Please help...can't get rid of this one

[Canuck78]

The malware on my computer is redirecting my browser. My Avast! is deactivated and I can't get it to run, can't get spybot or any other security software to run. I downloaded HighjackThis, but can't get it to run either. I know I have PC AntiSpyware 2010 on my computer, but can't get rid of it since I can't run any security software. Help please!

[shelf life]

You can try this:

Boot your machine into safe mode. To reach safe mode you would tap the f8 key during a computer restart. chose the first option from the list: safe mode.
Once at the safe mode desktop try running your AV and any anti-malware apps you have. See if this helps any.

Until clean I suggest using the machine as little as possible, in fact when not in use you can pull the plug on your modem or router or just shut it down so there is no network connectivity.

[Canuck78]

First off, thank you for helping me.

Here is what I have done so far:
Booted in safe mode, tried to run Avast! and SpybotSD with same result, error message "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item" Renamed Spybot and tried to run it. It comes up, but as soon as I chose to perform a scan, it shuts down and I can't open it again.

I have tried HJT and it will not run in safe mode or in normal mode. I have also renamed it, but still will not work.

I have backed up registry with ERUNT.

I also have a Kaspersky log if that would be helpful. Their online scan is the online thing I have been able to run so far and I have kept the log. Let me know if you need it.

[shelf life]

Do you have access to another machine that you could read a guide on?

We will try combofix, there is a guide to read first. Read through the guide then download combofix onto the infected machine. Before you save it to your desktop rename combofix.exe to combofix1.exe then save it to your desktop.

Double click the saved icon on your desktop and follow the prompts.

Another possibility is to rename and save the combofix1.exe to a usb flash drive then transfer it via usb to the infected computer. If you do this leave the usb drive in the infected computer. Its possible for some malware to infect usb drives and spread to a non-infected computer if inserted back into one.

Guide to using Combofix (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

[Canuck78]

Downloaded ComboFix and renamed it. When I double-click on it, the window "Open File - Security Warning" opens and it says "The publisher could not be verified. Are you sure you want to run this software?". I click run, the window goes away and then nothing happens.

[shelf life]

try booting into safe mode to run combofix. To reach safe mode you would tap the f8 key during a computer restart. Chose the first option: safe mode. Once at the safe mode desktop try running combofix.

[Canuck78]

Still exactly the same problem even in safe mode. After I click Run, the window disappears and nothing happens.

[shelf life]

Not good. See if you can get RootRepeal on board. And use the machine as little as possible, pull the plug on router/modem when not in use and no bank/financial stuff.

Please download: RootRepeal

http://ad13.geekstogo.com/RootRepeal.exe

Click the icon on your desktop to start.
Click on the Report tab at the bottom of the window
Next, Click on the Scan button
In the Select Scan Window check everything:

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services

Click the OK button
In the next dialog window select all the drives that are listed
Click OK to start the scan

May take some time to complete.
When done click the Save Report button.
Save the report to your desktop
To Exit RootRepeal: click File>Exit
Post the report in your reply

[Canuck78]

This actually worked. Here is the RootRepeal Report:

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/25 21:39
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys
Address: 0x99116000 Size: 778240 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x985DA000 Size: 49152 File Visible: No Signed: -
Status: -

Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0x9A784000 Size: 20480 File Visible: No Signed: -
Status: -

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xA0B5F000 Size: 61440 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\eventlog.dll
Status: Locked to the Windows API!

Path: c:\documents and settings\user\local settings\temp\~df2f60.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\user\local settings\temp\~df9370.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Processes
-------------------
Path: C:\WINDOWS\system32\braviax.exe
PID: 1032 Status: Hidden from the Windows API!

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39516b8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3951574

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3951a52

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395114c

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395164e

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395108c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39510f0

#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\System32\Drivers\Beep.SYS" at address 0xb7dbb1a0

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395176e

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395172e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39518ae

==EOF==

[shelf life]

not much there. I was expecting more. rerun rootrepeal. this time:

Click the icon on your desktop to start.
Click on the Report tab at the bottom of the window
Next, Click on the Scan button
In the Select Scan Window check:

Processes


Click the OK button
In the next dialog window select all the drives that are listed
Click OK to start the scan
When finished, in the main window, right click on "terminate process and delete file" for this single entry:

C:\WINDOWS\system32\braviax.exe

reboot machine and see if you can run anything.

