View Full Version : Survived a Virus attack
Hey,
I just survived a virus attack and a bunch of Malware was put on my computer. Most of it is gone but the following still occurs:
My firefox web browser often goes to the wrong webpage when I click on a link.
Sometimes it even opens a new window for varies weird webpages.
I also get audio advertising without a program showing to turn it off. It turn it off I have to end processes from TaskManager which is the IEXPLORER.EXE.
Any help would be great!
Hi Nanich
Click here (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.
Thank yoU!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:38:50 PM, on 11/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.227 awareremover2009.microsoft.com
O1 - Hosts: 91.212.127.227 awareremover2009.com
O1 - Hosts: 91.212.127.227 www.awareremover2009.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Classroom Teacher\NotebookPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: SMART Sync - {8E1233B3-485A-4E51-B77E-9E075A68C588} - C:\Program Files\SMART Technologies\Classroom Teacher\Sync Teacher\SyncIEToolbar.dll
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O4 - HKLM\..\Run: [8877] C:\Documents and Settings\Don\33C.tmp.exe
O4 - HKLM\..\Run: [Bsokukububovid] rundll32.exe "C:\WINDOWS\ekemutokaratiqe.dll",Startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Remote] "C:\Program Files\PowerColor\Real Angel 330\Remote.exe"
O4 - HKLM\..\Run: [Schedule] "C:\Program Files\PowerColor\Real Angel 330\Schedule.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: AVG Free Tray Icon.lnk = C:\Program Files\AVG\AVG8\avgtray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Update Service (gupdate1c9c62bfc4ddf28) (gupdate1c9c62bfc4ddf28) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Response Hardware - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SMART Board Service - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
O23 - Service: SMART Mirror Driver Monitor Service - SMART Technologies Inc. - C:\Program Files\Common Files\SMART Technologies\Mirror Driver\MonitorService.exe
O23 - Service: SMART SNMP Agent Service - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe (file missing)
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\WebServer.exe
--
End of file - 7885 bytes
We will continue with ComboFix. Please visit this webpage for download links, and instructions for running the tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New HijackThis log.
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
Here you go! Thanks again!
ComboFix 09-11-27.07 - Don 11/28/2009 8:47.1.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2632 [GMT -8:00]
Running from: c:\documents and settings\Don\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\1.bat
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\basis_br.xml
c:\program files\Fast Browser Search\IE\basis_de.xml
c:\program files\Fast Browser Search\IE\basis_en.xml
c:\program files\Fast Browser Search\IE\basis_es.xml
c:\program files\Fast Browser Search\IE\basis_fr.xml
c:\program files\Fast Browser Search\IE\basis_it.xml
c:\program files\Fast Browser Search\IE\basis_nr.xml
c:\program files\Fast Browser Search\IE\basis_pt.xml
c:\program files\Fast Browser Search\IE\basis_ru.xml
c:\program files\Fast Browser Search\IE\basis_tr.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\FBSPlugin.dll
c:\program files\Fast Browser Search\IE\fbsProtection.xml
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\fbstoolbar.jar
c:\program files\Fast Browser Search\IE\fbstoolbar.manifest
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\search_br.bmp
c:\program files\Fast Browser Search\IE\search_de.bmp
c:\program files\Fast Browser Search\IE\search_es.bmp
c:\program files\Fast Browser Search\IE\search_fr.bmp
c:\program files\Fast Browser Search\IE\search_it.bmp
c:\program files\Fast Browser Search\IE\search_pt.bmp
c:\program files\Fast Browser Search\IE\search_ru.bmp
c:\program files\Fast Browser Search\IE\SearchAssistant.dll
c:\program files\Fast Browser Search\IE\SearchGuardPlus.exe
c:\program files\Fast Browser Search\IE\SearchGuardPlus.ico
c:\program files\Fast Browser Search\IE\SGPU.ico
c:\program files\Fast Browser Search\IE\sgpUpdater.exe
c:\program files\Fast Browser Search\IE\sgpUpdater.xml
c:\program files\Fast Browser Search\IE\SGPUpdaterS.exe
c:\program files\Fast Browser Search\IE\tbhelper.dll
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\ToolBarBHO.dll
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\uninstalSGP.exe
c:\program files\Fast Browser Search\IE\uninstalSGPU.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt
c:\windows\ekemutokaratiqe.dll
c:\windows\run.log
c:\windows\system32\2306024.exe
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
c:\windows\system32\proquota.exe was missing
Restored copy from - c:\system volume information\_restore{63A83696-D3B1-49B2-B970-71CBE9E79BD0}\RP247\A0110503.exe
.
((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-28 )))))))))))))))))))))))))))))))
.
