Operating memory - Win32/Olmarik trojan - unable to clean

[peterolin]

I'm running ESET NOD32 Antivirus, V4.0.437.0 and it detects the following:

"Operating memory - Win32/Olmarik trojan - unable to clean"

I'm having some intermittent problems with IE windows ads popping up - and I'm not running IE usually.

Kind regards,
Peter Olin

A log from HiJackThis shows the following. Any help is greatly appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:17:50, on 2009-10-08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\Program\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Free Download Manager\fdm.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program\Spybot - Search & Destroy\TeaTimer.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9a157c2d-a9da-4ef1-a759-d824a4812667} - C:\WINDOWS\system32\zaregabi.dll (file missing)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program\Free Download Manager\iefdmcks.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ATIPTA] C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\Program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [DMXLauncher] C:\Program\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [egui] "C:\Program\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [prnet] "C:\WINDOWS\system32\prnet.tmp"
O4 - HKCU\..\Run: [ptidle] "C:\Documents and Settings\Peter\Application Data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [g[Hn7gQky] C:\Documents and Settings\Peter\Application Data\Microsoft\Windows\cvkkoaj.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program\Free Download Manager\dllink.htm
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
O9 - Extra 'Tools' menuitem: &Inställningar i Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program\Google\Google Gears\Internet Explorer\0.5.4.0\gears.dll (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - AppInit_DLLs: C:\WINDOWS\system32\polarudu.dll c:\progra~1\ThunMail\testabd.dll c:\windows\system32\miliyepa.dll
O23 - Service: Apache2 - Apache Software Foundation - C:\Program\Apache Group\Apache2\bin\Apache.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program\Canon\CAL\CALMAIN.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Unknown owner - C:\Program\DynDNS Updater\DynDNS.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 8700 bytes

[Blade81]

Hi,

Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.



Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.

[peterolin]

Hi Blade! Thanks for the response and your advise.


FYI: Between the HiJackThis execution and log posted the other day and now, AdAware has been executed, and a Win32Trojan.Tdss (Malware) has been removed. [Files: C:\WINDOWS\system32\odrkrjmeokwtsivt.dll and opnvyunykfvpysmj.dll] NOD32 Still reports that it is finding "Operating memory - Win32/Olmarik trojan - unable to clean".

Now back to the requested information:

Here below is DDS.txt, and attached is Attach.zip (Zipped version of Attach.txt) as requested. I also downloaded GMER, as bfwgfo4y.exe. The results of the execution is at the end of this post.

I've read the FAQ and tried my best to follow the guidelines supplied - all very clear and reasonable.

Thanks guys for the great work and service you are providing.

/Peter

DDS (Ver_09-09-29.01) - NTFSx86
Run by Peter at 18:14:04,07 on 2009-10-10
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.194 [GMT 2:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\Program\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\Program\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Free Download Manager\fdm.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program\Spybot - Search & Destroy\TeaTimer.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program\Java\jre6\bin\jqs.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Lavasoft\Ad-Aware\Ad-Aware.exe
C:\Program\Apple Software Update\SoftwareUpdate.exe
C:\Program\emacs-21.3\bin\emacs.exe
C:\Documents and Settings\Peter\Skrivbord\Downloaded\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.euro.dell.com/
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot - search & destroy\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {9a157c2d-a9da-4ef1-a759-d824a4812667} - c:\windows\system32\zaregabi.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
EB: DF Bar: {67fcef90-073e-11de-8c30-0800200c9a66} - %SystemRoot%\system32\shdocvw.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
uRun: [prnet] "c:\windows\system32\prnet.tmp"
uRun: [ptidle] "c:\documents and settings\peter\application data\ptidle\ptidle.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
uRun: [g[Hn7gQky] c:\documents and settings\peter\application data\microsoft\windows\cvkkoaj.exe
uRun: [SpybotSD TeaTimer] c:\program\spybot - search & destroy\TeaTimer.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
mRun: [pdfSaver3]
mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot - search & destroy\SDHelper.dll
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: c:\windows\system32\polarudu.dll c:\progra~1\thunmail\testabd.dll c:\windows\system32\miliyepa.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 setuid
LSA: Notification Packages = scecli c:\windows\system32\polarudu.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program\mozilla firefox\components\dfff.dll
FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}
FF - HiddenExtension: XUL Cache: No Registry Reference - c:\program\mozilla firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}

