applications CD(s).lnk

c:\documents and settings\Tee\Start Menu\Programs\System Recovery\System Recovery.lnk

c:\documents and settings\Tee\WINDOWS

c:\program files\RegGenie

c:\program files\RegGenie\Backups\40791.7620359491

c:\program files\RegGenie\RegGenie.ini

c:\windows\$NtUninstallKB45193$

c:\windows\$NtUninstallKB45193$\2246158266

c:\windows\1043810424

c:\windows\assembly\GAC_MSIL\desktop.ini

c:\windows\ptl6ndic.dll

c:\windows\RegGenieOnUninstall.exe

c:\windows\system32\comct332.ocx

c:\windows\system32\config\systemprofile\WINDOWS

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\ReadMe.txt

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

.

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\cdrom.sys

.

Infected copy of c:\program files\SUPERAntiSpyware\SASCORE.EXE was found and disinfected

Restored copy from - c:\system volume information\_restore{4653E8F8-6519-4964-B7BD-828D96FBCC0E}\RP588\A0211509.exe

.

Infected copy of c:\progra~1\SYMANT~1\SYMANT~1\DefWatch.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{4653E8F8-6519-4964-B7BD-828D96FBCC0E}\RP588\A0209177.exe

.

Infected copy of c:\program files\Java\jre6\bin\jqs.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{4653E8F8-6519-4964-B7BD-828D96FBCC0E}\RP588\A0209178.exe

.

Infected copy of c:\program files\idt\intelxpv_v103\wdm\STacSV.exe was found and disinfected

Restored copy from - c:\windows\system32\stacsv.exe

.

Infected copy of c:\windows\system32\SearchIndexer.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{4653E8F8-6519-4964-B7BD-828D96FBCC0E}\RP588\A0209180.exe

.

Infected copy of c:\progra~1\SYMANT~1\SYMANT~1\DefWatch.exe was found and disinfected

Restored copy from - c:\system volume information\_restore{4653E8F8-6519-4964-B7BD-828D96FBCC0E}\RP588\A0209177.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_7848373e

.

((((((((((((((((((((((((( Files Created from 2011-08-12 to 2011-09-12 )))))))))))))))))))))))))))))))

.

2011-09-12 21:09 . 2011-09-12 21:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Avira

2011-09-12 18:16 . 2011-09-12 18:18 48016 --sha-w- c:\windows\system32\c_56610.nl_

2011-09-12 03:52 . 2011-09-12 03:56 -------- dc----w- C:\MGtools

2011-09-12 03:49 . 2011-07-06 23:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-09-12 03:48 . 2011-07-06 23:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-09-12 03:22 . 2011-09-12 03:22 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2011-09-05 11:34 . 2011-09-05 11:34 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Threat Expert

2011-09-05 02:03 . 2011-09-05 02:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2011-09-05 02:03 . 2011-09-05 02:03 -------- d-----w- c:\documents and settings\Owner\Application Data\PC Tools

2011-09-04 20:09 . 2011-09-04 20:09 239104 ----a-w- c:\windows\system32\wscui32.dll

2011-09-03 10:17 . 2011-09-03 10:17 599040 -c----w- c:\windows\system32\dllcache\crypt32.dll

2011-09-03 02:20 . 2011-09-03 02:20 -------- d--h--w- c:\windows\msdownld.tmp

2011-09-02 20:44 . 2011-09-02 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

2011-09-02 20:42 . 2011-09-02 21:27 -------- d-----w- c:\documents and settings\Owner\Application Data\IObit

2011-09-02 20:16 . 2011-09-02 20:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Registry Cleaner

2011-09-02 19:54 . 2011-09-02 19:54 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\AMUST

2011-09-02 19:48 . 2011-09-02 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\!SASCORE

2011-09-02 19:48 . 2011-09-12 21:33 -------- d-----w- c:\program files\SUPERAntiSpyware

2011-09-02 17:18 . 2011-09-02 17:18 4194304 ----a-w- c:\windows\system32\maaamtym.dll

2011-09-02 17:17 . 2011-09-02 17:18 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2011-09-02 15:30 . 2011-09-02 15:30 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\PackageAware