[Canuck78]

Did as instructed and tried to run Avast!, SpybotSD, HJT and ComboFix with no success. I also noticed that when I run RootRepeal again, the same line appears again:

C:\WINDOWS\system32\braviax.exe

Also, I don't know if it's relevant or not, but at the end of the RootRepeal scan, I get the following error message: "Unrecognized partition type 14 (Oxe)!"

I also still have the report from the Kaspersky scan, don't know if that would be helpful or not?

[Canuck78]

I forgot to mention that I tried running all those programs in both safe and normal mode with no success in either one.

[shelf life]

Iam assuming all this is the working of malware. What operating system are you using? If the root repeal log is correct i cant see braviax.exe being the cause of all the problems.

You can look for the process in task manager. To get task manager you can hit at once the ctrl-alt-delete keys. Under the process tab look for braviax.exe, right click on it and select end process, click yes at the warning.
try navigating to the C:\WINDOWS\system32 directory and see if you can manually find and delete braviax.exe after ending its process

Yes you can post the Kaspersky scan.


"Unrecognized partition type 14 (Oxe)!
Dont know really, you have a single hard drive and operating system installed?

[Canuck78]

I am running Windows XP SP3. I only have one OS installed, but I do have an external hard drive that I haven't used in a while and is not connected to the computer.

Braviax doesn't appear in the task manager. I have found it in the directory though, but can't delete it.

Here is the Kaspersky scan report:

KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, August 26, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, August 26, 2009 23:44:34
Records in database: 2690294


Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes

Scan area Folder
C:\

Scan statistics
Objects scanned 82658
Threats found 10
Infected objects found 20
Suspicious objects found 0
Scan duration 00:47:59

File name Threat Threats count
C:\Documents and Settings\USER\Local Settings\Temp\msupd_2.exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\F7LT3V0X\livwja[1].htm Infected: Packed.Win32.TDSS.y 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\GOR3YO71\Install[1].exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1\ebbpttlp[1].htm Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1\tqqdv[1].txt Infected: Trojan.Win32.Agent.cvfm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\a55b8[1].pdf Infected: Exploit.Win32.Pidief.bjx 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\atdhuv[1].htm Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\nkkllpu[1].htm Infected: Trojan.Win32.Crot.v 1

C:\ekxfnpkm.exe Infected: Trojan.Win32.Crot.v 1

C:\lcbckjms.exe Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\sdlb.exe Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\WINDOWS\cru629.dat Infected: Backdoor.Win32.Small.ejx 1

C:\WINDOWS\system32\cru629.dat Infected: Backdoor.Win32.Small.ejx 1

C:\WINDOWS\system32\dllcache\beep.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\dllcache\figaro.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\drivers\beep.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\tajf83ikdmf.dll Infected: Trojan-Downloader.Win32.Agent.cnhi 1

C:\WINDOWS\system32\wisdstr.exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\WINDOWS\system32\_scui.cpl Infected: Trojan.Win32.FraudPack.qys 1

C:\yihw.exe Infected: Trojan.Win32.Agent.cvfm 1

Selected area has been scanned.

[shelf life]

See if you can get this on board and run it:

Download Dr.Web CureIt to the desktop:

ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Doubleclick the drweb-cureit icon to start the program.
* press start
* Allow the program to run the initial express scan
* This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
* Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
* Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take some time)
* During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
* Once the scan is complete, on the menu bar, click file and choose report list.
* Save the report to your desktop. The report will be called DrWeb.csv
* Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
* Close Dr.Web Cureit.
* Please post the Dr.Web.txt report in your next reply

[Canuck78]

We seem to be making some progress. My AV is running again and I am not getting those fake alerts that I am infected anymore.