---- FIREFOX POLICIES ----
c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
S3 eati1ttx;eati1ttx;\??\c:\docume~1\victor\lokala~1\temp\eati1ttx.sys --> c:\docume~1\victor\lokala~1\temp\eati1ttx.sys [?]
S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys --> c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys [?]
S3 o1394bul;o1394bul;\??\c:\docume~1\victor\lokala~1\temp\o1394bul.sys --> c:\docume~1\victor\lokala~1\temp\o1394bul.sys [?]
S3 xintelpp;xintelpp;\??\c:\docume~1\victor\lokala~1\temp\xintelpp.sys --> c:\docume~1\victor\lokala~1\temp\xintelpp.sys [?]

=============== Created Last 30 ================

2009-10-10 18:10 256 a---h--- C:\aaw7boot.cmd
2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
2009-10-08 01:09 <DIR> --d----- c:\program\ESET

==================== Find3M ====================

2009-10-08 01:26 115 a------- C:\xcrashdump.dat
2008-01-05 18:50 5,947 a------- c:\program\INSTALL.LOG
2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
2007-02-02 11:51 450,560 a------- c:\program\setup.exe
2007-02-02 11:51 517 a------- c:\program\layout.bin
2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
2007-02-02 11:48 490 a------- c:\program\setup.ini
2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
2007-01-23 17:02 44 a----r-- c:\program\autorun.inf
2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

============= FINISH: 18:14:39,10 ===============


GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2009-10-10 18:34:31
Windows 5.1.2600 Service Pack 3
Running: bfwgfo4y.exe; Driver: C:\DOCUME~1\Peter\LOKALA~1\Temp\fxtdipow.sys


---- System - GMER 1.0.15 ----

SSDT 8675BCB0 ZwOpenProcess
SSDT 8675C0D0 ZwOpenThread
SSDT 8675C6D0 ZwSuspendProcess
SSDT 8675C4F0 ZwSuspendThread
SSDT 8675BEE0 ZwTerminateProcess
SSDT 8675C310 ZwTerminateThread

Code 86E8B7D8 ZwEnumerateKey
Code 86EB8390 ZwFlushInstructionCache
Code 86EA214E IofCallDriver
Code 86DBC056 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 86EA2153
.text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 86DBC05B
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 86EB8394
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 86E8B7DC

---- User code sections - GMER 1.0.15 ----

.text C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe[1820] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\atapi \Device\Ide\IdePort0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)

---- Threads - GMER 1.0.15 ----

Thread System [4:344] 8675A930

---- EOF - GMER 1.0.15 ----

[Blade81]

Hello Peter,

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent
Azureus


I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).



After that:


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:


Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.


Click Yes to allow ComboFix to continue scanning for malware.


When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

[peterolin]

Hi!

Thanks for the heads up on uTorrent and Azuerus.

uTorrent - removed with Add/Remove Programs
Azureus - Add/Remove Programs couldn't do it, and popped up a warning dialog "Couldn't load main class", as did Azureus Uninstall.exe. So I simply removed the whole Azureus folder from my C:\Programs folder. So imagine there is some leftovers around somewhere.


I Disabled Azureus.

I downloaded ComboFix to the Desktop, read the instructions.

I Unpuggled my network cable since my antivir is now disabled, and I'm running this heart surgeon software.

I closed all windows.

When double clicking on ComboFix.exe on my desktop I received the following Windows error pop up:



"Windows - Ingen disk" [Translation from Swedish: "Windows - No disk"]
Exception Processing Message c0000012 Parameters 75b4bf7c 4 75b4bf7c 75b4bf7c
"Avbryt" "Försök igen" "Fortsätt" [Translation: "Cancel" "Try again" "Continue"]


I clicked "Try again", same message popup.

So I clicked "Continue", same message popup.

So I clicked "Cancel", and "Try Again" and "Cancel", and then...

...finally the ComboFix Disclaimer popped up.


A dark blue commandwindow opens up. Tells me that it it creating a restore checkpoint. (Messages are in Swedish)

After a few seconds, the same Error dialog as detailed above shows up.