2009-11-28 16:53 . 2008-04-14 12:42 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-11-28 16:53 . 2008-04-14 12:42 50176 ----a-w- c:\windows\system32\proquota.exe
2009-11-27 22:38 . 2009-11-27 22:38 -------- d-----w- c:\program files\Trend Micro
2009-11-26 01:15 . 2009-11-06 16:51 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-26 01:15 . 2009-11-02 17:57 3513624 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-11-26 01:15 . 2009-11-02 17:57 2028312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-24 16:00 . 2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
2009-11-24 16:00 . 2009-11-24 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\SP
2009-11-23 15:38 . 2009-11-23 15:38 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
2009-11-20 20:29 . 2009-11-20 20:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-20 20:29 . 2009-11-20 20:33 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-20 20:27 . 2009-11-20 20:27 117760 ----a-w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-11-20 01:37 . 2004-04-15 05:11 242840 ----a-w- c:\windows\system32\GDI TeletextServer.dll
2009-11-20 01:37 . 2004-01-03 01:29 339968 ----a-w- c:\windows\system32\mpeg2enc.dll
2009-11-20 01:37 . 2003-06-28 22:34 69707 ----a-w- c:\windows\system32\DISP_OPT1.dll
2009-11-20 01:37 . 1998-06-18 02:44 929844 ----a-w- c:\windows\system32\MFC42D.DLL
2009-11-20 01:37 . 1998-06-17 08:00 385100 ----a-w- c:\windows\system32\MSVCRTD.DLL
2009-11-18 22:41 . 2009-11-18 22:41 -------- d-----w- c:\program files\JRE
2009-11-18 22:40 . 2009-11-18 22:40 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-16 18:41 . 2009-11-16 18:41 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
2009-11-13 22:52 . 2009-11-13 22:52 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2009-11-13 18:07 . 2009-11-13 18:06 147456 --sh--r- C:\pxev.exe
2009-11-13 15:58 . 2009-11-13 15:58 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
2009-11-11 01:36 . 2009-11-11 02:12 -------- d-----w- c:\program files\DScaler
2009-11-09 19:37 . 2009-11-10 05:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-09 18:53 . 2009-11-09 20:16 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\xxvqof
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\Don\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-08 01:06 . 2009-11-28 16:27 120 ----a-w- c:\windows\Rnayak.dat
2009-11-08 01:06 . 2009-11-28 16:27 0 ----a-w- c:\windows\Xhitah.bin
2009-11-08 01:06 . 2009-11-08 01:06 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
2009-11-07 22:58 . 2009-11-07 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\df9430b
2009-11-05 20:57 . 2009-11-05 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2009-11-05 20:55 . 2009-11-05 20:55 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-11-05 20:40 . 2009-11-05 20:49 -------- d-----w- c:\program files\Dragon Age
2009-11-05 20:40 . 2009-11-05 20:55 -------- d-----w- c:\program files\Common Files\BioWare
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-28 16:27 . 2009-04-26 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-26 05:45 . 2009-01-23 05:33 1 ----a-w- c:\documents and settings\Don\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-20 20:27 . 2009-07-26 23:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-20 01:37 . 2009-01-21 19:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-19 00:26 . 2009-02-07 07:13 -------- d-----w- c:\documents and settings\Don\Application Data\BSW
2009-11-18 23:58 . 2009-01-25 08:37 39376 ----a-w- c:\documents and settings\Don\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-18 22:41 . 2009-01-21 20:11 -------- d-----w- c:\program files\OpenOffice.org 3
2009-11-18 22:40 . 2009-01-21 20:10 -------- d-----w- c:\program files\Java
2009-11-11 02:00 . 2009-08-18 18:46 -------- d-----w- c:\program files\Tile3D_40
2009-11-11 01:55 . 2009-04-26 04:53 -------- d-----w- c:\program files\Google
2009-11-11 01:54 . 2009-02-07 07:33 -------- d-----w- c:\program files\Codemasters
2009-11-11 01:52 . 2009-04-05 20:37 -------- d-----w- c:\program files\Steam
2009-11-08 06:32 . 2009-05-02 19:13 -------- d-----w- c:\program files\1701 A.D
2009-11-08 02:49 . 2009-01-21 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-08 02:39 . 2009-07-24 17:53 -------- d-----w- c:\program files\QuickTime
2009-11-07 22:59 . 2009-11-07 22:59 0 ----a-w- c:\documents and settings\Don\33D.tmp
2009-11-07 22:59 . 2009-11-07 22:59 100 ----a-w- c:\documents and settings\Don\33A.tmp
2009-11-07 22:58 . 2009-11-07 22:58 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-10-07 16:35 . 2009-01-22 02:15 189104 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-07 16:30 . 2009-01-22 02:15 139584 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-05 16:17 . 2009-10-05 16:17 -------- d-----w- c:\program files\Microsoft
2009-09-29 19:59 . 2009-09-29 19:59 -------- d-----w- c:\documents and settings\Don\Application Data\SMART Technologies
2009-09-29 04:15 . 2009-09-29 04:15 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JINECELP.dll
2009-09-29 04:15 . 2009-09-29 04:15 73216 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWAudio.dll
2009-09-29 04:15 . 2009-09-29 04:15 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWMixer.dll
2009-09-29 04:15 . 2009-09-29 04:15 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\ICE_JNIRegistry.dll