Here is the DrWeb Report:

braviax.exe;c:\windows\system32;Trojan.Fakealert.4875;Deleted.;
beep.sys;c:\windows\system32\drivers;Trojan.NtRootKit.3206;Deleted.;
lcbckjms.exe;C:\;Trojan.MulDrop.33724;Deleted.;
sdlb.exe;C:\;Trojan.MulDrop.33724;Deleted.;
yihw.exe;C:\;Trojan.Packed.2582;Deleted.;
RegUBP2b-USER.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;
msupd_2.exe;C:\Documents and Settings\USER\Local Settings\Temp;Trojan.Fakealert.4747;Incurable.Moved.;
winamp[1].exe;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\F7LT3V0X;Trojan.Fakealert.4703;Deleted.;
Install[1].exe;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\GOR3YO71;Trojan.Fakealert.4747;Incurable.Moved.;
ebbpttlp[1].htm;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1;Trojan.MulDrop.33724;Deleted.;
tqqdv[1].txt;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1;Trojan.Packed.2582;Deleted.;
atdhuv[1].htm;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4;Trojan.MulDrop.33724;Deleted.;
A0082662.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082664.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082679.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082680.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082685.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082705.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP140;Trojan.Fakealert.4875;Deleted.;
A0082707.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP140;Trojan.Fakealert.4875;Deleted.;
A0082734.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Fakealert.4875;Deleted.;
A0082751.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Fakealert.4875;Deleted.;
A0082752.sys;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.NtRootKit.3206;Deleted.;
A0082753.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.MulDrop.33724;Deleted.;
A0082754.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.MulDrop.33724;Deleted.;
A0082755.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Packed.2582;Deleted.;
A0082756.reg;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.StartPage.1505;Deleted.;
braviax.exe;C:\WINDOWS;Trojan.Fakealert.4875;Deleted.;
cru629.dat;C:\WINDOWS;Trojan.Proxy.1739;Deleted.;
cru629.dat;C:\WINDOWS\system32;Trojan.Proxy.1739;Deleted.;
wisdstr.exe;C:\WINDOWS\system32;Trojan.Fakealert.4747;Incurable.Moved.;
_scui.cpl;C:\WINDOWS\system32;Trojan.Fakealert.4739;Deleted.;
~.exe;C:\WINDOWS\system32;Trojan.Fakealert.4703;Deleted.;
beep.sys;C:\WINDOWS\system32\dllcache;Trojan.NtRootKit.3206;Deleted.;
figaro.sys;C:\WINDOWS\system32\dllcache;Trojan.NtRootKit.3206;Deleted

[Canuck78]

My google searches are still getting re-directed however.

[shelf life]

ok so far so good. You have read the combofix guide? See if you can get combofix to run now.

[Canuck78]

Here is the ComboFix Report:

