View Full Version : Search redirects lingering
Sublime4
2009-10-23, 06:45
I contracted the Rogue Security Tool malware. I ran everything I had in order to get rid of it and installed MalwareBytes which finally did.
I ran Avast, Spybot, AdAware, Malwarebytes, ComboFix, and Microsoft's Malicious Software Removal Tool.
Search engine link redirects are still happening, however. The redirect is through sterlingcm.com. Not every search returns links that are affected by the redirects.
Spybot found other malware without nailing the Rogue and removed them as did Avast. Today a thorough scan of my C:/ drive netted three more with Avast, nothing with Spybot. I assume they were downloaded from the pages fed to me by the redirect.
I use Firefox almost exclusively and IE only when I must.
I have backed up my registry with ERUNT and here is my HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:11 PM, on 10/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Dexrex\DexrexExtensions.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Dexrex\dexrex_npf.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1FD79A59-37B1-459B-9097-09F9FAB8A523} - (no file)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Dexrex Extensions] C:\Program Files\Dexrex\DexrexExtensions.exe /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Common Files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0 (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Suitcase Startup.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1210660849406
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1210556543541
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: dexrex_npf - Unknown owner - C:\Program Files\Dexrex\dexrex_npf.exe
O23 - Service: Google Update Service (gupdate1ca0766ece6ea62) (gupdate1ca0766ece6ea62) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
--
End of file - 8652 bytes
Thanks for your consideration.
Do NOT run 'FIXES' (ComboFix etc) without being asked (http://forums.spybot.info/showthread.php?t=16806)
Post contents of ComboFix & MBAM report of earlier runs, please.
Sublime4
2009-10-24, 20:06
Earliest Malwarebytes Log. Combofix log was overwritten, including last.
::::::::::::::::::::::::::::::::::::::::::::::::::::
Malwarebytes' Anti-Malware 1.41
Database version: 3009
Windows 5.1.2600 Service Pack 3
10/21/2009 9:00:49 PM
mbam-log-2009-10-21 (21-00-49).txt
Scan type: Full Scan (C:\|)
Objects scanned: 199674
Time elapsed: 33 minute(s), 2 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 14
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 6
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\dnscache.dnscacheobj (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{1fd79a59-37b1-459b-9097-09f9fab8a523} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b97f9125-71a1-48d0-b920-f140ef8de809} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{376892ae-1825-4e5f-9f85-23f9640051cc} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{376892ae-1825-4e5f-9f85-23f9640051cc} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{376892ae-1825-4e5f-9f85-23f9640051cc} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dnscache.dnscacheobj.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\net (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\mplayerplgn.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-507921405-1715567821-725345543-1003\Dc269.exe (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{CF49EC73-6741-4CA9-AB75-3B6A35FCB74C}\RP439\A0132951.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\net.net (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\xxyr.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\FrumpusD\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
:::::::::::::::::::::::::::::::::::::::::
ComboFix 09-10-22.01 - FrumpusD 10/23/2009 16:03.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1495 [GMT -7:00]
Running from: c:\documents and settings\FrumpusD\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091022-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
((((((((((((((((((((((((( Files Created from 2009-09-23 to 2009-10-23 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-10-22_05.36.38 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-18 00:20 279944 ----a-w- c:\program files\AskBarDis\bar\bin\askBar1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-07-18 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar1.dll" [2008-07-18 279944]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-03-28 1851128]
"Dexrex Extensions"="c:\program files\Dexrex\DexrexExtensions.exe" [2009-02-18 313344]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-10-09 520024]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-12-19 76304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2008-07-26 439568]
c:\documents and settings\FrumpusD\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-6-7 809488]
Suitcase Startup.lnk - c:\program files\Extensis\Suitcase 9.2\Suitcase.exe [2008-5-17 3145728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 07:30 72208 ----a-w- c:\program files\Common Files\logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ehTray"=c:\windows\ehome\ehtray.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe"
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe"
"HP Software Update"=c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
"OSSelectorReinstall"=c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
"HPDJ Taskbar Utility"=c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
"MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" /L=1033 /TASK
"47876133"=c:\docume~1\ALLUSE~1\APPLIC~1\47876133\47876133.exe
"net"="c:\windows\system32\net.net"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"f:\\uTorrent\\uTorrent.exe"=
"f:\\BitTorrent\\bittorrent.exe"=
R2 gupdate1ca0766ece6ea62;Google Update Service (gupdate1ca0766ece6ea62);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-18 133104]
R3 SetupNTGLM7X;SetupNTGLM7X;J:\NTGLM7X.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-06-20 64160]
S1 aswSP;avast! Self Protection; [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2009-03-28 110992]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2009-02-20 24336]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-09-15 20560]
S2 dexrex_npf;dexrex_npf;c:\program files\Dexrex\dexrex_npf.exe [2009-02-18 5120]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-10-09 1028432]
S2 LBeepKE;LBeepKE;c:\windows\system32\Drivers\LBeepKE.sys [2008-12-19 10384]
S2 RHDISK;RHDISK;c:\program files\Rohos\RHDISK.SYS [2008-05-02 35136]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
S3 WPRO_40_1123;WinPcap Packet Driver (WPRO_40_1123);c:\windows\system32\drivers\WPRO_40_1123.sys [x]
.