2011-09-02 05:40 . 2011-09-02 05:40 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\2K Games

2011-08-31 22:04 . 2011-08-31 22:04 -------- d-----w- c:\program files\Common Files\Steam

2011-08-31 20:43 . 2011-08-31 20:43 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Activision

2011-08-31 20:41 . 2010-06-02 08:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll

2011-08-31 20:41 . 2010-06-02 08:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll

2011-08-31 20:41 . 2010-06-02 08:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll

2011-08-31 20:41 . 2010-05-26 15:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll

2011-08-31 20:41 . 2010-05-26 15:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll

2011-08-31 20:41 . 2010-05-26 15:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll

2011-08-31 20:41 . 2010-05-26 15:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll

2011-08-31 20:41 . 2010-05-26 15:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll

2011-08-31 20:41 . 2010-02-04 14:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll

2011-08-31 20:41 . 2010-02-04 14:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll

2011-08-31 20:41 . 2010-02-04 14:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll

2011-08-31 20:41 . 2010-02-04 14:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll

2011-08-31 20:29 . 2011-08-31 20:29 -------- d-----w- c:\program files\Activision

2011-08-27 01:06 . 2011-08-27 01:06 -------- d-----w- c:\program files\Apple Software Update

2011-08-25 21:10 . 2011-08-25 21:10 -------- d-----w- c:\program files\EA GAMES

2011-08-25 21:04 . 2011-08-25 21:04 -------- d-sh--w- c:\windows\system32\AI_RecycleBin

2011-08-25 21:04 . 2011-08-25 21:04 -------- d-----w- c:\program files\W3i

2011-08-25 21:04 . 2011-08-25 21:04 -------- d-----w- c:\documents and settings\All Users\Application Data\W3i

2011-08-25 21:04 . 2011-08-25 21:04 -------- d-----w- c:\documents and settings\Owner\Application Data\NetAssistant

2011-08-19 01:23 . 2011-08-19 01:23 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc

2011-08-19 01:15 . 2011-08-19 01:23 -------- d-----w- c:\documents and settings\Owner\Application Data\uPlayer

2011-08-19 01:15 . 2011-08-19 01:15 -------- d-----w- c:\program files\uPlayer

2011-08-19 01:14 . 2011-08-19 01:35 -------- d-----w- c:\program files\Common Files\FreeCause

2011-08-15 18:11 . 2011-08-15 18:11 -------- d-----w- c:\program files\Common Files\Adobe

2011-08-14 17:47 . 2011-08-14 17:47 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-08-14 02:12 . 2011-08-14 02:12 -------- d-----w- c:\windows\Temp301C9D70-ACA1-50E5-859B-41624187A40B-Signatures

2011-08-14 01:48 . 2011-04-21 13:37 105472 -c----w- c:\windows\system32\dllcache\mup.sys

2011-08-14 01:45 . 2011-08-14 01:45 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-08-14 01:45 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys

2011-08-14 01:42 . 2011-03-29 15:22 1034240 ----a-r- c:\windows\system32\drivers\AE2500xp.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-12 18:15 . 2005-04-13 16:55 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys

2011-09-12 03:56 . 2011-09-12 03:52 146025 -c--a-w- C:\MGlogs.zip

2011-09-03 10:17 . 2005-04-13 16:55 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-07-20 15:30 . 2010-01-23 19:58 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2011-07-20 15:30 . 2010-01-23 19:58 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys

2011-07-15 13:29 . 2005-04-13 16:55 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-07-08 14:02 . 2005-04-13 16:55 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys

2011-06-24 14:10 . 2005-04-13 17:12 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys

2011-06-23 18:36 . 2005-04-13 16:56 916480 ----a-w- c:\windows\system32\wininet.dll

2011-06-23 18:36 . 2005-04-13 16:55 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-06-23 18:36 . 2005-04-13 16:55 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-06-23 12:05 . 2005-04-13 16:55 385024 ----a-w- c:\windows\system32\html.iec

2011-06-20 17:44 . 2005-04-13 16:56 293376 ----a-w- c:\windows\system32\winsrv.dll

2001-09-28 22:00 . 2006-12-29 21:52 164864 -c--a-w- c:\program files\UNWISE.EXE

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2009-08-27 . F232BA9F39BC0F722672C7E79E68EBEA . 634648 . . [7.00.6000.16915] . . c:\windows\ie8\iexplore.exe

[7] 2009-08-27 . 332EC7562F3AA7364F2D4231C56DA986 . 634648 . . [7.00.6000.21115] . . c:\windows\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe

[7] 2009-06-29 . 3CFC56F73D494FC1AA2B6E981DF15ACD . 634632 . . [7.00.6000.16876] . . c:\windows\ie7updates\KB974455-IE7\iexplore.exe

[7] 2009-06-29 . 02E2754D3E566C11A4934825920C47DD . 634632 . . [7.00.6000.21073] . . c:\windows\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe

[7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe

[7] 2009-02-28 . BCD8E48709BE4A79606F0B6E8E9A6162 . 636088 . . [7.00.6000.21020] . . c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe

[7] 2009-02-28 . A251068640DDB69FD7805B57D89D7FF7 . 636072 . . [7.00.6000.16827] . . c:\windows\ie7updates\KB972260-IE7\iexplore.exe

[7] 2008-12-19 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978] . . c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe

[7] 2008-12-19 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791] . . c:\windows\ie7updates\KB963027-IE7\iexplore.exe

[7] 2008-10-15 . 9D3DB9ADFABD2F0BC778EC03250A3ABB . 633632 . . [7.00.6000.16762] . . c:\windows\ie7updates\KB961260-IE7\iexplore.exe

[7] 2008-10-15 . 056C927CF7207857E8B34F7A8FFD9B9E . 633632 . . [7.00.6000.20935] . . c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe

[7] 2008-08-23 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900] . . c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe

[7] 2008-08-23 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735] . . c:\windows\ie7updates\KB958215-IE7\iexplore.exe

[7] 2008-06-23 . 64E376A47763DAEABCDA14BD5B6EA286 . 625664 . . [7.00.6000.16705] . . c:\windows\ie7updates\KB956390-IE7\iexplore.exe

[7] 2008-06-23 . C52A9EF571E91535EB78DB4B8B95EA07 . 625664 . . [7.00.6000.20861] . . c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe

[7] 2008-04-22 . 197B7E4030CFBD8D2979D375E1787AA2 . 625664 . . [7.00.6000.20815] . . c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe

[7] 2008-04-22 . 232B22817B90AE0AFF2D189E3E3735AC . 625664 . . [7.00.6000.16674] . . c:\windows\ie7updates\KB953838-IE7\iexplore.exe

[7] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\iexplore.exe

[7] 2008-02-29 . 2D0E5592AB5A46C27DAF7CCAFF4F5B59 . 625664 . . [7.00.6000.16640] . . c:\windows\ie7updates\KB950759-IE7\iexplore.exe

[7] 2008-02-22 . 6E0888626E0CAC79F57149814E22DB4D . 625664 . . [7.00.6000.20772] . . c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe

[7] 2007-12-06 . 2703D940A62B731AA220529DD7331A78 . 625664 . . [7.00.6000.16608] . . c:\windows\ie7updates\KB947864-IE7\iexplore.exe

[7] 2007-12-06 . 809D17D8FA0FDAEE07778CD821CAFFDE . 625664 . . [7.00.6000.20733] . . c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe

[7] 2007-10-10 . E854D02E4231F704D9BE782A424E6D8B . 625152 . . [7.00.6000.16574] . . c:\windows\ie7updates\KB944533-IE7\iexplore.exe

[7] 2007-10-10 . 632BDE0179847234433CA50945442ACB . 625664 . . [7.00.6000.20696] . . c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe

[7] 2007-08-17 . 3AC2BC667DA0AF2C968E96E1630F5AB5 . 625152 . . [7.00.6000.16544] . . c:\windows\ie7updates\KB942615-IE7\iexplore.exe

[7] 2007-08-17 . 5577D0E3AC2F9F035ACD81B44AF5F511 . 625152 . . [7.00.6000.20661] . . c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe

[7] 2007-06-27 . BD8502DFD53FC24FB8D6929DC46B8C2C . 625152 . . [7.00.6000.20627] . . c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe

[7] 2007-06-27 . 275CEE268B9E5D82474C43D5D249D111 . 625152 . . [7.00.6000.16512] . . c:\windows\ie7updates\KB939653-IE7\iexplore.exe

[7] 2007-04-24 . 10BDB55982586A432A3951EB19A26009 . 625152 . . [7.00.6000.16473] . . c:\windows\ie7updates\KB937143-IE7\iexplore.exe

[7] 2007-04-24 . 9B3516C1F30DA17ADD3818573047D63C . 625152 . . [7.00.6000.20583] . . c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe

[7] 2007-02-28 . D321092F8529CDAE843D6E24E3CAC6CB . 625152 . . [7.00.6000.20544] . . c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\iexplore.exe

[7] 2007-02-21 . 683DDE71BCF03B501B912D20CB93B549 . 623616 . . [7.00.6000.16441] . . c:\windows\ie7updates\KB933566-IE7\iexplore.exe

[7] 2007-01-08 . 93A6A4F5293AE19E3B37021AABCF0902 . 623616 . . [7.00.6000.16414] . . c:\windows\ie7updates\KB931768-IE7\iexplore.exe

[-] 2006-10-17 . 5334D4461AA92A7B008755FE6D13C5F2 . 622080 . . [7.00.5730.11] . . c:\windows\ie7updates\KB928090-IE7\iexplore.exe

[-] 2004-08-10 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\ie7\iexplore.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{132A3557-F4F3-4BCC-9648-8346A82E74Cf}]

2011-09-04 20:09 239104 ----a-w- c:\windows\system32\wscui32.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdobeUMUpdate"="c:\documents and settings\Owner\Application Data\AdobeUM\AdobeUMUpdate\AdobeUMupdt32.exe" [2011-09-04 56832]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-08-12 4603264]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-12 483422]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"vptray"="c:\progra~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-04-26 90112]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

"AdobeUMUpdate"="c:\documents and settings\Owner\Application Data\AdobeUM\AdobeUMUpdate\AdobeUMupdt32.exe" [2011-09-04 56832]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk

backup=c:\windows\pss\BigFix.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Install Pending Files.LNK]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Install Pending Files.LNK

backup=c:\windows\pss\Install Pending Files.LNKCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Run Google Web Accelerator.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Run Google Web Accelerator.lnk

backup=c:\windows\pss\Run Google Web Accelerator.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

backupExtension=Common Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]

2005-05-03 21:02 543232 -c--a-w- c:\windows\zHotkey.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]

2005-08-05 17:56 64512 ----a-w- c:\windows\ehome\ehtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-04-25 17:29 77824 -c--a-w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2005-04-25 17:32 94208 -c--a-w- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstallIQUpdater]

2011-08-09 21:02 1176064 ----a-w- c:\program files\W3i\InstallIQUpdater\InstallIQUpdater.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]

2005-06-02 23:03 1957888 -c----w- c:\program files\Ahead\Nero BackItUp\NBJ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 18:50 155648 -c--a-w- c:\windows\system32\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2005-04-25 17:32 114688 -c--a-w- c:\windows\system32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]

2002-09-14 06:42 212992 -c--a-w- c:\windows\SMINST\Recguard.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]

2005-03-09 15:49 966656 -c--a-w- c:\windows\creator\remind_xp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2009-03-12 17:53 483422 ----a-w- c:\windows\sttray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]

2004-11-15 22:04 135168 -c--a-w- c:\program files\Digital Media Reader\shwiconEM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"PrismXL"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Common Files\\AOL\\1144556525\\ee\\aim6.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\1144556525\\ee\\aolsoftware.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Program Files\\W3i\\InstallIQUpdater\\InstallIQUpdater.exe"=

"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=

"c:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE"=

"c:\\WINDOWS\\system32\\mshta.exe"=

"c:\\Program Files\\Google\\Update\\GoogleUpdate.exe"=

"c:\\Program Files\\EA GAMES\\MOHAA\\MOHAA.exe"=

"c:\\Documents and Settings\\Owner\\Application Data\\AdobeUM\\AdobeUMUpdate\\AdobeUMupdt32.exe"=