ComboFix 09-08-24.05 - USER 08/29/2009 0:03.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2602 [GMT -5:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090827-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\kuvepa.com
c:\documents and settings\All Users\Application Data\limow.reg
c:\documents and settings\All Users\Application Data\ovepipud.dl
c:\documents and settings\All Users\Application Data\qigeb.dll
c:\documents and settings\All Users\Application Data\vojyxi.exe
c:\documents and settings\All Users\Documents\iheman.scr
c:\documents and settings\All Users\Documents\puluwyfi.exe
c:\documents and settings\All Users\Documents\zuwesu.sys
c:\documents and settings\USER\Application Data\mexamyq.com
c:\documents and settings\USER\Application Data\tozo.vbs
c:\documents and settings\USER\Application Data\upinyfuzi.pif
c:\documents and settings\USER\Application Data\upowikovu.scr
c:\documents and settings\USER\Application Data\ygifiryko.com
c:\documents and settings\USER\Cookies\fumefuw.com
c:\documents and settings\USER\Cookies\ipeco.com
c:\documents and settings\USER\Cookies\okacusewur.dll
c:\documents and settings\USER\Cookies\oloxi.sys
c:\documents and settings\USER\Local Settings\Application Data\fewopykyra.exe
c:\documents and settings\USER\Local Settings\Application Data\fyzehil.vbs
c:\documents and settings\USER\Local Settings\Application Data\hikogimyx._dl
c:\documents and settings\USER\Local Settings\Application Data\ijadinuwit.exe
c:\documents and settings\USER\Local Settings\Application Data\ijetequkad.com
c:\documents and settings\USER\Local Settings\Application Data\iwodosil.scr
c:\documents and settings\USER\Local Settings\Application Data\kewozaba.pif
c:\documents and settings\USER\Local Settings\Application Data\povit._dl
c:\documents and settings\USER\Local Settings\Application Data\pyromug.pif
c:\documents and settings\USER\Local Settings\Application Data\tuxiku.ban
c:\documents and settings\USER\Local Settings\Application Data\yfel.ban
c:\documents and settings\USER\Local Settings\Temporary Internet Files\gileranage._dl
c:\documents and settings\USER\Local Settings\Temporary Internet Files\hebunubere.scr
c:\documents and settings\USER\Local Settings\Temporary Internet Files\irisuviror.bin
c:\documents and settings\USER\Local Settings\Temporary Internet Files\uliqa.reg
c:\documents and settings\USER\Local Settings\Temporary Internet Files\ynodehy.dl
C:\ekxfnpkm.exe
c:\program files\Common Files\erifazu._dl
c:\program files\Common Files\horiguxeny.scr
c:\program files\Common Files\isetiqewu.scr
c:\program files\Common Files\jene.scr
c:\program files\Common Files\qoqi.com
c:\program files\Common Files\zafajodab.vbs
c:\windows\cucobacux.exe
c:\windows\isumezi.dl
c:\windows\suge.reg
c:\windows\system32\anysakugek._dl
c:\windows\system32\dosimeci.reg
c:\windows\system32\drivers\UACd.sys
c:\windows\system32\hojeq.dl
c:\windows\system32\owofiroma.bin
c:\windows\system32\rumob.bat
c:\windows\system32\tajf83ikdmf.dll
c:\windows\system32\tedebo.vbs
c:\windows\system32\umatu.dll
c:\windows\system32\uzib.pif
c:\windows\system32\weqibyn.dll
c:\windows\ubinygegoz.pif
c:\windows\upehutaz.ban
c:\windows\ymawo.reg

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 )))))))))))))))))))))))))))))))
.