Contents of the 'Scheduled Tasks' folder
2009-06-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]
2009-10-23 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-05-16 02:27]
2009-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-18 05:16]
2009-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-18 05:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: microsoft.com\www.update
FF - ProfilePath - c:\documents and settings\FrumpusD\Application Data\Mozilla\Firefox\Profiles\fq6d5akc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-23 16:15
Windows 5.1.2600 Service Pack 3 NTFS
detected NTDLL code modification:
ZwClose, ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="D8D6A44112A97608965A558C3C87C46A7C29728698EA48ADC8F40D7F9F1E70138D14963750716CAEB2D7E55444F8F3051FAFC4ADD19425FA649E15E1C8D0EA1CF9FC8542B591FC24100F4D863B8CE3E2E86B08D9F31C19EB4FA98FB1EC532F990CEEF37528F00BD7F93B7A7ABA1A314B269234C669E41D3C766C9AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667C038D530D6EB3452A6A0AC4980AC7933BF9EC193AF0F551FE21A6CC2E6A45E37B3A0080412E41BB04D230B8BB56CC8133B069FD3926CF359C4CDA6F6155EE210884E991B9C3F648CE0F933EA85DC5AAB1BAD71A38ABAA526059F5C2977F7D5F1C054A6B82A533237F19F161BDF380ACD3145447857DEDAD55693A927C1F6C5D515A3F622036AD0EFDE99C87C422780A21F029A6BC983B81AC2AD9BE4B827711793B2C7C6020EBCDBD9EED394BE9319B5DD9B6A3CCA93180827F73879BA95D0F21D7EC8B5998FA9846B2AB50BF830627B39509C4DD1C1839CB301731E35940E8EE9049D21CC007C54ECDC5EAD2BEE2148CF5F11A16E82BD34EDD9BAB2AB3A83728146DEE1B3B6D11D0D99B26E2409CAD4970E9965438FB9122D176B3BB5604507424C17737BCFF791CF770D5FC27B0EBED526FA6506E4A15CA054595C7E25199E5D9F4776632B6F4C0B12B8BC7D05C78728F1EF9480C44F9EC6ADCB63456C76EA5A5064AF4169F0C8E88AF760DCA90D957DC326889234D545F4C5FCBDDC5A8C0391F055847B74E5E5E8837F4D7FB2A4301A6F407A2DFB7923D3419CFD2E593DE3B017F5838FF46D6A5EA47828152C8906164E5449D62A326F61CACC5CB2189BEBBADD17D98DDBD9FDEF9AFEB8E365EC295B3C6B75290FAB456D1026337A89F3DE84E37C5E995B31AC1813A4EC4573318DAB1B84A654BF47A09C42B201A762C1E3B84BDD066B6BAE66A5436F54A62E6D0E99CE912698951A66E716F1E8F39CB88653BCE76F5147BF803AE157268731EE660EBFF760CE2EEBDA9C47563229783BB5A7E0B8D8A8EC88334E2C4A3AFEDCB3B9C4D991695E69B8AA5B91C6472675E6C5DAE6E727E720DE9A2C60288C37556F0CCB90ADF547EDB1E218389E375E5C85EC6781F9E016E74D37724246BEEA040AC708558D601A253CF41C00ADB45A359AC81BE7EC33D010126E141A6D95EB131FB9B123E7A6003AF0398432B51733CE5BD516D3306DC6279F8657B25CF9A174FD145475E5E9B0209969C11DEED99ABBB0F85083A8833E001D2E57DCC1F9035A29EACFCCA5707B8AB9A31913821AD1D1397A913CAB8D0E336473036A44441EBE5AB8D62E39A542F3046AA1E7919C312BC58379418947A19A04CC1D357C30945C7B5A732327157C98E2244AF6AE4624A65B2677607E907B"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(820)
c:\windows\system32\guard32.dll
c:\windows\system32\WININET.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
- - - - - - - > 'lsass.exe'(896)
c:\windows\system32\guard32.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(1056)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-10-23 16:20
ComboFix-quarantined-files.txt 2009-10-23 23:20
ComboFix2.txt 2009-10-22 05:41
ComboFix3.txt 2008-09-24 13:39
Pre-Run: 57,298,964,480 bytes free
Post-Run: 57,434,124,288 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 937D8686769CF853A6E24369B2A1535D
Hi,
Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop. Post them back to your topic.