I click "Cancel" x 3

A progress bar shows up for a while

Again, I must click "Cancel" x 4

ComboFix wants do download Windows Recovery Console, so I plug in my network cable again.

A dialog shows that some rootkits are active . And lists them. I'm attaching a JPGof that dialog if you need it. A handful of random name files are listed.

Automatic reboot.

Process continues according to instructions.

At reboot another dialog that I always see at startup is shown. See attached JPG.



So, here are the logs. Check attachemnts for dialogs. The one without the rootkit info translates roughly to: "One of the files in the registry had to be restored with the help of a log file or from an alternate version. The restore was performed."

Thanks,
Peter


ComboFix 09-10-10.02 - Peter 2009-10-11 11:24.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.650 [GMT 2:00]
Körs från: c:\documents and settings\Peter\Skrivbord\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Skapade en ny återställningspunkt
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Peter\Application Data\digifast
c:\documents and settings\Peter\Application Data\digifast\config.cfg
c:\documents and settings\Peter\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Peter\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Peter\Local Settings\Temporary Internet Files\Cpvff.stt
c:\documents and settings\Peter\Local Settings\Temporary Internet Files\fbk.sts
c:\documents and settings\Peter\Mina dokument\ZbThumbnail.info
c:\documents and settings\Victor\Start-meny\Program\Autostart\Registration .LNK
c:\program\\setup.exe
c:\program\autorun.inf
c:\program\INSTALL.LOG
c:\program\Jcore
c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}
c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{15964B87-5FBE-4E16-AF1B-54E3C5B554C7}\install.rdf
c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}
c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{6304F630-C28D-40A9-A654-9F3413A0A848}\install.rdf
c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}
c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{77322F9F-BF99-4673-B68B-E644CE969734}\install.rdf
c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}
c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{7CCD23DD-89BF-422C-9633-6DA4B41056A2}\install.rdf
c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}
c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{84338D93-3760-4A87-A403-C70FF9C05B57}\install.rdf
c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}
c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{A2949525-3453-4128-8AE3-7372243A4643}\install.rdf
c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}
c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{A5C09217-5258-4D2C-B92A-FB822ABF08A4}\install.rdf
c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}
c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{C31C77BD-4D5C-4AAB-8105-19FF8EA247CF}\install.rdf
c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}
c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{C83C9375-06E3-4E3A-9466-001C9AF18294}\install.rdf
c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}
c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{DCEE8A2C-532E-4898-9B4B-8D6D7F8179E2}\install.rdf
c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}
c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{DE98CC08-268C-41FC-B9FE-31ACE687D827}\install.rdf
c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}
c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{E72EAD31-F3F1-404A-ACCB-EE2489167C86}\install.rdf
c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}
c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{EE12C842-6538-4BDA-8F50-9EBE2ECA881F}\install.rdf
c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}
c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{F65F1F29-316D-43D5-8168-A7C1405584B9}\install.rdf
c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}
c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\chrome.manifest
c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\chrome\content\overlay.xul
c:\program\Mozilla Firefox\extensions\{FAA789E6-6531-4153-834F-B9E6320CBD37}\install.rdf
c:\program\WWShow
c:\windows\Installer\5e9e98.msi
c:\windows\Installer\76a0b6.msi
c:\windows\run.log
c:\windows\system32\drivers\ovfsthpqxfdgptkltioahfcixjxwdoetsberql.sys
c:\windows\system32\N8BGALPv.exe.a_a
c:\windows\system32\ovfsthhsrtqcknlkriabwuqdmmgqarpibgkipe.dat
c:\windows\system32\ovfsthtfioxtuiwgldcanwodrkrjmeokwtsivt.dll
c:\windows\system32\ovfsthxaixwobsxlttvdnqopnvyunykfvpysmj.dll
c:\windows\system32\ovfsthxwbapqpakmpjxjkvnntorrnlqbehppfc.dll
c:\windows\system32\ovfsthyrgsobkmklitfxiorgqyjskevewtrfvx.dat
c:\windows\system32\vp_setup.exe.bat
C:\xcrashdump.dat
E:\install.exe

.
((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthuwmybwvypibmlwvlhylkrvkinethowia


(((((((((((((((((((((((( Filer Skapade från 2009-09-11 till 2009-10-11 ))))))))))))))))))))))))))))))
.

2009-10-10 20:11 . 2009-10-10 21:40 -------- d-----w- c:\program\Squeak
2009-10-10 16:28 . 2009-10-11 08:42 -------- d-----w- C:\Downloads
2009-10-09 22:04 . 2009-10-09 22:04 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-08 10:30 . 2009-10-08 10:39 -------- d-----w- c:\program\Safer Networking
2009-10-08 08:30 . 2009-10-08 08:30 -------- d-----w- c:\program\Squeak3.8-current-win-full
2009-10-08 08:15 . 2009-10-08 08:23 -------- d-----w- c:\program\Spybot - Search & Destroy
2009-10-08 07:44 . 2009-10-08 07:15 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-10-08 07:15 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-10-08 07:11 . 2009-10-08 07:11 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
2009-10-07 23:09 . 2009-10-07 23:11 -------- d-----w- c:\program\ESET

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-11 08:44 . 2005-08-23 01:06 -------- d-----w- c:\documents and settings\Peter\Application Data\Free Download Manager
2009-10-11 08:23 . 2007-07-15 13:31 -------- d-----w- c:\program\uTorrent
2009-10-09 22:04 . 2005-07-15 18:31 -------- d-----w- c:\program\Java
2009-10-08 08:16 . 2005-09-30 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-08 07:09 . 2007-03-17 14:13 -------- d-----w- c:\program\Delade filer\Wise Installation Wizard
2009-10-08 07:08 . 2005-08-04 20:46 -------- d-----w- c:\documents and settings\Peter\Application Data\Apple Computer
2009-10-07 23:34 . 2009-05-18 20:42 -------- d-----w- c:\documents and settings\Peter\Application Data\Twain
2009-10-07 23:28 . 2006-11-13 19:12 -------- d-----w- c:\program\NCH Swift Sound
2009-09-23 19:47 . 2007-07-15 13:31 -------- d-----w- c:\documents and settings\Victor\Application Data\uTorrent
2009-09-23 16:37 . 2007-12-18 19:13 -------- d-----w- c:\program\Steam
2007-02-02 09:58 . 2007-02-02 09:58 57016 ----a-w- c:\program\data1.hdr
2007-02-02 09:51 . 2007-02-02 09:51 517 ----a-w- c:\program\layout.bin
2007-02-02 09:51 . 2007-02-02 09:51 1036390187 ----a-w- c:\program\data2.cab
2007-02-02 09:48 . 2007-02-02 09:48 67332864 ----a-w- c:\program\data1.cab
2007-02-02 09:48 . 2007-02-02 09:48 552214 ----a-w- c:\program\ISSetup.dll
2007-02-02 09:48 . 2007-02-02 09:48 490 ----a-w- c:\program\setup.ini
2007-01-23 15:03 . 2007-01-23 15:03 317248 ----a-r- c:\program\dxwebsetup.exe
2006-08-07 08:09 . 2006-08-07 08:09 164784 ----a-w- c:\program\_Setup.dll
2003-12-18 09:33 . 2007-02-02 08:01 20102 ----a-w- c:\program\Readme.txt
2003-09-03 05:46 . 2007-08-31 13:20 10960 ----a-w- c:\program\EULA.txt
2009-05-18 20:48 . 2009-05-18 20:48 211968 ----a-w- c:\program\mozilla firefox\components\dfff.dll
.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* Tomma poster & legitima standardposter visas inte.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Free Download Manager"="c:\program\Free Download Manager\fdm.exe" [2006-08-15 2089007]
"MsnMsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"SpybotSD TeaTimer"="c:\program\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE" [2004-08-25 339968]
"ISUSPM Startup"="c:\program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DMXLauncher"="c:\program\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016]
"VaCtrl"="c:\program\VoiceAge\Common\VaCtrl.exe" [2003-08-28 90112]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-03-16 127037]
"DVDLauncher"="c:\program\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"StartCCC"="c:\program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"iTunesHelper"="c:\program\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"egui"="c:\program\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"SunJavaUpdateSched"="c:\program\Java\jre6\bin\jusched.exe" [2009-10-09 149280]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\STSYSTRA.EXE [2005-03-22 339968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 setuid

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program\\Messenger\\msmsgs.exe"=
"c:\\Program\\SmartFTP\\SmartFTP.exe"=
"c:\\Program\\Mozilla Firefox\\firefox.exe"=
"c:\\Program\\Java\\jdk1.5.0_05\\jre\\bin\\java.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\half-life 2\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\half-life 2 deathmatch\\hl2.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\team fortress 2\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\source sdk base\\hl2.exe"=
"c:\\Program\\Steam\\Steam.exe"=
"c:\\Program\\Steam\\steamapps\\bigbadfrostwolf\\source sdk base\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\lordkelvin553\\source sdk base\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\lordkelvin553\\team fortress 2\\hl2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Documents and Settings\\Peter\\Skrivbord\\Downloaded\\utorrent.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\source sdk base 2007\\hl2.exe"=
"c:\\Program\\Bonjour\\mDNSResponder.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\diprip warm up\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\zombie panic! source\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\synergy\\hl2.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\synergy dedicated server\\srcds.exe"=
"c:\\Program\\Steam\\steamapps\\soffpotatisen\\insurgency\\hl2.exe"=
"c:\\Program\\iTunes\\iTunes.exe"=
"c:\\Program\\Spotify\\spotify.exe"=
"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program\\iPod\\bin\\iPodService.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:VNC
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-08 64160]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-05-14 94360]
R2 ekrn;ESET Service;c:\program\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\Lavasoft\Ad-Aware\AAWService.exe [2009-07-03 1028432]
S3 eati1ttx;eati1ttx;\??\c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys --> c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys [?]
S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys --> c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys [?]
S3 o1394bul;o1394bul;\??\c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys --> c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys [?]
S3 xintelpp;xintelpp;\??\c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys --> c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys [?]
.
Innehållet i mappen 'Schemalagda aktiviteter':

2009-10-08 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 07:15]

2009-10-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program\Apple Software Update\SoftwareUpdate.exe [2007-08-29 10:34]
.
.
------- Extra genomsökning -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: Download all with Free Download Manager - file://c:\program\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program\Free Download Manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program\Free Download Manager\dllink.htm
FF - ProfilePath - c:\documents and settings\Peter\Application Data\Mozilla\Firefox\Profiles\fvazp8ky.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program\Mozilla Firefox\components\dfff.dll
FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\program\Unity\WebPlayer\loader\npUnity3D32.dll

---- FIREFOX POLICY ----
c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
.
- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

BHO-{9a157c2d-a9da-4ef1-a759-d824a4812667} - c:\windows\system32\zaregabi.dll
HKCU-Run-prnet - c:\windows\system32\prnet.tmp
HKCU-Run-ptidle - c:\documents and settings\Peter\Application Data\ptidle\ptidle.exe
HKCU-Run-g[Hn7gQky - c:\documents and settings\Peter\Application Data\Microsoft\Windows\cvkkoaj.exe
HKLM-Run-pdfSaver3 - (no file)
AddRemove-prnet - c:\windows\system32\prnet.tmp
AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\UninstFl.exe
AddRemove-TapSmartKeyLink - c:\program files\TapSmartKeyLink\Uninstall.exe
AddRemove-digifast - c:\documents and settings\Peter\Application Data\digifast\DFUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-11 11:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\c34nb4c5]
"ImagePath"="\??\c:\docume~1\Victor\LOKALA~1\Temp\gXfj7"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
--------------------- DLLer som "laddats" under processer som körs ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\setuid.dll

- - - - - - - > 'explorer.exe'(2648)
c:\windows\system32\WPDShServiceObj.dll
c:\program\SmartFTP\smarthook.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andra processer som körs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program\Bonjour\mDNSResponder.exe
c:\program\Java\jre6\bin\jqs.exe
c:\windows\system32\PnkBstrA.exe
c:\program\Canon\CAL\CALMAIN.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program\iPod\bin\iPodService.exe
c:\program\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program\Windows Live\Contacts\wlcomm.exe
.
**************************************************************************
.
Sluttid: 2009-10-11 11:50 - datorn startades om.
ComboFix-quarantined-files.txt 2009-10-11 09:50

Före genomsökningen: 37*019*582*464 byte ledigt
Efter genomsökningen: 42*063*831*040 byte ledigt

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Peter" /noexecute=optin /fastdetect
signature(c014c601)disk(1)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Victor" /noexecute=optin /fastdetect

302 --- E O F --- 2009-05-16 13:01





DDS (Ver_09-09-29.01) - NTFSx86
Run by Peter at 12:31:57,10 on 2009-10-11
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.379 [GMT 2:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\stsystra.exe
C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program\Java\jre6\bin\jusched.exe
C:\Program\Free Download Manager\fdm.exe
C:\Program\Windows Live\Messenger\msnmsgr.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program\Windows Live\Contacts\wlcomm.exe
C:\WINDOWS\explorer.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Peter\Skrivbord\Downloaded\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot - search & destroy\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
uRun: [SpybotSD TeaTimer] c:\program\spybot - search & destroy\TeaTimer.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [SunJavaUpdateSched] "c:\program\java\jre6\bin\jusched.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot - search & destroy\SDHelper.dll
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 setuid

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program\mozilla firefox\components\dfff.dll
FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
S3 eati1ttx;eati1ttx;\??\c:\docume~1\victor\lokala~1\temp\eati1ttx.sys --> c:\docume~1\victor\lokala~1\temp\eati1ttx.sys [?]
S3 gnwlnknb;gnwlnknb;\??\c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys --> c:\docume~1\victor\lokala~1\temp\gnwlnknb.sys [?]
S3 o1394bul;o1394bul;\??\c:\docume~1\victor\lokala~1\temp\o1394bul.sys --> c:\docume~1\victor\lokala~1\temp\o1394bul.sys [?]
S3 xintelpp;xintelpp;\??\c:\docume~1\victor\lokala~1\temp\xintelpp.sys --> c:\docume~1\victor\lokala~1\temp\xintelpp.sys [?]

=============== Created Last 30 ================

2009-10-11 10:55 <DIR> a-dshr-- C:\cmdcons
2009-10-11 10:52 229,888 a------- c:\windows\PEV.exe
2009-10-11 10:52 161,792 a------- c:\windows\SWREG.exe
2009-10-11 10:52 98,816 a------- c:\windows\sed.exe
2009-10-10 22:11 <DIR> --d----- c:\program\Squeak
2009-10-10 18:28 <DIR> --d----- C:\Downloads
2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
2009-10-08 01:09 <DIR> --d----- c:\program\ESET

==================== Find3M ====================

2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
2007-02-02 11:51 517 a------- c:\program\layout.bin
2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
2007-02-02 11:48 490 a------- c:\program\setup.ini
2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

============= FINISH: 12:32:27,73 ===============

[Blade81]

Hi again,

Upload following file to http://www.virustotal.com and post back a link to the results:
c:\windows\system32\setuid.dll


Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
Run Spybot-S&D in Advanced Mode
If it is not already set to do this, go to the Mode menu
select
Advanced Mode

On the left hand side, click on Tools
Then click on the Resident icon in the list
Uncheck
Resident TeaTimer
and OK any prompts.
Restart your computer


Open notepad and copy/paste the text in the quotebox below into it:



Driver::
eati1ttx
gnwlnknb
o1394bul
xintelpp
c34nb4c5
File::
c:\docume~1\Victor\LOKALA~1\Temp\eati1ttx.sys
c:\docume~1\Victor\LOKALA~1\Temp\gnwlnknb.sys
c:\docume~1\Victor\LOKALA~1\Temp\o1394bul.sys
c:\docume~1\Victor\LOKALA~1\Temp\xintelpp.sys
c:\docume~1\Victor\LOKALA~1\Temp\gXfj7
Folder::
c:\program\uTorrent
c:\documents and settings\Victor\Application Data\uTorrent
DDS::
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000000



Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Uninstall old Adobe Reader versions and get the latest one (9.1 and updates 9.1.2 & 9.1.3) here (http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows) or get Foxit Reader here (http://www.foxitsoftware.com/pdf/reader_2/down_reader.htm). Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here (http://pdfreaders.org/).


Uninstall your current Macromedia Shockwave Player and get the fresh one here (http://get.adobe.com/shockwave/) if needed.

Uninstall vulnerable Flash versions by following instructions here (http://kb2.adobe.com/cps/141/tn_14157.html). Fresh version can be obtained here (http://get.adobe.com/flashplayer/).


Uninstall these vulnerable Javas:
J2SE Development Kit 5.0 Update 5
J2SE Runtime Environment 5.0 Update 5


Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


* Go here (http://www.eset.eu/online-scanner) to run an online scanner from ESET.
Tick the box next to YES, I accept the Terms of Use.
Click Start
Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic, along with a fresh dds.txt log and above mentioned ComboFix resultant log.

[peterolin]

Hi again, thanks for your service and patience.

Now we're getting into the dirty underwear of this family computer. :sick:

Virustotal link: http://www.virustotal.com/sv/analisis/9a398422412c55ab4def0dde4d54736845d79dafa4c43a8309ab7d908dcd4bb7-1255282139

Removed AcrobatReader, Macromedia Shockwave Player, Flash, (old Java versions reluctantly).

ATF cleanup executed.

ComboFix log attached as zip (too big to include).

ESET Online scan log below.


/Peter

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6050
# api_version=3.0.2
# EOSSerial=60e7671558b70345a15643f912cb90df
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-10-11 08:45:05
# local_time=2009-10-11 10:45:05 (+0100, Västeuropa, sommartid)
# country="Sweden"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=769 62 0 32 585149176562500
# compatibility_mode=8199 37 100 100 78312656250
# scanned=202731
# found=5
# cleaned=0
# scan_time=4801
# nod_component=V3 Build:0x30000000
C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\In.mbx.001 JS/TrojanDownloader.gen trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\In.mbx.002 probably a variant of VBS/TrojanDropper.Zerolin trojan 00000000000000000000000000000000 I
C:\Documents and Settings\Peter\Mina dokument\Peter\Application Data\Qualcomm\Eudora\[K9Spam].mbx multiple threats 00000000000000000000000000000000 I
C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP832\A0269411.dll Win32/Olmarik.HJ trojan 00000000000000000000000000000000 I
C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP832\A0269412.dll Win32/Olmarik.HJ trojan 00000000000000000000000000000000 I

[Blade81]

Please post a fresh dds.txt log too and let me know how's the system running :)

[peterolin]

Blade, thanks a lot. I really appreciate your help, and I'm on my way to the "Donate" button.

ESET removed and no longer reports about the Olmarik Trojan.

The system "feels" fine, but I haven't spent much time at the computer, except for running scans ,tools and whatnot the last couple of days. :-)

And here's a fresh dds.txt log.

Again, thanks!

/Peter



DDS (Ver_09-09-29.01) - NTFSx86
Run by Peter at 22:07:11,10 on 2009-10-13
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1022.522 [GMT 2:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\stsystra.exe
C:\Program\Canon\CAL\CALMAIN.exe
C:\PROGRAM\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\Program\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program\Java\jre6\bin\jusched.exe
C:\Program\Free Download Manager\fdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Peter\Skrivbord\dds.scr

============== Pseudo HJT Report ===============

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program\free download manager\iefdmcks.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program\yahoo!\companion\installs\cpn\yt.dll
uRun: [Free Download Manager] c:\program\free download manager\fdm.exe -autorun
uRun: [MsnMsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [ATIPTA] c:\program\ati technologies\ati control panel\ATIPTAXX.EXE
mRun: [ISUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe
mRun: [VaCtrl] c:\program\voiceage\common\VaCtrl.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [StartCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [egui] "c:\program\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [SunJavaUpdateSched] c:\program\java\jre6\bin\jusched.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: Download all with Free Download Manager - file://c:\program\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program\free download manager\dlselected.htm
IE: Download with Free Download Manager - file://c:\program\free download manager\dllink.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBC} - c:\program\java\jre6\bin\npjpi160_15.dll
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program\google\google gears\internet explorer\0.5.4.0\gears.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot~1\SDHelper.dll
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.euro.dell.com/systemprofiler/SysPro.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 setuid

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\fvazp8ky.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - component: c:\program\mozilla firefox\components\dfff.dll
FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
FF - plugin: c:\program\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");
c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");
c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-10-8 64160]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]
R2 ekrn;ESET Service;c:\program\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]

=============== Created Last 30 ================

2009-10-11 19:10 1,089,883 -------- c:\windows\system32\dllcache\ntprint.cat
2009-10-11 18:14 <DIR> --d----- c:\windows\system32\XPSViewer
2009-10-11 18:09 117,760 -------- c:\windows\system32\prntvpt.dll
2009-10-11 18:09 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-10-11 18:09 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-11 18:09 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-10-11 18:09 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-11 18:09 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-10-11 18:09 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll
2009-10-11 18:08 <DIR> --d----- c:\windows\SxsCaPendDel
2009-10-11 11:55 153,088 -------- c:\windows\system32\dllcache\triedit.dll
2009-10-11 11:55 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
2009-10-11 11:49 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-10-11 10:55 <DIR> a-dshr-- C:\cmdcons
2009-10-11 10:52 229,888 a------- c:\windows\PEV.exe
2009-10-11 10:52 161,792 a------- c:\windows\SWREG.exe
2009-10-11 10:52 98,816 a------- c:\windows\sed.exe
2009-10-10 22:11 <DIR> --d----- c:\program\Squeak
2009-10-10 18:28 <DIR> --d----- C:\Downloads
2009-10-10 00:04 411,368 a------- c:\windows\system32\deploytk.dll
2009-10-10 00:04 73,728 a------- c:\windows\system32\javacpl.cpl
2009-10-08 12:30 <DIR> --d----- c:\program\Safer Networking
2009-10-08 10:30 <DIR> --d----- c:\program\Squeak3.8-current-win-full
2009-10-08 10:15 <DIR> --d----- c:\program\Spybot - Search & Destroy
2009-10-08 09:44 15,688 a------- c:\windows\system32\lsdelete.exe
2009-10-08 09:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-10-08 09:11 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}
2009-10-08 01:09 <DIR> --d----- c:\program\ESET

==================== Find3M ====================

2009-10-11 18:21 444,322 a------- c:\windows\system32\perfh01D.dat
2009-10-11 18:21 83,620 a------- c:\windows\system32\perfc01D.dat
2009-08-13 17:24 512,000 -------- c:\windows\system32\dllcache\jscript.dll
2009-08-05 11:01 205,312 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 11:01 205,312 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-29 06:37 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-29 06:37 81,920 a------- c:\windows\system32\fontsub.dll
2009-07-29 06:37 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-07-29 06:37 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-07-19 15:32 3,597,824 -------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 15:32 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-17 21:04 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 21:04 58,880 -------- c:\windows\system32\dllcache\atl.dll
2007-02-02 11:58 57,016 a------- c:\program\data1.hdr
2007-02-02 11:51 1,036,390,187 a------- c:\program\data2.cab
2007-02-02 11:51 517 a------- c:\program\layout.bin
2007-02-02 11:48 67,332,864 a------- c:\program\data1.cab
2007-02-02 11:48 552,214 a------- c:\program\ISSetup.dll
2007-02-02 11:48 490 a------- c:\program\setup.ini
2007-01-23 17:03 317,248 a----r-- c:\program\dxwebsetup.exe
2006-08-07 10:09 164,784 a------- c:\program\_Setup.dll
2003-12-18 11:33 20,102 a------- c:\program\Readme.txt
2003-09-03 07:46 10,960 a------- c:\program\EULA.txt
2008-09-12 08:31 32,768 a--sh--- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008091220080913\index.dat

============= FINISH: 22:07:47,57 ===============

[Blade81]

Unless something shows up, here's a list of recommended final steps :)

THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis



Now lets uninstall ComboFix:

Click START then RUN
Now copy-paste Combofix /u in the runbox and click OK



Please download OTC (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.


hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this (http://www.bleepingcomputer.com/forums/tutorial60.html) webpage out.
If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free (http://www.tallemu.com/free-firewall-protection-software.html) or Comodo Firewall Pro (http://www.personalfirewall.comodo.com/download_firewall.html#fw3.0) (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.



Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.



Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:

[peterolin]

Well, that should settle it all for now.

Thanks for the finalizing instructions.

The computer behaves nicely - and there are no reported virii or malware.

Thanks!

/Peter

[Blade81]

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.