2009-09-29 04:15 . 2009-09-29 04:15 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\WinPlatform.dll
2009-09-29 03:58 . 2009-09-29 03:58 98816 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\53\6061d535-284d4338-n\WinVideo.dll
2009-09-29 03:58 . 2009-09-29 03:58 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JINECELP.dll
2009-09-29 03:58 . 2009-09-29 03:58 68608 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWAudio.dll
2009-09-29 03:58 . 2009-09-29 03:58 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWMixer.dll
2009-09-29 03:58 . 2009-09-29 03:58 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\ICE_JNIRegistry.dll
2009-09-29 03:58 . 2009-09-29 03:58 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\WinPlatform.dll
2009-09-11 14:18 . 2008-04-14 12:42 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2008-04-14 12:42 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-01 20:37 . 2009-09-01 20:37 1998848 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\181154-18125.dll
2009-09-01 20:36 . 2009-09-01 20:36 242976 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\QWPATCH.EXE
2009-09-01 20:36 . 2009-09-01 20:36 223584 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\patchw32.dll
2009-09-01 20:36 . 2009-09-01 20:36 997 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\Quicken\Inet\Common\patch\Update\rebase.cmd
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\sp]
@="{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
[HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}]
2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-11 2001648]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-18 149280]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"Remote"="c:\program files\PowerColor\Real Angel 330\Remote.exe" [2006-03-06 253952]
"Schedule"="c:\program files\PowerColor\Real Angel 330\Schedule.exe" [2006-05-19 94208]
c:\documents and settings\Don\Start Menu\Programs\Startup\
AVG Free Tray Icon.lnk - c:\program files\AVG\AVG8\avgtray.exe [2009-1-21 2029336]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-15 17:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\ResponseSoftwareService.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\UCGui.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\UCService.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\WebServer.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\Sync Teacher\\SMARTSyncTeacher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\empire total war\\Empire.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"13398:TCP"= 13398:TCP:spport
"29653:TCP"= 29653:TCP:spport
"14605:TCP"= 14605:TCP:spport
"6659:TCP"= 6659:TCP:spport
"15609:TCP"= 15609:TCP:spport
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/21/2009 11:33 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/21/2009 11:33 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/21/2009 11:33 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/21/2009 11:33 AM 297752]
R2 Response Hardware;Response Hardware;c:\program files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe [8/11/2009 12:10 PM 30504]
R2 SPService;SPService;c:\windows\system32\svchost.exe -k netsvc [4/14/2008 4:42 AM 14336]
R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1e51x86.sys [1/21/2009 11:07 AM 36864]
R3 smrtdrv;SMART Technologies Inc. Mirror Driver;c:\windows\system32\drivers\smrtdrv.sys [4/22/2004 10:38 AM 2432]
S2 gupdate1c9c62bfc4ddf28;Google Update Service (gupdate1c9c62bfc4ddf28);c:\program files\Google\Update\GoogleUpdate.exe [4/25/2009 9:00 PM 133104]
S2 SMART Mirror Driver Monitor Service;SMART Mirror Driver Monitor Service;c:\program files\Common Files\SMART Technologies\Mirror Driver\MonitorService.exe [1/16/2009 10:03 AM 135680]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [11/5/2009 12:48 PM 25832]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [5/30/2007 4:34 PM 39424]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
S3 SMART SNMP Agent Service;SMART SNMP Agent Service;c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe --> c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe [?]
S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies\Classroom Teacher\WebServer.exe [7/23/2009 4:51 PM 1245184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
netsvc REG_MULTI_SZ SPService
.
Contents of the 'Scheduled Tasks' folder
2009-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
2009-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com/
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\m6tf3mhu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={1651BD89-383E-6D1B-C9C4-68D795ABED09}&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {A42A97C1-1509-481F-97FF-37F073F7C132} - c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
FF - HiddenExtension: XULRunner: {22400F1B-A246-4997-83B4-BD1963E86E19} - c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
FF - HiddenExtension: XULRunner: {799FCEF6-870A-454D-A1AD-7CC39161BE85} - c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
FF - HiddenExtension: XULRunner: {9830D2C5-7C79-41C5-969C-3D9F7E97BD0D} - c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
.
------- File Associations -------
.