Sublime4
2009-10-25, 19:30
Comodo wasn't active when I ran this. As you can see, Windows Security was running to tell me so. Don't know why it reported as *enabled*.
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DDS (Ver_09-10-24.04) - NTFSx86
Run by FrumpusD at 11:15:41.42 on Sun 10/25/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_06
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1361 [GMT -7:00]
AV: avast! antivirus 4.8.1356 [VPS 091024-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Dexrex\DexrexExtensions.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
svchost.exe
C:\Program Files\Dexrex\dexrex_npf.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\FrumpusD\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Dexrex Extensions] c:\program files\dexrex\DexrexExtensions.exe /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRunOnce: [WUAppSetup] c:\program files\common files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0
StartupFolder: c:\docume~1\frumpusd\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\suitca~1.lnk - c:\program files\extensis\suitcase 9.2\Suitcase.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: microsoft.com\www.update
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1210660849406
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1210556543541
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\frumpusd\applic~1\mozilla\firefox\profiles\fq6d5akc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
=============== Created Last 30 ================
==================== Find3M ====================
============= FINISH: 11:17:13.93 ===============
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-10-25.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/11/2008 6:34:37 PM
System Uptime: 10/25/2009 9:22:56 AM (2 hours ago)
Motherboard: ASUSTeK Computer INC. | | P5K
Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz | LGA775 | 2200/200mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 86 GiB total, 55.469 GiB free.
F: is FIXED (NTFS) - 80 GiB total, 46.705 GiB free.
G: is FIXED (NTFS) - 94 GiB total, 58.093 GiB free.
H: is FIXED (NTFS) - 96 GiB total, 85.163 GiB free.
J: is CDROM ()
K: is CDROM (UDF)
==== Disabled Device Manager Items =============
Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Keyboard
Device ID: ACPI\PNP0303\4&1400782C&0
Manufacturer: Logitech
Name: PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&1400782C&0
Service: i8042prt
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: SM Bus Controller
Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_82771043&REV_02\3&11583659&0&FB
Manufacturer:
Name: SM Bus Controller
PNP Device ID: PCI\VEN_8086&DEV_2930&SUBSYS_82771043&REV_02\3&11583659&0&FB
Service:
==== System Restore Points ===================
RP437: 10/17/2009 4:25:16 PM - System Checkpoint
RP438: 10/18/2009 4:46:20 PM - System Checkpoint
RP439: 10/20/2009 5:34:33 PM - System Checkpoint
RP440: 10/23/2009 12:32:00 PM - System Checkpoint
RP441: 10/23/2009 4:58:52 PM - Removed Futuremark SystemInfo
RP442: 10/23/2009 5:01:54 PM - Removed PC Inspector smart recovery
RP443: 10/24/2009 5:18:25 PM - System Checkpoint
==== Installed Programs ======================
==== Event Viewer Messages From Past Week ========
==== End Of File ===========================
Hi,
Delete your current ComboFix.exe file.