"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=

"c:\\Documents and Settings\\Owner\\Desktop\\Bleeping computer downloads\\SUPERAntiSpyware.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"81:TCP"= 81:TCP:*:Disabled:www.fileporn.org

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"15072:TCP"= 15072:TCP:*:Disabled:BitComet 15072 TCP

"15072:UDP"= 15072:UDP:*:Disabled:BitComet 15072 UDP

"27097:TCP"= 27097:TCP:*:Disabled:BitComet 27097 TCP

"27097:UDP"= 27097:UDP:*:Disabled:BitComet 27097 UDP

"49154:TCP"= 49154:TCP:*:Disabled:BitComet 49154 TCP

"49154:UDP"= 49154:UDP:*:Disabled:BitComet 49154 UDP

"53580:TCP"= 53580:TCP:*:Disabled:BitComet 53580 TCP

"53580:UDP"= 53580:UDP:*:Disabled:BitComet 53580 UDP

"6839:TCP"= 6839:TCP:*:Disabled:BitComet 6839 TCP

"6839:UDP"= 6839:UDP:*:Disabled:BitComet 6839 UDP

"52890:TCP"= 52890:TCP:*:Disabled:BitComet 52890 TCP

"52890:UDP"= 52890:UDP:*:Disabled:BitComet 52890 UDP

"62890:TCP"= 62890:TCP:*:Disabled:BitComet 62890 TCP

"62890:UDP"= 62890:UDP:*:Disabled:BitComet 62890 UDP

"38839:TCP"= 38839:TCP:*:Disabled:BitCometBeta 38839 TCP

"38839:UDP"= 38839:UDP:*:Disabled:BitCometBeta 38839 UDP

"9383:TCP"= 9383:TCP:*:Disabled:BitComet 9383 TCP

"9383:UDP"= 9383:UDP:*:Disabled:BitComet 9383 UDP

"9879:TCP"= 9879:TCP:*:Disabled:BitComet 9879 TCP

"9879:UDP"= 9879:UDP:*:Disabled:BitComet 9879 UDP

"6346:TCP"= 6346:TCP:BitComet 6346 TCP

"6346:UDP"= 6346:UDP:BitComet 6346 UDP

"43823:TCP"= 43823:TCP:BitComet 43823 TCP

"43823:UDP"= 43823:UDP:BitComet 43823 UDP

"31853:TCP"= 31853:TCP:BitComet 31853 TCP

"31853:UDP"= 31853:UDP:BitComet 31853 UDP

"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015

"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016

"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

"23301:TCP"= 23301:TCP:BitComet 23301 TCP

"23301:UDP"= 23301:UDP:BitComet 23301 UDP

.

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [9/12/2011 5:33 PM 116608]

R3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [8/13/2011 9:42 PM 1034240]

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [7/10/2006 10:36 PM 691696]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

S1 cqknmdjg;cqknmdjg; [x]

S1 MpKsl1b68c793;MpKsl1b68c793; [x]

S1 MpKsl3c4a2abb;MpKsl3c4a2abb; [x]

S1 MpKsld7d2ad1c;MpKsld7d2ad1c; [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 12:27 PM 12880]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 5:55 PM 67664]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2010 9:39 PM 135664]

S2 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2010 9:39 PM 135664]

S2 RPCQT;Remote Procedure Call (CQTPM);c:\windows\System32\svchost.exe -k netsvcs [4/13/2005 12:56 PM 14336]

S3 ATMFBUS;A600 USB Composite Device Driver;c:\windows\system32\DRIVERS\ATMFBUS.sys --> c:\windows\system32\DRIVERS\ATMFBUS.sys [?]

S3 ATMFCVsp;A600 Cricket CM Port;c:\windows\system32\DRIVERS\ATMFCVsp.sys --> c:\windows\system32\DRIVERS\ATMFCVsp.sys [?]

S3 ATMFFLT;A600 USB Modem Installation CD;c:\windows\system32\DRIVERS\ATMFFLT.sys --> c:\windows\system32\DRIVERS\ATMFFLT.sys [?]

S3 ATMFMdm;A600 Cricket EVDO Modem;c:\windows\system32\DRIVERS\ATMFMdm.sys --> c:\windows\system32\DRIVERS\ATMFMdm.sys [?]

S3 ATMFNET;A600 Cricket EVDO Network Adapter;c:\windows\system32\DRIVERS\ATMFNET.sys --> c:\windows\system32\DRIVERS\ATMFNET.sys [?]

S3 ATMFNVsp;A600 Cricket NMEA Port Serial Port;c:\windows\system32\DRIVERS\ATMFNVsp.sys --> c:\windows\system32\DRIVERS\ATMFNVsp.sys [?]

S3 ATMFVsp;A600 Cricket Diagnostics Port;c:\windows\system32\DRIVERS\ATMFVsp.sys --> c:\windows\system32\DRIVERS\ATMFVsp.sys [?]

S3 DPCNET5U;Satellite USB Driver;c:\windows\system32\DRIVERS\dpcnet5u.sys --> c:\windows\system32\DRIVERS\dpcnet5u.sys [?]

S3 gAGP440p;gAGP440p; [x]

S3 TfNetMon;TfNetMon; [x]

S4 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/23/2010 3:58 PM 136360]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

RPCQT

.

Contents of the 'Scheduled Tasks' folder

.

2011-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]

.

2007-10-30 c:\windows\Tasks\BitComet.job

- c:\progra~1\BitComet\BitComet.exe [2009-07-31 09:05]

.

2011-09-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-21 01:38]

.

2011-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-21 01:38]

.

2011-09-12 c:\windows\Tasks\User_Feed_Synchronization-{7B8B7F67-DA93-447D-83C7-A6BD434B3F4A}.job

- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

uInternet Settings,ProxyOverride = <local>

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-DisplayVerifierOnline - c:\documents and settings\All Users\Application Data\DisplayVerifierOnline.dll

HKCU-Run-Wbapuvaca - c:\windows\ptl6ndic.dll

SafeBoot-53117751.sys

MSConfigStartUp-DAEMON Tools - c:\program files\DAEMON Tools\daemon.exe

MSConfigStartUp-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

MSConfigStartUp-IntelAudioStudio - c:\program files\Intel Audio Studio\IntelAudioStudio.exe

MSConfigStartUp-kakiziguv - c:\windows\system32\polekove.dll

MSConfigStartUp-RemoteControl - c:\program files\CyberLink\PowerDVD\PDVDServ.exe

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe

MSConfigStartUp-webHancer Agent - c:\program files\webHancer\Programs\whagent.exe

MSConfigStartUp-{382AC062-0AEF-1033-0802-050718200001} - c:\program files\Common Files\{382AC062-0AEF-1033-0802-050718200001}\Update.exe

MSConfigStartUp-{382AC062-0AF0-1033-0802-050718200001} - c:\program files\Common Files\{382AC062-0AF0-1033-0802-050718200001}\Update.exe

MSConfigStartUp-{382AC062-0AFF-1033-0802-050718200001} - c:\program files\Common Files\{382AC062-0AFF-1033-0802-050718200001}\Update.exe

MSConfigStartUp-{382AC062-0B0D-1033-0802-050718200001} - c:\program files\Common Files\{382AC062-0B0D-1033-0802-050718200001}\Update.exe

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\documents and settings\All Users\Application Data\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\standard_1.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-09-12 17:41

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet009\Services\.cdrom]

"ImagePath"="\*"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-3411350672-2408072866-3857614147-1006\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•A~*]

"AB141C35E9F4BF344B9FC010BB17F68A"=""

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(588)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

- - - - - - - > 'explorer.exe'(1980)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll

c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

.

Completion time: 2011-09-12 17:50:11 - machine was rebooted

ComboFix-quarantined-files.txt 2011-09-12 21:50

.

Pre-Run: 59,100,139,520 bytes free

Post-Run: 59,777,572,864 bytes free

.

Current=9 Default=9 Failed=8 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10

- - End Of File - - B598FAAE80A5124EF1A79A68AFB54F73

lilgeezy24 · September 13, 2011

I ran combofix and it stated that my comp was infected with rootkit.zeroaccess it says deleted alot of files and fixed them but the computer is still acting the same. mbam still wont scan