txtfile=%windir%\NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-8877 - c:\documents and settings\Don\33C.tmp.exe
HKLM-Run-Bsokukububovid - c:\windows\ekemutokaratiqe.dll
AddRemove-Impulse - c:\documents and settings\All Users\Application Data\{AD1633B8-8F63-40E6-8A96-9AF47AC850E1}\Impulse_setup.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-InstallShield_{AFAE2B15-89A0-4215-A030-F7B5B478886B} - c:\program files\InstallShield Installation Information\{AFAE2B15-89A0-4215-A030-F7B5B478886B}\setup.exe
AddRemove-InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F} - c:\program files\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe
AddRemove-InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217} - c:\program files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe
AddRemove-NVIDIA Drivers - c:\windows\system32\nvuninst.exe UninstallGUI
AddRemove-Sins of a Solar Empire - c:\documents and settings\All Users\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}\setup.exe REMOVE=TRUE MODIFY=FALSE
AddRemove-Steam App 10500 - c:\program files\Steam\steam.exe steam://uninstall/10500
AddRemove-Windows Media Format Runtime - c:\program files\Windows Media Player\wmsetsdk.exe
AddRemove-{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6} - c:\program files\InstallShield Installation Information\{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}\setup.exe
AddRemove-{3108C217-BE83-42E4-AE9E-A56A2A92E549} - c:\program files\InstallShield Installation Information\{3108C217-BE83-42E4-AE9E-A56A2A92E549}\Setup.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-28 08:55
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:6f,b3,c7,b1,b2,d8,ed,7a,c8,bb,09,b2,89,68,d6,95,ed,ac,2c,33,01,53,8c,
50,78,5e,47,a3,86,ea,a1,96,27,06,5e,22,0e,2a,30,2c,b0,d7,c1,de,fd,93,db,f7,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\License information*]
"datasecu"=hex:b7,e1,ed,21,d2,38,df,6c,e3,19,80,da,f2,c2,a5,27,aa,53,be,5d,62,
b7,84,2e,ce,86,fc,62,b3,1e,24,c0,df,e9,2d,82,f5,c4,4e,21,ec,a6,9e,50,a0,85,\
"rkeysecu"=hex:6c,33,7b,3b,e2,25,e6,76,ff,a4,29,b1,81,c5,11,57
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2009-11-28 08:56
ComboFix-quarantined-files.txt 2009-11-28 16:56
Pre-Run: 377,553,129,472 bytes free
Post-Run: 379,405,078,528 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 6C8776692CE367067A9A203F99C16BB4
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:49 AM, on 11/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.227 awareremover2009.microsoft.com
O1 - Hosts: 91.212.127.227 awareremover2009.com
O1 - Hosts: 91.212.127.227 www.awareremover2009.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Classroom Teacher\NotebookPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O3 - Toolbar: SMART Sync - {8E1233B3-485A-4E51-B77E-9E075A68C588} - C:\Program Files\SMART Technologies\Classroom Teacher\Sync Teacher\SyncIEToolbar.dll
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Remote] "C:\Program Files\PowerColor\Real Angel 330\Remote.exe"
O4 - HKLM\..\Run: [Schedule] "C:\Program Files\PowerColor\Real Angel 330\Schedule.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AVG Free Tray Icon.lnk = C:\Program Files\AVG\AVG8\avgtray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Update Service (gupdate1c9c62bfc4ddf28) (gupdate1c9c62bfc4ddf28) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Response Hardware - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SMART Board Service - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
O23 - Service: SMART Mirror Driver Monitor Service - SMART Technologies Inc. - C:\Program Files\Common Files\SMART Technologies\Mirror Driver\MonitorService.exe
O23 - Service: SMART SNMP Agent Service - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe (file missing)
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\WebServer.exe
--
End of file - 7717 bytes
Open notepad and copy/paste the text in the codebox below into it:
File::
c:\windows\Rnayak.dat
c:\windows\Xhitah.bin
c:\windows\system32\drivers\etc\hosts
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
I have not done anything yet. What should I be copy/pasting?
Code:
---------
File::
c:\windows\Rnayak.dat
c:\windows\Xhitah.bin
c:\windows\system32\drivers\etc\hosts
---------
or
File::
c:\windows\Rnayak.dat
c:\windows\Xhitah.bin
c:\windows\system32\drivers\etc\hosts
I Just want to be sure.
Thanks
Don
The latter one, please :)
Thanks again. The system seems to be working much better already. I have been trying to get rid of "www.fastbrowsersearch.com" but I have not had any luck doing so.
Thanks!
Don
ComboFix 09-11-30.02 - Don 11/30/2009 14:37.2.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2309 [GMT -8:00]
Running from: c:\documents and settings\Don\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Don\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FILE ::
"c:\windows\Rnayak.dat"
"c:\windows\system32\drivers\etc\hosts"
"c:\windows\Xhitah.bin"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Rnayak.dat
c:\windows\system32\drivers\etc\hosts
c:\windows\Xhitah.bin
.
((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-30 )))))))))))))))))))))))))))))))
.