2009-08-28 02:38 . 2009-08-28 02:38 -------- d-----w- c:\documents and settings\USER\DoctorWeb
2009-08-25 01:22 . 2009-08-25 01:22 18107 ----a-w- c:\windows\suzibim.dat
2009-08-25 00:42 . 2009-08-25 00:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-23 19:31 . 2009-08-23 19:31 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-23 02:40 . 2009-08-23 02:40 -------- d-----w- c:\program files\Trend Micro
2009-08-23 02:38 . 2009-08-23 02:38 -------- d-----w- c:\program files\ERUNT
2009-08-23 02:07 . 2009-08-23 02:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-23 00:41 . 2009-08-23 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-23 00:41 . 2009-08-23 01:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\USER\Application Data\Malwarebytes
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-22 09:43 . 2009-08-22 09:43 18842 ----a-w- c:\windows\sadir.com
2009-08-22 09:43 . 2009-08-22 09:43 16248 ----a-w- c:\windows\system32\ivalitib.com
2009-08-22 09:43 . 2009-08-22 09:43 12350 ----a-w- c:\windows\system32\irilyp.dat
2009-08-14 08:19 . 2009-06-25 08:25 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll
2009-08-14 08:19 . 2009-06-25 08:25 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll
2009-08-14 08:19 . 2009-06-25 08:25 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll
2009-08-14 08:19 . 2009-06-24 11:18 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\MSBuild
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\Reference Assemblies
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- C:\994bb1b65eb8bd7bddb4
2009-08-14 08:03 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-14 08:03 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-14 08:03 . 2009-08-14 08:17 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-12 08:00 . 2009-08-12 08:00 -------- d-----w- c:\program files\MSXML 4.0
2009-08-11 21:11 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\LocalService\Application Data\Roxio
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\USER\Application Data\Roxio
2009-08-10 17:54 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-10 17:54 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-10 17:46 . 2009-08-10 19:37 256 ----a-w- c:\windows\system32\pool.bin
2009-08-10 17:46 . 2009-08-10 18:01 -------- d-----w- c:\documents and settings\USER\Application Data\Research In Motion
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\USER\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-08-10 17:38 . 2009-08-10 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2009-08-10 17:37 . 2009-01-09 21:18 27136 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2009-08-10 17:37 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-08-10 17:36 . 2009-08-10 17:37 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-08-10 17:36 . 2009-08-10 17:38 -------- d-----w- c:\program files\Research In Motion
2009-08-08 04:46 . 2009-08-08 04:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-07 05:21 . 2009-08-07 05:21 -------- d-----w- c:\documents and settings\USER\Freeze Tag
2009-08-07 05:18 . 2009-08-07 05:20 -------- d-----w- c:\program files\Mystery Masterpiece - The Moonstone
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-25 13:30 . 2009-04-17 16:48 -------- d-----w- c:\program files\Common Files\Software Update Utility
2009-08-25 01:22 . 2009-08-25 01:22 18195 ----a-w- c:\program files\Common Files\mexohysu.inf
2009-08-25 01:22 . 2009-08-25 01:22 12681 ----a-w- c:\program files\Common Files\isikusicy.lib
2009-08-25 00:27 . 2009-06-16 03:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-10 18:01 . 2009-03-28 06:38 80936 ----a-w- c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-10 17:39 . 2009-03-23 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-08 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Google
2009-08-07 14:58 . 2009-06-16 03:12 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-08-05 20:17 . 2009-04-02 23:56 -------- d-----w- c:\documents and settings\USER\Application Data\dvdcss
2009-08-05 09:01 . 2004-08-03 20:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-18 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Common Files\Real
2009-07-18 04:46 . 2009-07-18 04:46 -------- d-----w- c:\program files\Real
2009-07-17 19:01 . 2004-08-03 20:56 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 19:50 . 2009-07-08 16:56 -------- d-----w- c:\program files\Farm Frenzy 2
2009-07-14 04:43 . 2004-08-03 20:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 17:31 . 2009-07-08 17:06 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-07-08 06:29 . 2009-07-06 09:00 -------- d-----w- c:\documents and settings\All Users\Application Data\MumboJumbo
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\program files\AIM6
2009-07-06 16:09 . 2009-07-06 16:09 -------- d-----w- c:\program files\AIM Toolbar
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-06 16:09 . 2009-04-17 16:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-07-03 17:09 . 2004-08-03 20:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 16:00 . 2009-04-17 17:04 -------- d-----w- c:\program files\AIMTunes
2009-06-25 08:25 . 2004-08-03 20:56 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-03 20:56 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-03 20:56 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-03 20:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-03 20:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-03 20:56 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-03 18:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-03 20:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-23 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-03 20:56 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-03 20:56 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:19 . 2009-03-23 18:33 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2004-08-03 20:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-03 20:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-03 20:56 1291264 ----a-w- c:\windows\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-06 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-06 137752]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 823296]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-06-01 974848]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2008-04-14 53248]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2007-03-27 217088]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-21 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-09-13 91432]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-18 198160]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

c:\documents and settings\USER\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-05-17 04:50 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/23/2009 2:06 PM 114768]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2/1/2008 8:24 PM 41456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/23/2009 2:06 PM 20560]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/17/2009 11:48 AM 24652]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [3/23/2009 1:49 PM 812544]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-08-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-18 04:46]

2009-08-29 c:\windows\Tasks\User_Feed_Synchronization-{355B7B07-B470-4EFF-9466-FD543D9FD666}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C19FB533-FDBA-4162-BDA8-6DD0D43D97DF} = 85.31.81.245,85.31.66.4
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 00:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1028)
c:\windows\system32\VESWinlogon.dll

- - - - - - - > 'explorer.exe'(3748)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-08-29 0:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-29 05:13

Pre-Run: 929,124,352 bytes free
Post-Run: 1,262,014,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

309 --- E O F --- 2009-08-27 10:20

[shelf life]

ok looking good. Your redirects must be gone by now. We will use combofix:

Click Start, then Run and type Notepad and click OK.
Copy/paste the text in the code box below into notepad:



File::
c:\windows\suzibim.dat
c:\windows\sadir.com
c:\windows\system32\ivalitib.com
c:\windows\system32\irilyp.dat
c:\program files\Common Files\mexohysu.inf
c:\program files\Common Files\isikusicy.lib
C:\994bb1b65eb8bd7bddb4


Name the Notepad file CFScript.txt and Save it to your desktop.
now locate the file you just saved and the combofix icon, both on your desktop
using your mouse drag the CFScript right on top of the combofix icon and release, combofix will run and produce a new log
please post the new combofix log.

After combofix has finished check Malwarebytes for updates do a full scan and post its log also:

Start MBAM, click the updates tab then check for updates. If an update is found, it will download and install the latest version.

click the Scanner tab, select Perform FULL SCAN, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click *Remove Selected.*

*A restart of your computer most likely will be required to remove some items.*

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post the log in your reply.

[Canuck78]

Yes the redirects are gone now.

Here is the ComboFix Report:

ComboFix 09-08-29.01 - USER 08/29/2009 23:45.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2567 [GMT -5:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\USER\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090829-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point

FILE ::
"C:\994bb1b65eb8bd7bddb4"
"c:\program files\Common Files\isikusicy.lib"
"c:\program files\Common Files\mexohysu.inf"
"c:\windows\sadir.com"
"c:\windows\suzibim.dat"
"c:\windows\system32\irilyp.dat"
"c:\windows\system32\ivalitib.com"
.
/wow section - STAGE 7
The process cannot access the file because it is being used by another process.


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\syrevu.lib
c:\documents and settings\USER\Application Data\jufatug._sy
c:\documents and settings\USER\Application Data\nade._sy
c:\documents and settings\USER\Application Data\ufogoz.inf
c:\documents and settings\USER\Cookies\pucan.inf
c:\program files\Common Files\isikusicy.lib
c:\program files\Common Files\mexohysu.inf
c:\windows\AegisP.inf
c:\windows\qivifom.inf
c:\windows\sadir.com
c:\windows\suzibim.dat
c:\windows\system32\irilyp.dat
c:\windows\system32\ivalitib.com

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
.

2009-08-28 02:38 . 2009-08-28 02:38 -------- d-----w- c:\documents and settings\USER\DoctorWeb
2009-08-25 00:42 . 2009-08-25 00:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-23 19:31 . 2009-08-23 19:31 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-23 02:40 . 2009-08-23 02:40 -------- d-----w- c:\program files\Trend Micro
2009-08-23 02:38 . 2009-08-23 02:38 -------- d-----w- c:\program files\ERUNT
2009-08-23 02:07 . 2009-08-23 02:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-23 00:41 . 2009-08-23 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-23 00:41 . 2009-08-23 01:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\USER\Application Data\Malwarebytes
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-14 08:19 . 2009-06-25 08:25 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll
2009-08-14 08:19 . 2009-06-25 08:25 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll
2009-08-14 08:19 . 2009-06-25 08:25 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll
2009-08-14 08:19 . 2009-06-24 11:18 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\MSBuild
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\Reference Assemblies
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- C:\994bb1b65eb8bd7bddb4
2009-08-14 08:03 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-14 08:03 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-14 08:03 . 2009-08-14 08:17 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-12 08:00 . 2009-08-12 08:00 -------- d-----w- c:\program files\MSXML 4.0
2009-08-11 21:11 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\LocalService\Application Data\Roxio
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\USER\Application Data\Roxio
2009-08-10 17:54 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-10 17:54 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-10 17:46 . 2009-08-10 19:37 256 ----a-w- c:\windows\system32\pool.bin
2009-08-10 17:46 . 2009-08-10 18:01 -------- d-----w- c:\documents and settings\USER\Application Data\Research In Motion
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\USER\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-08-10 17:38 . 2009-08-10 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2009-08-10 17:37 . 2009-01-09 21:18 27136 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2009-08-10 17:37 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-08-10 17:36 . 2009-08-10 17:37 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-08-10 17:36 . 2009-08-10 17:38 -------- d-----w- c:\program files\Research In Motion
2009-08-08 04:46 . 2009-08-08 04:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-07 05:21 . 2009-08-07 05:21 -------- d-----w- c:\documents and settings\USER\Freeze Tag
2009-08-07 05:18 . 2009-08-07 05:20 -------- d-----w- c:\program files\Mystery Masterpiece - The Moonstone
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 05:16 . 2009-03-28 06:38 80936 ----a-w- c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-25 13:30 . 2009-04-17 16:48 -------- d-----w- c:\program files\Common Files\Software Update Utility
2009-08-25 00:27 . 2009-06-16 03:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-10 17:39 . 2009-03-23 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-08 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Google
2009-08-07 14:58 . 2009-06-16 03:12 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-08-05 20:17 . 2009-04-02 23:56 -------- d-----w- c:\documents and settings\USER\Application Data\dvdcss
2009-08-05 09:01 . 2004-08-03 20:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-18 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Common Files\Real
2009-07-18 04:46 . 2009-07-18 04:46 -------- d-----w- c:\program files\Real
2009-07-17 19:01 . 2004-08-03 20:56 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 19:50 . 2009-07-08 16:56 -------- d-----w- c:\program files\Farm Frenzy 2
2009-07-14 04:43 . 2004-08-03 20:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 17:31 . 2009-07-08 17:06 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-07-08 06:29 . 2009-07-06 09:00 -------- d-----w- c:\documents and settings\All Users\Application Data\MumboJumbo
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\program files\AIM6
2009-07-06 16:09 . 2009-07-06 16:09 -------- d-----w- c:\program files\AIM Toolbar
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-06 16:09 . 2009-04-17 16:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-07-03 17:09 . 2004-08-03 20:56 915456 ------w- c:\windows\system32\wininet.dll
2009-06-25 08:25 . 2004-08-03 20:56 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-03 20:56 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-03 20:56 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-03 20:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-03 20:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-03 20:56 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-03 18:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-03 20:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-23 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-03 20:56 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-03 20:56 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:19 . 2009-03-23 18:33 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2004-08-03 20:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-03 20:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-03 20:56 1291264 ----a-w- c:\windows\system32\quartz.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-29_05.10.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-30 04:33 . 2009-08-30 04:33 16384 c:\windows\Temp\Perflib_Perfdata_6f8.dat
- 2009-08-29 04:54 . 2009-08-29 04:54 16384 c:\windows\Temp\Perflib_Perfdata_6f8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-06 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-06 137752]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 823296]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-06-01 974848]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2008-04-14 53248]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2007-03-27 217088]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-21 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-09-13 91432]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-18 198160]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

c:\documents and settings\USER\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-05-17 04:50 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/23/2009 2:06 PM 114768]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2/1/2008 8:24 PM 41456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/23/2009 2:06 PM 20560]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/17/2009 11:48 AM 24652]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [3/23/2009 1:49 PM 812544]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-08-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-18 04:46]

2009-08-30 c:\windows\Tasks\User_Feed_Synchronization-{355B7B07-B470-4EFF-9466-FD543D9FD666}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C19FB533-FDBA-4162-BDA8-6DD0D43D97DF} = 85.31.81.245,85.31.66.4
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 23:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1008)
c:\windows\system32\VESWinlogon.dll
.
Completion time: 2009-08-30 23:50
ComboFix-quarantined-files.txt 2009-08-30 04:50
ComboFix2.txt 2009-08-29 05:13

Pre-Run: 1,236,328,448 bytes free
Post-Run: 1,169,977,344 bytes free

232 --- E O F --- 2009-08-27 10:20


I am about to run MBAM. I will post the report as soon as it is done.

[Canuck78]

Here is the MBAM Report:

Malwarebytes' Anti-Malware 1.40
Database version: 2715
Windows 5.1.2600 Service Pack 3

8/30/2009 12:31:04 AM
mbam-log-2009-08-30 (00-31-04).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 162239
Time elapsed: 23 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\ekxfnpkm.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tajf83ikdmf.dll.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\USER\DoctorWeb\Quarantine\Install[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\USER\DoctorWeb\Quarantine\msupd_2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\USER\DoctorWeb\Quarantine\wisdstr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082760.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082761.cpl (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082763.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082764.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082901.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141\A0082912.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

[shelf life]

please run RootRepeal once more, like last time and post the log.

[Canuck78]

New RootRepeal log:

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/30 23:07
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys
Address: 0x9787F000 Size: 778240 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x97B7C000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: c:\windows\temp\perflib_perfdata_960.dat
Status: Allocation size mismatch (API: 16384, Raw: 0)

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa33726b8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3372574

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3372a52

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa337214c

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa337264e

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa337208c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa33720f0

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa337276e

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa337272e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa33728ae

==EOF==

[shelf life]

ok thanks for the info. One more thing to do:

Please download this utility to your desktop:

http://download.bleepingcomputer.com/rootrepeal/Win32kDiag.exe

double click to run. When finished it will generate a .txt file on your desktop: Win32KDiag.txt. Post the contents of the .txt file.

[Canuck78]

Sorry about not responing earlier. I have been moving and things have been hectic. Here is the file that was generated:

Log file is located at: C:\Documents and Settings\USER\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...





Finished!

[shelf life]

Hi Canuck78,

ok thanks for all the info. You can remove combofix like this;
start>run and type in:
combofix /u
click ok or enter
Note: there is a space after the x and before the /
You can delete the RootRepeal icon from your desktop.

Always check MBAM for updates before scanning. The paid version offers auto-updating and a real time protection feature.

One last thing you can do is a make a new restore point. The why and how:

One of the features of Windows ME,XP and Vista is the System Restore option, however if malware infects a computer it is possible that the malware could be backed up in the System Restore archive. Therefore, clearing the restore points is a good idea after malware is removed and your computer appears to be functioning ok.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore. (deletes old possibly infected restore point)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.(new restore points on a clean system)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK, then reboot

And last some general tips:

10 Tips for Reducing Your Risk To Malware:
The Short Version

1) It is essential to Keep your OS (http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us),(Windows) browser (IE, FireFox) and other software up to date to "patch" vulnerabilities that could be exploited. This is also true for web based applications like Java, Adobe Flash/Reader, QuickTime etc. Check there version status here. (http://secunia.com/vulnerability_scanning/online/) Malicious web sites can take advantage of vulnerabilities to possibly push and install malware to your computer.

2) Know what you are installing to your computer. Alot of software can come bundled with unwanted add-ons, like adware, toolbars and malware. Do not install any files from ads, popups or random links. Do not fall for fake warnings about virus and trojans being found on your computer and your then prompted to install software to remedy this. See also the signs (http://www.virusvault.us/signs1.html)that you may have malware on your computer.

3) Install and keep updated: one antivirus and two or three anti-malware applications. If not updated they will soon be worthless. Scanning frequency is a function of your computer habits.

4) Refrain from clicking on links or attachments you receive via E-Mail, IM, IRC, Chat Rooms or Social Networking Sites, no matter how tempting or legitimate the message may seem. Links could redirect you to malicious websites that host exploits. Attachments could contain malware. Do you trust the source?

5) Don't click on ads/pop ups or offers from websites requesting that you need to install software, media players or codecs to your computer--for any reason.

6) Don't click on offers to "scan" your computer. Install ActiveX Objects with care. Do you trust the website?

7) Set up and use limited (non-privileged) accounts for everyday use, rather than administrator accounts. Limited accounts (http://www.microsoft.com/protect/computer/advanced/useraccount.mspx) can help prevent *malware from installing.*

8) Install and understand the limitations of a software firewall.

9) Consider using an alternate browser and E-mail client. Internet Explorer and OutLook Express are popular targets for malicious code because they are widely used. See also: Hardening or Securing Internet Explorer. (http://www.microsoft.com/downloads/details.aspx?FamilyID=6AA4C1DA-6021-468E-A8CF-AF4AFE4C84B2&displaylang=en)

10) Warez, cracks, keygens etc are very popular for carrying malware payloads. Avoid. If you install files via p2p (http://www.virusvault.us/p2p.html) networks then you are much more likely to encounter malicious code. Do you trust the source? Do you really need another malware source?

A longer version in link below.

Happy Safe Surfing.

[tashi]

Thank you shelf life.