1. Download combofix from one of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Run ComboFix and post back its report.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...
Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6 Update 16 (http://java.sun.com/javase/downloads/index.jsp).
Click the
Download
button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.
* Go here (http://www.eset.eu/online-scanner) to run an online scanner from ESET.
Tick the box next to YES, I accept the Terms of Use.
Click Start
Make sure that the option Remove found threats is UNchecked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic, along with a new dds.txt log & a description of any remaining problems.
Sublime4
2009-10-26, 00:00
Wow.
This copy of ComboFix detected a rootkit and had me reboot.
What the heck is:
"Restored copy from - Kitty ate it :p" ??
ComboFix 09-10-25.01 - FrumpusD 10/25/2009 15:43.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1530 [GMT -7:00]
Running from: c:\documents and settings\FrumpusD\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1356 [VPS 091025-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.
2009-10-25 05:48 . 2009-10-25 05:48 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-23 04:14 . 2009-10-23 04:14 -------- d-----w- c:\program files\ERUNT
2009-10-22 23:18 . 2009-10-22 23:19 -------- d-----w- c:\program files\FLV Player
2009-10-22 05:46 . 2009-10-22 05:46 -------- d-----w- c:\program files\Trend Micro
2009-10-22 03:24 . 2009-10-22 03:24 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\Malwarebytes
2009-10-22 03:23 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-22 03:23 . 2009-10-22 04:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-22 03:23 . 2009-10-22 03:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-22 03:23 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-21 23:31 . 2009-10-22 05:22 1226 ----a-w- c:\documents and settings\FrumpusD\Local Settings\Application Data\dxportassociation.dat
2009-10-09 04:59 . 2009-10-09 04:59 -------- d-----w- c:\documents and settings\FrumpusD\Local Settings\Application Data\RadarSync
2009-10-09 04:58 . 2009-10-24 00:04 -------- d-----w- c:\program files\RadarSyncPcupz
2009-10-09 01:37 . 2009-10-09 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 22:41 . 2009-10-25 22:41 100880 ----a-w- c:\windows\system32\WPRO_40_1123woem.tmp
2009-10-25 22:40 . 2008-08-31 00:37 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-25 22:40 . 2008-08-31 00:37 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-10-25 22:16 . 2009-03-09 06:41 738 ----a-w- c:\documents and settings\FrumpusD\Local Settings\Application Data\Dexrex.dat
2009-10-25 18:10 . 2008-05-13 02:49 -------- d-----w- c:\program files\Mozilla Thunderbird
2009-10-24 23:51 . 2009-08-11 05:12 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\vlc
2009-10-24 21:19 . 2009-06-13 15:39 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\dvdcss
2009-10-24 00:09 . 2009-07-18 21:56 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-10-24 00:08 . 2008-05-12 02:32 -------- d-----w- c:\program files\Yahoo!
2009-10-24 00:05 . 2008-12-26 01:24 -------- d-----w- c:\program files\Vuze
2009-10-24 00:04 . 2008-10-18 21:03 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\SanDisk
2009-10-24 00:03 . 2008-06-09 23:46 -------- d-----w- c:\program files\Picture Retriever
2009-10-24 00:00 . 2008-10-19 00:15 -------- d-----w- c:\program files\MediaMonkey
2009-10-23 23:59 . 2008-05-12 01:38 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-09 05:26 . 2008-05-16 09:54 -------- d-----w- c:\program files\Glary Utilities
2009-09-25 13:03 . 2009-07-12 02:12 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\uTorrent
2009-09-24 22:48 . 2008-05-22 01:30 -------- d-----w- c:\documents and settings\FrumpusD\Application Data\FileZilla
2009-09-23 12:55 . 2009-06-20 20:36 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-20 15:10 . 2009-09-20 15:10 20192 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-09-20 06:03 . 2009-09-20 06:03 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-09-20 01:55 . 2009-09-20 01:55 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-15 10:59 . 2008-05-12 23:00 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:56 . 2008-05-12 23:00 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-09-15 10:56 . 2008-05-12 23:00 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-09-15 10:55 . 2008-05-12 23:00 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2008-05-12 23:00 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:54 . 2008-05-12 23:00 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2008-05-12 23:00 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2008-05-12 23:00 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-09-15 10:53 . 2008-05-12 23:00 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-12 15:42 . 2008-05-12 23:48 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-11 14:18 . 2006-03-15 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2006-03-15 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 09:17 . 2009-06-20 21:40 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-08-29 07:36 . 2006-03-15 12:00 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36 . 2006-03-15 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36 . 2006-03-15 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00 . 2006-03-15 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-16 22:14 . 2008-05-12 01:36 20192 ----a-w- c:\documents and settings\FrumpusD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-12 19:42 . 2009-08-13 00:50 21192 ----a-w- c:\windows\system32\novamns6.dll
2009-08-12 19:42 . 2009-08-13 00:50 19144 ----a-w- c:\windows\system32\novamis6.dll
2009-08-07 02:24 . 2008-05-12 01:30 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 02:24 . 2008-05-12 01:30 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 02:24 . 2008-05-12 01:42 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-07 02:24 . 2008-05-12 01:30 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-07 02:24 . 2008-05-12 01:30 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 02:24 . 2006-03-15 12:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 02:23 . 2008-05-12 01:30 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 02:23 . 2009-09-20 04:13 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23 . 2009-09-20 04:13 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 02:23 . 2008-05-12 01:30 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2006-03-15 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 02:52 . 2009-08-05 02:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 15:13 . 2006-03-15 12:00 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2004-08-03 22:59 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-10-22_05.36.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-25 22:40 . 2009-10-25 22:40 16384 c:\windows\Temp\Perflib_Perfdata_778.dat
+ 2009-10-09 01:35 . 2009-10-22 23:15 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2009-10-09 01:35 . 2009-10-11 18:48 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-10-25 05:50 . 2009-09-23 12:55 64288 c:\windows\system32\DRVSTORE\lbd_B425E86B28F27CC7F4A0CAF275F9F2789F3C6909\Lbd.sys
+ 2006-03-15 12:00 . 2008-04-13 18:40 96512 c:\windows\system32\dllcache\atapi.sys
+ 2008-05-12 01:35 . 2009-10-25 21:44 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-05-12 01:35 . 2009-10-22 04:51 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-12 01:35 . 2009-10-25 21:44 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-05-12 01:35 . 2009-10-22 04:51 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-05-12 01:35 . 2009-10-22 04:51 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-12 01:35 . 2009-10-25 21:44 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-10-25 16:24 . 2009-10-25 16:24 192512 c:\windows\erdnt\AutoBackup\10-25-2009\Users\00000002\UsrClass.dat
+ 2009-10-25 16:24 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\10-25-2009\ERDNT.EXE
+ 2009-10-24 16:15 . 2009-10-24 16:15 192512 c:\windows\erdnt\AutoBackup\10-24-2009\Users\00000002\UsrClass.dat
+ 2009-10-24 16:15 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\10-24-2009\ERDNT.EXE
+ 2009-10-23 17:03 . 2009-10-23 17:03 192512 c:\windows\erdnt\AutoBackup\10-23-2009\Users\00000002\UsrClass.dat
+ 2009-10-23 17:03 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\10-23-2009\ERDNT.EXE
+ 2009-10-23 04:15 . 2005-10-20 19:02 163328 c:\windows\erdnt\10-22-2009\ERDNT.EXE
+ 2009-10-25 05:48 . 2009-10-25 05:48 1861120 c:\windows\Installer\2eba35b.msi
+ 2009-10-25 16:24 . 2009-10-25 16:24 9400320 c:\windows\erdnt\AutoBackup\10-25-2009\Users\00000001\NTUSER.DAT
+ 2009-10-24 16:15 . 2009-10-24 16:15 9400320 c:\windows\erdnt\AutoBackup\10-24-2009\Users\00000001\NTUSER.DAT
+ 2009-10-23 17:03 . 2009-10-23 17:03 9383936 c:\windows\erdnt\AutoBackup\10-23-2009\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2009-03-28 1851128]
"Dexrex Extensions"="c:\program files\Dexrex\DexrexExtensions.exe" [2009-02-18 313344]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-10-25 781656]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-10-07 1630208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-12-19 76304]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WUAppSetup"="c:\program files\Common Files\logishrd\WUApp32.exe" [2008-07-26 439568]
c:\documents and settings\FrumpusD\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-6-7 809488]
Suitcase Startup.lnk - c:\program files\Extensis\Suitcase 9.2\Suitcase.exe [2008-5-17 3145728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-02-19 07:30 72208 ----a-w- c:\program files\Common Files\logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS\0lsdelete
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ehTray"=c:\windows\ehome\ehtray.exe
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe"
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe"
"HP Software Update"=c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
"OSSelectorReinstall"=c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
"HPDJ Taskbar Utility"=c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe
"MPlayerForWindows_UpdateReminder"="c:\program files\MPlayer for Windows\AutoUpdate.exe" /L=1033 /TASK
"47876133"=c:\docume~1\ALLUSE~1\APPLIC~1\47876133\47876133.exe
"net"="c:\windows\system32\net.net"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"f:\\uTorrent\\uTorrent.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/20/2009 1:36 PM 64288]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [5/12/2008 4:00 PM 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [12/26/2008 11:21 PM 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [12/26/2008 11:21 PM 24336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [5/12/2008 4:00 PM 20560]
R2 dexrex_npf;dexrex_npf;c:\program files\Dexrex\dexrex_npf.exe [2/18/2009 12:26 PM 5120]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [6/7/2009 5:20 PM 10384]
R2 RHDISK;RHDISK;c:\program files\Rohos\rhdisk.sys [10/12/2008 4:26 PM 35136]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [5/11/2008 6:38 PM 38656]
R3 WPRO_40_1123;WinPcap Packet Driver (WPRO_40_1123);c:\windows\system32\drivers\WPRO_40_1123.sys --> c:\windows\system32\drivers\WPRO_40_1123.sys [?]
S2 gupdate1ca0766ece6ea62;Google Update Service (gupdate1ca0766ece6ea62);c:\program files\Google\Update\GoogleUpdate.exe [7/17/2009 10:16 PM 133104]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 4:17 AM 1170768]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\j:\ntglm7x.sys --> j:\NTGLM7X.sys [?]
--- Other Services/Drivers In Memory ---
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder
2009-10-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 05:49]
2009-06-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]
2009-10-25 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-05-16 02:27]
2009-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-18 05:16]
2009-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-18 05:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: microsoft.com\www.update
FF - ProfilePath - c:\documents and settings\FrumpusD\Application Data\Mozilla\Firefox\Profiles\fq6d5akc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\FrumpusD\Application Data\Mozilla\Firefox\Profiles\fq6d5akc.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-25 15:47
Windows 5.1.2600 Service Pack 3 NTFS
detected NTDLL code modification:
ZwClose, ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="D8D6A44112A97608965A558C3C87C46A7C29728698EA48ADC8F40D7F9F1E70138D14963750716CAEB2D7E55444F8F3051FAFC4ADD19425FA649E15E1C8D0EA1CF9FC8542B591FC24100F4D863B8CE3E2E86B08D9F31C19EB4FA98FB1EC532F990CEEF37528F00BD7F93B7A7ABA1A314B269234C669E41D3C766C9AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667C038D530D6EB3452A6A0AC4980AC7933BF9EC193AF0F551FE21A6CC2E6A45E37B3A0080412E41BB04D230B8BB56CC8133B069FD3926CF359C4CDA6F6155EE210884E991B9C3F648CE0F933EA85DC5AAB1BAD71A38ABAA526059F5C2977F7D5F1C054A6B82A533237F19F161BDF380ACD3145447857DEDAD55693A927C1F6C5D515A3F622036AD0EFDE99C87C422780A21F029A6BC983B81AC2AD9BE4B827711793B2C7C6020EBCDBD9EED394BE9319B5DD9B6A3CCA93180827F73879BA95D0F21D7EC8B5998FA9846B2AB50BF830627B39509C4DD1C1839CB301731E35940E8EE9049D21CC007C54ECDC5EAD2BEE2148CF5F11A16E82BD34EDD9BAB2AB3A83728146DEE1B3B6D11D0D99B26E2409CAD4970E9965438FB9122D176B3BB5604507424C17737BCFF791CF770D5FC27B0EBED526FA6506E4A15CA054595C7E25199E5D9F4776632B6F4C0B12B8BC7D05C78728F1EF9480C44F9EC6ADCB63456C76EA5A5064AF4169F0C8E88AF760DCA90D957DC326889234D545F4C5FCBDDC5A8C0391F055847B74E5E5E8837F4D7FB2A4301A6F407A2DFB7923D3419CFD2E593DE3B017F5838FF46D6A5EA47828152C8906164E5449D62A326F61CACC5CB2189BEBBADD17D98DDBD9FDEF9AFEB8E365EC295B3C6B75290FAB456D1026337A89F3DE84E37C5E995B31AC1813A4EC4573318DAB1B84A654BF47A09C42B201A762C1E3B84BDD066B6BAE66A5436F54A62E6D0E99CE912698951A66E716F1E8F39CB88653BCE76F5147BF803AE157268731EE660EBFF760CE2EEBDA9C47563229783BB5A7E0B8D8A8EC88334E2C4A3AFEDCB3B9C4D991695E69B8AA5B91C6472675E6C5DAE6E727E720DE9A2C60288C37556F0CCB90ADF547EDB1E218389E375E5C85EC6781F9E016E74D37724246BEEA040AC708558D601A253CF41C00ADB45A359AC81BE7EC33D010126E141A6D95EB131FB9B123E7A6003AF0398432B51733CE5BD516D3306DC6279F8657B25CF9A174FD145475E5E9B0209969C11DEED99ABBB0F85083A8833E001D2E57DCC1F9035A29EACFCCA5707B8AB9A31913821AD1D1397A913CAB8D0E336473036A44441EBE5AB8D62E39A542F3046AA1E7919C312BC58379418947A19A04CC1D357C30945C7B5A732327157C98E2244AF6AE4624A65B2677607E907B"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(812)
c:\windows\system32\guard32.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
- - - - - - - > 'lsass.exe'(872)
c:\windows\system32\guard32.dll
.
Completion time: 2009-10-25 15:49
ComboFix-quarantined-files.txt 2009-10-25 22:49
ComboFix2.txt 2009-10-23 23:20
ComboFix3.txt 2009-10-22 05:41
ComboFix4.txt 2008-09-24 13:39
Pre-Run: 59,515,097,088 bytes free
Post-Run: 59,474,800,640 bytes free
- - End Of File - - 61A63F2095D572F7EEA2E4152243403A
Sublime4
2009-10-26, 01:37
ESET Results:
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\Local Folders\Junk multiple threats
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\mail.panzo-1.org\Inbox multiple threats
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\mail.twomuse.com\Inbox multiple threats
C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Win32/Olmarik.OF virus
F:\ShortcutCreator4U3\runsc.exe probably a variant of Win32/SdBot trojan
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Google redirects seem to have ceased.
Sublime4
2009-10-26, 01:39
New DDS.txt:
DDS (Ver_09-10-24.04) - NTFSx86
Run by FrumpusD at 17:37:50.64 on Sun 10/25/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1234 [GMT -7:00]
AV: avast! antivirus 4.8.1356 [VPS 091025-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *disabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Dexrex\DexrexExtensions.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Extensis\Suitcase 9.2\Suitcase.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Dexrex\dexrex_npf.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\FrumpusD\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 8\SnagItBHO.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 8\SnagItIEAddin.dll
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [nwiz] nwiz.exe /install
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Dexrex Extensions] c:\program files\dexrex\DexrexExtensions.exe /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
dRunOnce: [WUAppSetup] c:\program files\common files\logishrd\WUApp32.exe -v 0x046d -p 0x09a1 -f video -m logitech -d 11.70.1196.0
StartupFolder: c:\docume~1\frumpusd\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\suitca~1.lnk - c:\program files\extensis\suitcase 9.2\Suitcase.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: microsoft.com\www.update
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1210660849406
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1210556543541
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\frumpusd\applic~1\mozilla\firefox\profiles\fq6d5akc.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\frumpusd\application data\mozilla\firefox\profiles\fq6d5akc.default\extensions\{0b457caa-602d-484a-8fe7-c1d894a011ba}\platform\winnt_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-20 64288]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-5-12 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-26 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-26 24336]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-5-12 20560]
R2 dexrex_npf;dexrex_npf;c:\program files\dexrex\dexrex_npf.exe [2009-2-18 5120]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-6-7 10384]
R2 RHDISK;RHDISK;c:\program files\rohos\rhdisk.sys [2008-10-12 35136]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2008-5-11 38656]
R3 WPRO_40_1123;WinPcap Packet Driver (WPRO_40_1123);c:\windows\system32\drivers\wpro_40_1123.sys --> c:\windows\system32\drivers\WPRO_40_1123.sys [?]
S2 gupdate1ca0766ece6ea62;Google Update Service (gupdate1ca0766ece6ea62);c:\program files\google\update\GoogleUpdate.exe [2009-7-17 133104]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1170768]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\j:\ntglm7x.sys --> j:\NTGLM7X.sys [?]
=============== Created Last 30 ================
2009-10-25 23:13:40 0 d-----w- c:\program files\ESET
2009-10-25 23:08:53 73728 ----a-w- c:\windows\system32\javacpl.cpl
2009-10-25 23:08:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-25 23:06:17 100880 ----a-w- c:\windows\system32\WPRO_40_1123woem.tmp
2009-10-25 22:37:26 77312 ----a-w- c:\windows\MBR.exe
2009-10-25 22:36:49 0 d-----w- C:\ComboFix
2009-10-25 05:48:25 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
2009-10-23 23:01:44 0 d-sha-r- C:\cmdcons
2009-10-23 23:00:11 236544 ----a-w- c:\windows\PEV.exe
2009-10-22 05:46:40 0 d-----w- c:\program files\Trend Micro
2009-10-22 03:24:05 0 d-----w- c:\docume~1\frumpusd\applic~1\Malwarebytes
2009-10-22 03:23:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-22 03:23:40 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-22 03:23:40 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-22 03:23:40 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-21 23:52:54 202 ----a-w- c:\windows\wininit.ini
2009-10-09 04:58:34 0 d-----w- c:\program files\RadarSyncPcupz
2009-10-09 01:37:24 0 d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
==================== Find3M ====================
2009-10-25 23:05:12 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-25 23:05:10 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-09-23 12:55:23 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-09-20 15:10:41 20192 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-03 09:17:47 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-08-29 07:36:27 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:36:24 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:36:24 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-12 19:42:14 21192 ----a-w- c:\windows\system32\novamns6.dll
2009-08-12 19:42:12 19144 ----a-w- c:\windows\system32\novamis6.dll
2009-08-07 02:23:46 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 02:23:46 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 02:52:22 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 15:13:08 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20:09 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2006-06-23 22:48:54 32768 ----a-r- c:\windows\inf\UpdateUSB.exe
============= FINISH: 17:38:12.84 ===============
Hi,
What the heck is:
"Restored copy from - Kitty ate it :p" ??
Working copy of infected file was restored successfully :)
Delete suspicious email messages in these folders (open in Thunderbird):
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\Local Folders\Junk (probably can empty this thru Thunderbird)
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\mail.panzo-1.org\Inbox
C:\Documents and Settings\FrumpusD\Application Data\Thunderbird\Profiles\j7zexanq.default\Mail\mail.twomuse.com\Inbox
Open notepad and copy/paste the text in the quotebox below into it:
File::
F:\ShortcutCreator4U3\runsc.exe
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"47876133"=-
"net"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"f:\\uTorrent\\uTorrent.exe"=-
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log. Any issues left?
Due to inactivity, this thread will now be closed.
Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.
If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.