2009-11-28 16:53 . 2008-04-14 12:42 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-11-28 16:53 . 2008-04-14 12:42 50176 ----a-w- c:\windows\system32\proquota.exe
2009-11-27 22:38 . 2009-11-27 22:38 -------- d-----w- c:\program files\Trend Micro
2009-11-26 01:15 . 2009-11-06 16:51 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-26 01:15 . 2009-11-02 17:57 3513624 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-11-26 01:15 . 2009-11-02 17:57 2028312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-24 16:00 . 2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
2009-11-24 16:00 . 2009-11-24 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\SP
2009-11-23 15:38 . 2009-11-23 15:38 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
2009-11-20 20:29 . 2009-11-20 20:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-20 20:29 . 2009-11-20 20:33 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-20 20:27 . 2009-11-20 20:27 117760 ----a-w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-11-20 01:37 . 2004-04-15 05:11 242840 ----a-w- c:\windows\system32\GDI TeletextServer.dll
2009-11-20 01:37 . 2004-01-03 01:29 339968 ----a-w- c:\windows\system32\mpeg2enc.dll
2009-11-20 01:37 . 2003-06-28 22:34 69707 ----a-w- c:\windows\system32\DISP_OPT1.dll
2009-11-20 01:37 . 1998-06-18 02:44 929844 ----a-w- c:\windows\system32\MFC42D.DLL
2009-11-20 01:37 . 1998-06-17 08:00 385100 ----a-w- c:\windows\system32\MSVCRTD.DLL
2009-11-18 22:41 . 2009-11-18 22:41 -------- d-----w- c:\program files\JRE
2009-11-18 22:40 . 2009-11-18 22:40 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-16 18:41 . 2009-11-16 18:41 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
2009-11-13 22:52 . 2009-11-13 22:52 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2009-11-13 18:07 . 2009-11-13 18:06 147456 --sh--r- C:\pxev.exe
2009-11-13 15:58 . 2009-11-13 15:58 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
2009-11-11 01:36 . 2009-11-11 02:12 -------- d-----w- c:\program files\DScaler
2009-11-09 19:37 . 2009-11-10 05:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-09 18:53 . 2009-11-09 20:16 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\xxvqof
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\Don\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-08 01:06 . 2009-11-08 01:06 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
2009-11-07 22:58 . 2009-11-07 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\df9430b
2009-11-05 20:57 . 2009-11-05 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2009-11-05 20:55 . 2009-11-05 20:55 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-11-05 20:40 . 2009-11-05 20:49 -------- d-----w- c:\program files\Dragon Age
2009-11-05 20:40 . 2009-11-05 20:55 -------- d-----w- c:\program files\Common Files\BioWare
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-30 18:29 . 2009-04-26 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-29 23:21 . 2009-01-23 05:33 1 ----a-w- c:\documents and settings\Don\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-11-20 20:27 . 2009-07-26 23:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-20 01:37 . 2009-01-21 19:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-19 00:26 . 2009-02-07 07:13 -------- d-----w- c:\documents and settings\Don\Application Data\BSW
2009-11-18 23:58 . 2009-01-25 08:37 39376 ----a-w- c:\documents and settings\Don\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-18 22:41 . 2009-01-21 20:11 -------- d-----w- c:\program files\OpenOffice.org 3
2009-11-18 22:40 . 2009-01-21 20:10 -------- d-----w- c:\program files\Java
2009-11-11 02:00 . 2009-08-18 18:46 -------- d-----w- c:\program files\Tile3D_40
2009-11-11 01:55 . 2009-04-26 04:53 -------- d-----w- c:\program files\Google
2009-11-11 01:54 . 2009-02-07 07:33 -------- d-----w- c:\program files\Codemasters
2009-11-11 01:52 . 2009-04-05 20:37 -------- d-----w- c:\program files\Steam
2009-11-08 06:32 . 2009-05-02 19:13 -------- d-----w- c:\program files\1701 A.D
2009-11-08 02:49 . 2009-01-21 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-08 02:39 . 2009-07-24 17:53 -------- d-----w- c:\program files\QuickTime
2009-11-07 22:59 . 2009-11-07 22:59 0 ----a-w- c:\documents and settings\Don\33D.tmp
2009-11-07 22:59 . 2009-11-07 22:59 100 ----a-w- c:\documents and settings\Don\33A.tmp
2009-11-07 22:58 . 2009-11-07 22:58 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-10-07 16:35 . 2009-01-22 02:15 189104 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-07 16:30 . 2009-01-22 02:15 139584 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-05 16:17 . 2009-10-05 16:17 -------- d-----w- c:\program files\Microsoft
2009-09-29 04:15 . 2009-09-29 04:15 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JINECELP.dll
2009-09-29 04:15 . 2009-09-29 04:15 73216 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWAudio.dll
2009-09-29 04:15 . 2009-09-29 04:15 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWMixer.dll
2009-09-29 04:15 . 2009-09-29 04:15 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\ICE_JNIRegistry.dll
2009-09-29 04:15 . 2009-09-29 04:15 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\WinPlatform.dll
2009-09-29 03:58 . 2009-09-29 03:58 98816 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\53\6061d535-284d4338-n\WinVideo.dll
2009-09-29 03:58 . 2009-09-29 03:58 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JINECELP.dll
2009-09-29 03:58 . 2009-09-29 03:58 68608 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWAudio.dll
2009-09-29 03:58 . 2009-09-29 03:58 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWMixer.dll
2009-09-29 03:58 . 2009-09-29 03:58 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\ICE_JNIRegistry.dll
2009-09-29 03:58 . 2009-09-29 03:58 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\WinPlatform.dll
2009-09-11 14:18 . 2008-04-14 12:42 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2008-04-14 12:42 58880 ----a-w- c:\windows\system32\msasn1.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-11-28_16.55.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-30 16:06 . 2009-11-30 16:06 16384 c:\windows\Temp\Perflib_Perfdata_5dc.dat
+ 2006-02-28 12:00 . 2009-11-30 16:10 71206 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-11-28 16:51 71206 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2009-11-30 16:10 441014 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2009-11-28 16:51 441014 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\sp]
@="{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
[HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}]
2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-11 2001648]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-18 149280]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"Remote"="c:\program files\PowerColor\Real Angel 330\Remote.exe" [2006-03-06 253952]
"Schedule"="c:\program files\PowerColor\Real Angel 330\Schedule.exe" [2006-05-19 94208]
c:\documents and settings\Don\Start Menu\Programs\Startup\
AVG Free Tray Icon.lnk - c:\program files\AVG\AVG8\avgtray.exe [2009-1-21 2029336]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-15 17:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\ResponseSoftwareService.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\UCGui.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\UCService.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\WebServer.exe"=
"c:\\Program Files\\SMART Technologies\\Classroom Teacher\\Sync Teacher\\SMARTSyncTeacher.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\empire total war\\Empire.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"13398:TCP"= 13398:TCP:spport
"29653:TCP"= 29653:TCP:spport
"14605:TCP"= 14605:TCP:spport
"6659:TCP"= 6659:TCP:spport
"15609:TCP"= 15609:TCP:spport
"5562:TCP"= 5562:TCP:spport
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/21/2009 11:33 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/21/2009 11:33 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/21/2009 11:33 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/21/2009 11:33 AM 297752]
R2 Response Hardware;Response Hardware;c:\program files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe [8/11/2009 12:10 PM 30504]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
R3 smrtdrv;SMART Technologies Inc. Mirror Driver;c:\windows\system32\drivers\smrtdrv.sys [4/22/2004 10:38 AM 2432]
S2 gupdate1c9c62bfc4ddf28;Google Update Service (gupdate1c9c62bfc4ddf28);c:\program files\Google\Update\GoogleUpdate.exe [4/25/2009 9:00 PM 133104]
S2 SMART Mirror Driver Monitor Service;SMART Mirror Driver Monitor Service;c:\program files\Common Files\SMART Technologies\Mirror Driver\MonitorService.exe [1/16/2009 10:03 AM 135680]
S2 SPService;SPService;c:\windows\system32\svchost.exe -k netsvc [4/14/2008 4:42 AM 14336]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [11/5/2009 12:48 PM 25832]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [5/30/2007 4:34 PM 39424]
S3 SMART SNMP Agent Service;SMART SNMP Agent Service;c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe --> c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe [?]
S3 SMART Web Server;SMART Web Server;c:\program files\SMART Technologies\Classroom Teacher\WebServer.exe [7/23/2009 4:51 PM 1245184]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
netsvc REG_MULTI_SZ SPService
.
Contents of the 'Scheduled Tasks' folder
2009-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-11-30 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-26 04:53]
2009-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
2009-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com/
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\m6tf3mhu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={1651BD89-383E-6D1B-C9C4-68D795ABED09}&q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {A42A97C1-1509-481F-97FF-37F073F7C132} - c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
FF - HiddenExtension: XULRunner: {22400F1B-A246-4997-83B4-BD1963E86E19} - c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
FF - HiddenExtension: XULRunner: {799FCEF6-870A-454D-A1AD-7CC39161BE85} - c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
FF - HiddenExtension: XULRunner: {9830D2C5-7C79-41C5-969C-3D9F7E97BD0D} - c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-30 14:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:6f,b3,c7,b1,b2,d8,ed,7a,c8,bb,09,b2,89,68,d6,95,ed,ac,2c,33,01,53,8c,
50,78,5e,47,a3,86,ea,a1,96,27,06,5e,22,0e,2a,30,2c,b0,d7,c1,de,fd,93,db,f7,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\License information*]
"datasecu"=hex:b7,e1,ed,21,d2,38,df,6c,e3,19,80,da,f2,c2,a5,27,aa,53,be,5d,62,
b7,84,2e,ce,86,fc,62,b3,1e,24,c0,df,e9,2d,82,f5,c4,4e,21,ec,a6,9e,50,a0,85,\
"rkeysecu"=hex:6c,33,7b,3b,e2,25,e6,76,ff,a4,29,b1,81,c5,11,57
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2009-11-30 14:42
ComboFix-quarantined-files.txt 2009-11-30 22:42
ComboFix2.txt 2009-11-28 16:56
Pre-Run: 379,174,871,040 bytes free
Post-Run: 379,157,454,848 bytes free
- - End Of File - - 5568B60314F426F9174C5E1D7D71A1F1
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:45:39 PM, on 11/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PowerColor\Real Angel 330\Schedule.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Classroom Teacher\NotebookPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O3 - Toolbar: SMART Sync - {8E1233B3-485A-4E51-B77E-9E075A68C588} - C:\Program Files\SMART Technologies\Classroom Teacher\Sync Teacher\SyncIEToolbar.dll
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Remote] "C:\Program Files\PowerColor\Real Angel 330\Remote.exe"
O4 - HKLM\..\Run: [Schedule] "C:\Program Files\PowerColor\Real Angel 330\Schedule.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: AVG Free Tray Icon.lnk = C:\Program Files\AVG\AVG8\avgtray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Update Service (gupdate1c9c62bfc4ddf28) (gupdate1c9c62bfc4ddf28) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Response Hardware - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\ResponseHardwareService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SMART Board Service - SMART Technologies - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTBoardService.exe
O23 - Service: SMART Mirror Driver Monitor Service - SMART Technologies Inc. - C:\Program Files\Common Files\SMART Technologies\Mirror Driver\MonitorService.exe
O23 - Service: SMART SNMP Agent Service - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe (file missing)
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\WebServer.exe
--
End of file - 7677 bytes
I see :)
Please next run this CFScript and post back a fresh HijackThis log and a fresh combofix log.
Firefox::
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\m6tf3mhu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q=
FF - prefs.js: browser.search.selectedEngine - Fast Browser Search
FF - prefs.js: keyword.URL - hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={1651BD89-383E-6D1B-C9C4-68D795ABED09}&q=
Here is the combo fix. I did to reboot as my "Start" bar and desktop did not come back. I will send you the Hijack This is a sec
ComboFix 09-12-01.01 - Don 12/01/2009 19:52.3.4 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2326 [GMT -8:00]
Running from: c:\documents and settings\Don\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Don\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((( Files Created from 2009-11-02 to 2009-12-02 )))))))))))))))))))))))))))))))
.
2009-11-28 16:53 . 2008-04-14 12:42 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-11-28 16:53 . 2008-04-14 12:42 50176 ----a-w- c:\windows\system32\proquota.exe
2009-11-27 22:38 . 2009-11-27 22:38 -------- d-----w- c:\program files\Trend Micro
2009-11-26 01:15 . 2009-11-06 16:51 2064152 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-11-26 01:15 . 2009-11-02 17:57 3513624 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-11-26 01:15 . 2009-11-02 17:57 2028312 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
2009-11-24 16:00 . 2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
2009-11-24 16:00 . 2009-11-24 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\SP
2009-11-23 15:38 . 2009-11-23 15:38 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
2009-11-20 20:29 . 2009-11-20 20:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-11-20 20:29 . 2009-11-20 20:33 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-11-20 20:27 . 2009-11-20 20:27 117760 ----a-w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-11-20 20:27 . 2009-11-20 20:27 -------- d-----w- c:\documents and settings\Don\Application Data\SUPERAntiSpyware.com
2009-11-20 01:37 . 2004-04-15 05:11 242840 ----a-w- c:\windows\system32\GDI TeletextServer.dll
2009-11-20 01:37 . 2004-01-03 01:29 339968 ----a-w- c:\windows\system32\mpeg2enc.dll
2009-11-20 01:37 . 2003-06-28 22:34 69707 ----a-w- c:\windows\system32\DISP_OPT1.dll
2009-11-20 01:37 . 1998-06-18 02:44 929844 ----a-w- c:\windows\system32\MFC42D.DLL
2009-11-20 01:37 . 1998-06-17 08:00 385100 ----a-w- c:\windows\system32\MSVCRTD.DLL
2009-11-18 22:41 . 2009-11-18 22:41 -------- d-----w- c:\program files\JRE
2009-11-18 22:40 . 2009-11-18 22:40 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-11-16 18:41 . 2009-11-16 18:41 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
2009-11-13 22:52 . 2009-11-13 22:52 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2009-11-13 18:07 . 2009-11-13 18:06 147456 --sh--r- C:\pxev.exe
2009-11-13 15:58 . 2009-11-13 15:58 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
2009-11-11 01:36 . 2009-11-11 02:12 -------- d-----w- c:\program files\DScaler
2009-11-09 19:37 . 2009-11-10 05:50 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-09 18:53 . 2009-11-09 20:16 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\xxvqof
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\Don\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-08 02:29 . 2009-09-10 22:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-08 02:29 . 2009-11-08 02:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-08 01:06 . 2009-11-08 01:06 -------- d-----w- c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
2009-11-07 22:58 . 2009-11-07 22:58 -------- d-----w- c:\documents and settings\All Users\Application Data\df9430b
2009-11-05 20:57 . 2009-11-05 20:57 -------- d-----w- c:\documents and settings\All Users\Application Data\BioWare
2009-11-05 20:55 . 2009-11-05 20:55 -------- d-----w- c:\windows\1C4551A64743409391E41477CD655043.TMP
2009-11-05 20:40 . 2009-11-05 20:49 -------- d-----w- c:\program files\Dragon Age
2009-11-05 20:40 . 2009-11-05 20:55 -------- d-----w- c:\program files\Common Files\BioWare
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-02 02:23 . 2009-01-23 05:33 1 ----a-w- c:\documents and settings\Don\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-01 19:30 . 2009-04-26 04:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-11-30 23:11 . 2009-01-25 08:37 36504 ----a-w- c:\documents and settings\Don\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 22:53 . 2009-09-29 05:01 -------- d-----w- c:\documents and settings\All Users\Application Data\SMART Technologies
2009-11-20 20:27 . 2009-07-26 23:54 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-11-20 01:37 . 2009-01-21 19:07 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-11-19 00:26 . 2009-02-07 07:13 -------- d-----w- c:\documents and settings\Don\Application Data\BSW
2009-11-18 22:41 . 2009-01-21 20:11 -------- d-----w- c:\program files\OpenOffice.org 3
2009-11-18 22:40 . 2009-01-21 20:10 -------- d-----w- c:\program files\Java
2009-11-11 02:00 . 2009-08-18 18:46 -------- d-----w- c:\program files\Tile3D_40
2009-11-11 01:55 . 2009-04-26 04:53 -------- d-----w- c:\program files\Google
2009-11-11 01:54 . 2009-02-07 07:33 -------- d-----w- c:\program files\Codemasters
2009-11-11 01:52 . 2009-04-05 20:37 -------- d-----w- c:\program files\Steam
2009-11-08 06:32 . 2009-05-02 19:13 -------- d-----w- c:\program files\1701 A.D
2009-11-08 02:49 . 2009-01-21 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-11-08 02:39 . 2009-07-24 17:53 -------- d-----w- c:\program files\QuickTime
2009-11-07 22:59 . 2009-11-07 22:59 0 ----a-w- c:\documents and settings\Don\33D.tmp
2009-11-07 22:59 . 2009-11-07 22:59 100 ----a-w- c:\documents and settings\Don\33A.tmp
2009-11-07 22:58 . 2009-11-07 22:58 361600 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-10-07 16:35 . 2009-01-22 02:15 189104 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-10-07 16:30 . 2009-01-22 02:15 139584 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-10-05 16:17 . 2009-10-05 16:17 -------- d-----w- c:\program files\Microsoft
2009-09-29 04:15 . 2009-09-29 04:15 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JINECELP.dll
2009-09-29 04:15 . 2009-09-29 04:15 73216 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWAudio.dll
2009-09-29 04:15 . 2009-09-29 04:15 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\14\450fe1ce-16c28c2f-n\JIWMixer.dll
2009-09-29 04:15 . 2009-09-29 04:15 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\ICE_JNIRegistry.dll
2009-09-29 04:15 . 2009-09-29 04:15 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\46\be777ae-147b1fa5-n\WinPlatform.dll
2009-09-29 03:58 . 2009-09-29 03:58 98816 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\53\6061d535-284d4338-n\WinVideo.dll
2009-09-29 03:58 . 2009-09-29 03:58 74240 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JINECELP.dll
2009-09-29 03:58 . 2009-09-29 03:58 68608 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWAudio.dll
2009-09-29 03:58 . 2009-09-29 03:58 66048 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\56\4d4f6cf8-5d711d8a-n\JIWMixer.dll
2009-09-29 03:58 . 2009-09-29 03:58 65536 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\ICE_JNIRegistry.dll
2009-09-29 03:58 . 2009-09-29 03:58 60928 ----a-w- c:\documents and settings\Don\Application Data\Sun\Java\Deployment\cache\6.0\15\306e94cf-7448b613-n\WinPlatform.dll
2009-09-11 14:18 . 2008-04-14 12:42 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 2008-04-14 12:42 58880 ----a-w- c:\windows\system32\msasn1.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-11-28_16.55.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-01 16:08 . 2009-12-01 16:08 16384 c:\windows\Temp\Perflib_Perfdata_750.dat
+ 2006-02-28 12:00 . 2009-12-01 16:12 71206 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-11-28 16:51 71206 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2009-12-01 16:12 441014 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2009-11-28 16:51 441014 c:\windows\system32\perfh009.dat
+ 2009-01-21 10:31 . 2009-12-01 16:07 160344 c:\windows\system32\FNTCACHE.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\sp]
@="{96AFBE69-C3B0-4b00-8578-D933D2896EE2}"
[HKEY_CLASSES_ROOT\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2}]
2009-11-24 16:00 53760 ----a-w- c:\documents and settings\All Users\Application Data\SP\sp.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-11-11 2001648]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-18 149280]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"Remote"="c:\program files\PowerColor\Real Angel 330\Remote.exe" [2006-03-06 253952]
"Schedule"="c:\program files\PowerColor\Real Angel 330\Schedule.exe" [2006-05-19 94208]
c:\documents and settings\Don\Start Menu\Programs\Startup\
AVG Free Tray Icon.lnk - c:\program files\AVG\AVG8\avgtray.exe [2009-1-21 2029336]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-15 17:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=
"c:\\Program Files\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"=
"c:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Steam\\SteamApps\\common\\empire total war\\Empire.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daorigins.exe"=
"c:\\Program Files\\Dragon Age\\DAOriginsLauncher.exe"=
"c:\\Program Files\\Dragon Age\\bin_ship\\daupdatersvc.service.exe"=
"c:\\WINDOWS\\system32\\svchost.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port
"13398:TCP"= 13398:TCP:spport
"29653:TCP"= 29653:TCP:spport
"14605:TCP"= 14605:TCP:spport
"6659:TCP"= 6659:TCP:spport
"15609:TCP"= 15609:TCP:spport
"5562:TCP"= 5562:TCP:spport
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [1/21/2009 11:33 AM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [1/21/2009 11:33 AM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [11/11/2009 10:44 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [11/11/2009 10:44 AM 74480]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [1/21/2009 11:33 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [1/21/2009 11:33 AM 297752]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [11/11/2009 10:44 AM 7408]
S2 gupdate1c9c62bfc4ddf28;Google Update Service (gupdate1c9c62bfc4ddf28);c:\program files\Google\Update\GoogleUpdate.exe [4/25/2009 9:00 PM 133104]
S2 SPService;SPService;c:\windows\system32\svchost.exe -k netsvc [4/14/2008 4:42 AM 14336]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\Dragon Age\bin_ship\daupdatersvc.service.exe [11/5/2009 12:48 PM 25832]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [5/30/2007 4:34 PM 39424]
S3 SMART SNMP Agent Service;SMART SNMP Agent Service;c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe --> c:\program files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe [?]
S3 smrtdrv;SMART Technologies Inc. