New infection for this PC.. SecureBill, INC

Vegittz · November 11, 2011

Hiya friends, I'm trying to help my friend fix their computer and have followed the directions in the "how to" forum... I got a lot of functionality back but the bug still persists. I ran malwarebytes full scan and selected the remove function. Upon request to restart I did, and the system locked for a full 10 min, I hard powered (sorry>.<) and rebooted to some of the origional symptoms. I still have every file on the HD marked as "Hidden" and the desktop is still wallpaperless (ohno )

Thanks for any help in advance!

As requested here are the two logs:

dds:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18

Run by Heather at 21:26:40 on 2011-11-10

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1982.1344 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe -k LocalService

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Nova Development\Photo Explosion 3.0 SE\calcheck.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Messenger\MSMSGS.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [MSMSGS] "c:\program files\messenger\MSMSGS.EXE" /background

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [PhotoExplosionCalCheck] c:\program files\nova development\photo explosion 3.0 se\calcheck.exe

mRun: [lxddmon.exe] "c:\program files\lexmark 2500 series\lxddmon.exe"

mRun: [lxddamon] "c:\program files\lexmark 2500 series\lxddamon.exe"

mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\documents and settings\heather\start menu\programs\startup\CurseClientStartup.ccip

dPolicies-explorer: NoDesktop = 1 (0x1)

dPolicies-system: DisableTaskMgr = 1 (0x1)

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 192.168.0.1 205.171.3.25

TCP: Interfaces\{BB9D7449-46EA-4E27-9E4D-90E224B81761} : DhcpNameServer = 192.168.0.1 205.171.3.25

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\heather\application data\mozilla\firefox\profiles\xidn59ed.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://search.myheritage.com/?orig=ds&q=

FF - plugin: c:\documents and settings\heather\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll

FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll

FF - plugin: c:\program files\worldwinner.com, inc\worldwinner games\npwwload.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation

foundation\DotNetAssistantExtension

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-10 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-10 22216]

S2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]

S2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [2011-7-18 99248]

.

=============== Created Last 30 ================

.

2011-11-11 04:15:18 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-11-11 03:34:05 6792 ----a-w- c:\windows\system32\0.4612228925453007.exe

2011-11-11 03:33:03 -------- d-----w- c:\documents and settings\heather\application data\Malwarebytes

2011-11-11 03:32:56 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-11-11 03:32:53 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-11 03:32:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-11 02:12:05 7077 ---ha-w- c:\windows\system32\0.7989301717041639.exe

2011-11-11 02:02:02 28160 ---ha-w- c:\windows\system32\dll.dll

2011-11-09 19:00:05 295762 ---ha-w- c:\windows\system32\shimg.dll

2011-11-09 18:59:36 7025 ---ha-w- c:\windows\system32\0.7134633267506013.exe

2011-11-09 04:28:38 6433 ---ha-w- c:\windows\system32\0.7358760714970098.exe

2011-11-09 04:28:31 6793 ---ha-w- c:\windows\system32\0.7235014016234915.exe

2011-11-09 04:28:25 7077 ---ha-w- c:\windows\system32\0.9024795825469005.exe

2011-11-09 04:27:24 7077 ---ha-w- c:\windows\system32\0.6106823250354919.exe

2011-11-04 02:41:49 -------- d--h--w- c:\documents and settings\heather\riotsGamesLogs

2011-11-04 02:41:10 -------- d--h--w- c:\documents and settings\heather\application data\LolClient

2011-11-04 02:27:55 414368 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-03 22:29:52 -------- d--h--w- C:\Riot Games

2011-11-03 21:24:31 -------- d--h--w- c:\documents and settings\heather\local settings\application data\PMB Files

2011-11-03 21:24:29 -------- d--h--w- c:\documents and settings\all users\application data\PMB Files

2011-11-03 21:24:20 -------- d--h--w- c:\program files\Pando Networks

2011-10-22 05:41:20 -------- d--h--w- c:\program files\MSXML 4.0

.

==================== Find3M ====================

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST3160815AS rev.4.ADA -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x88FEC49F]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x88ff3728]; MOV EAX, [0x88ff389c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI;

JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EE00A] -> \Device\Harddisk0\DR0[0x8A44DAB8]

3 CLASSPNP[0xBA0F905B] -> ntkrnlpa!IofCallDriver[0x804EE00A] -> \Device\00000059[0x8A4A9F18]

5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EE00A] -> [0x8A467940]

\Driver\atapi[0x8A23B1D8] -> IRP_MJ_CREATE -> 0x88FEC49F

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ;

MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x88FEC2C6

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 21:27:21.26 ===============

and attach:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume2

Install Date: 1/19/2010 3:26:29 PM

System Uptime: 11/10/2011 9:13:40 PM (0 hours ago)

.

Motherboard: Dell Inc. | | 0RY206

Processor: AMD Sempron Processor LE-1300 | Socket AM2 | 2310/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 149 GiB total, 99.095 GiB free.

D: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description:

Device ID: ACPI\AWY0001\2&DABA3FF&0

Manufacturer:

Name:

PNP Device ID: ACPI\AWY0001\2&DABA3FF&0

Service:

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: PCI Simple Communications Controller

Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&72ACDAA&0&4820

Manufacturer:

Name: PCI Simple Communications Controller

PNP Device ID: PCI\VEN_14F1&DEV_2F20&SUBSYS_200F14F1&REV_00\4&72ACDAA&0&4820

Service:

.

==== System Restore Points ===================

.

RP304: 10/21/2011 7:16:11 PM - System Checkpoint

RP305: 10/21/2011 11:41:15 PM - Software Distribution Service 3.0

RP306: 10/31/2011 6:56:55 PM - System Checkpoint

RP307: 11/1/2011 7:32:56 PM - System Checkpoint

RP308: 11/3/2011 3:40:07 PM - System Checkpoint

RP309: 11/3/2011 4:29:51 PM - Installed League of Legends

RP310: 11/6/2011 8:31:13 PM - System Checkpoint

.

==== Installed Programs ======================

.

Adobe Flash Player 11 Plugin

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Bonjour

Curse Client

Driver Detective

High Definition Audio Driver Package - KB888111

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB935448)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

iTunes

Java Auto Updater

Java 6 Update 18

League of Legends

Lexmark 2500 Series

Lexmark Fax Solutions

Lexmark Toolbar

Malwarebytes' Anti-Malware version 1.51.2.1300

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Web Publishing Wizard 1.52

MobileMe Control Panel

Mozilla Firefox (3.6.23)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6 Service Pack 2 (KB973686)

NVIDIA Drivers

Pando Media Booster

Photo Explosion 3.0 Special Edition

QuickTime

Realtek High Definition Audio Driver

Safari

Security Update for Windows Media Player (KB911564)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows Media Player 8 (KB917734)

Security Update for Windows Media Player 9 (KB911565)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB890046)

Security Update for Windows XP (KB893756)

Security Update for Windows XP (KB896358)

Security Update for Windows XP (KB896423)

Security Update for Windows XP (KB896424)

Security Update for Windows XP (KB896428)

Security Update for Windows XP (KB899587)

Security Update for Windows XP (KB899591)

Security Update for Windows XP (KB900725)

Security Update for Windows XP (KB901017)

Security Update for Windows XP (KB901214)

Security Update for Windows XP (KB902400)

Security Update for Windows XP (KB904706)

Security Update for Windows XP (KB905414)

Security Update for Windows XP (KB905749)

Security Update for Windows XP (KB908519)

Security Update for Windows XP (KB911562)

Security Update for Windows XP (KB911927)

Security Update for Windows XP (KB912919)

Security Update for Windows XP (KB913580)

Security Update for Windows XP (KB914388)

Security Update for Windows XP (KB914389)

Security Update for Windows XP (KB917344)

Security Update for Windows XP (KB917422)

Security Update for Windows XP (KB917953)

Security Update for Windows XP (KB919007)

Security Update for Windows XP (KB920670)

Security Update for Windows XP (KB920683)

Security Update for Windows XP (KB920685)

Security Update for Windows XP (KB921398)

Security Update for Windows XP (KB921883)

Security Update for Windows XP (KB922616)

Security Update for Windows XP (KB922819)

Security Update for Windows XP (KB923191)

Security Update for Windows XP (KB923414)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB924191)

Security Update for Windows XP (KB924496)

Security Update for Windows XP (KB944338-v2)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958470)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB981350)

Security Update for Windows XP (KB982381)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows XP (KB898461)

Update for Windows XP (KB908531)

Update for Windows XP (KB910437)

Update for Windows XP (KB911280)

Update for Windows XP (KB925720)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update for Windows XP (KB978207)

Update for Windows XP (KB980182)

WebFldrs XP

Windows Imaging Component

Windows Installer 3.1 (KB893803)

Windows XP Hotfix - KB873339

Windows XP Hotfix - KB885835

Windows XP Hotfix - KB885836

Windows XP Hotfix - KB888302

Windows XP Hotfix - KB890859

Windows XP Hotfix - KB891781

Windows XP Service Pack 2

World of Warcraft

WorldWinner Games

Yahoo! BrowserPlus 2.9.8

.

==== Event Viewer Messages From Past Week ========

.

11/9/2011 11:54:10 AM, error: Service Control Manager [7031] - The Remote Procedure Call (RPC) service

terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in

60000 milliseconds: Reboot the machine.

11/9/2011 11:42:05 AM, error: Service Control Manager [7034] - The iPod Service service terminated

unexpectedly. It has done this 1 time(s).

11/9/2011 11:41:25 AM, error: Service Control Manager [7031] - The Apple Mobile Device service

terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in

60000 milliseconds: Restart the service.

11/8/2011 8:34:51 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for

the lxddCATSCustConnectService service to connect.

11/8/2011 8:34:51 PM, error: Service Control Manager [7000] - The lxddCATSCustConnectService service

failed to start due to the following error: The service did not respond to the start or control request

in a timely fashion.

11/10/2011 9:24:02 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated

unexpectedly. It has done this 1 time(s).

11/10/2011 9:23:37 PM, error: Service Control Manager [7034] - The Java Quick Starter service

terminated unexpectedly. It has done this 1 time(s).

11/10/2011 9:23:29 PM, error: Service Control Manager [7034] - The lxdd_device service terminated

unexpectedly. It has done this 1 time(s).

11/10/2011 9:23:25 PM, error: Service Control Manager [7034] - The Application Layer Gateway Service

service terminated unexpectedly. It has done this 1 time(s).

11/10/2011 7:02:16 PM, error: SRService [104] - The System Restore initialization process failed.

11/10/2011 7:02:16 PM, error: Service Control Manager [7023] - The System Restore Service service

terminated with the following error: Access is denied.

.

==== End Of File ===========================

Any additional help would be GREAT thanks again!

Maniac · November 11, 2011

Hello Vegittz! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/paste in your next reply.

Please follow the instructions here to try to run ComboFix tool:

www.bleepingcomputer.com/combofix/how-to-use-combofix#use

When you are ready, post the log.txt

Vegittz · November 11, 2011

Hi Maniac I am in process of running the combofix utility. Unfortunatyely it seems to have hung up. It went throught the 50 stage process then moved on to deleting files, and passed on to "Deleting Folders" and has been frozen there for about 20 min with no change or log creation. I still have it running in the background, but I fear it is stuck.

Maniac · November 11, 2011

Sometimes it takes a little more time, please wait a little longer. Thanks for your patience!

Vegittz · November 11, 2011

Great news! I rebooted and ran combofix again and got the log! so without further adue!

ComboFix 11-11-11.04 - Heather 11/11/2011 9:47.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1982.1489 [GMT -7:00]

Running from: c:\documents and settings\Heather\My Documents\Downloads\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2011-10-11 to 2011-11-11 )))))))))))))))))))))))))))))))

.

2011-11-11 03:33 . 2011-11-11 03:33 -------- d-----w- c:\documents and settings\Heather\Application Data\Malwarebytes

2011-11-11 03:32 . 2011-11-11 03:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-11-11 03:32 . 2011-11-11 03:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-11 03:32 . 2011-09-01 00:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-09 03:52 . 2011-11-09 03:52 -------- d-s---w- c:\documents and settings\NetworkService\UserData

2011-11-04 02:41 . 2011-11-09 18:58 -------- d--h--w- c:\documents and settings\Heather\riotsGamesLogs

2011-11-04 02:41 . 2011-11-04 02:41 -------- d--h--w- c:\documents and settings\Heather\Application Data\LolClient

2011-11-04 02:27 . 2011-11-04 02:27 414368 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-03 22:29 . 2011-11-03 22:29 -------- d-----w- C:\Riot Games

2011-11-03 21:24 . 2011-11-11 16:53 -------- d--h--w- c:\documents and settings\Heather\Local Settings\Application Data\PMB Files

2011-11-03 21:24 . 2011-11-09 18:59 -------- d--h--w- c:\documents and settings\All Users\Application Data\PMB Files

2011-11-03 21:24 . 2011-11-03 21:24 -------- d--h--w- c:\program files\Pando Networks

2011-10-22 05:41 . 2011-10-22 05:41 -------- d--h--w- c:\program files\MSXML 4.0

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-11-03 3077528]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2007-09-04 8466432]

"nwiz"="nwiz.exe" [2007-09-04 1626112]

"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2007-09-04 81920]

"RTHDCPL"="RTHDCPL.EXE" [2008-01-09 16859648]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-15 47904]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-02 421160]

"PhotoExplosionCalCheck"="c:\program files\Nova Development\Photo Explosion 3.0 SE\calcheck.exe" [2006-09-20 69632]

"lxddmon.exe"="c:\program files\Lexmark 2500 Series\lxddmon.exe" [2007-06-11 291760]

"lxddamon"="c:\program files\Lexmark 2500 Series\lxddamon.exe" [2007-04-30 20480]

"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-06-11 312240]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608]

.

c:\documents and settings\Heather\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2011-1-1 0]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\lxddcoms.exe"=

"c:\\Program Files\\Lexmark 2500 Series\\lxddamon.exe"=

"c:\\Program Files\\Lexmark 2500 Series\\App4R.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddtime.exe"=

"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxddpswx.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"c:\\Documents and Settings\\Heather\\Local Settings\\Apps\\2.0\\52A0Q1QR.KLH\\22952QH5.AZW\\curs..tion_eee711038731a406_0004.0000_0d453ed5fea2fe48\\CurseClient.exe"=

"c:\\Program Files\\Lexmark 2500 Series\\lxddmon.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

"57047:TCP"= 57047:TCP:Pando Media Booster

"57047:UDP"= 57047:UDP:Pando Media Booster

.

R2 lxdd_device;lxdd_device;c:\windows\system32\lxddcoms.exe -service --> c:\windows\system32\lxddcoms.exe -service [?]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/10/2011 8:32 PM 366152]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/10/2011 8:32 PM 22216]

S2 lxddCATSCustConnectService;lxddCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxddserv.exe [7/18/2011 2:24 PM 99248]

.

Contents of the 'Scheduled Tasks' folder

.

2010-10-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 17:50]

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.0.1 205.171.3.25

FF - ProfilePath - c:\documents and settings\Heather\Application Data\Mozilla\Firefox\Profiles\xidn59ed.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://search.myheritage.com/?orig=ds&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - user.js: yahoo.homepage.dontask - true

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-11-11 09:53

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

1Y5U7AYUVGXZYFXDCQRADEFD = c:\fonts\6DFBBA7729B.exe /q

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST3160815AS rev.4.ADA -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5

.

device: opened successfully

user: MBR read successfully

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x890EE2C6

user & kernel MBR OK

.

**************************************************************************

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"1Y5U7AYUVGXZYFXDCQRADEFD"="c:\\Fonts\\6DFBBA7729B.exe /q"

.

Completion time: 2011-11-11 09:59:48

ComboFix-quarantined-files.txt 2011-11-11 16:59

.

Pre-Run: 106,604,175,360 bytes free

Post-Run: 106,614,173,696 bytes free

.

- - End Of File - - 45A23C2EB1AA5A1B367973B8C3BCA267

Vegittz · November 11, 2011

Further: the malwarebytes app keeps informing me that it is successfully blocking outgoing to "178.238.233.153" =/ someplace in germany.....

Vegittz · November 11, 2011

I ran mbam again for no result, see log:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Database version: 8136

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

11/11/2011 11:03:53 AM

mbam-log-2011-11-11 (11-03-53).txt

Scan type: Full scan (C:\|)

Objects scanned: 207544

Time elapsed: 28 minute(s), 49 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

I also decided a new DDS may be useful:

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18

Run by Heather at 11:19:02 on 2011-11-11

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1982.1199 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Nova Development\Photo Explosion 3.0 SE\calcheck.exe

C:\Program Files\Lexmark 2500 Series\lxddmon.exe

C:\Program Files\Lexmark 2500 Series\lxddamon.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Pando Networks\Media Booster\PMB.exe

C:\WINDOWS\System32\svchost.exe -k LocalService

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\lxddcoms.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime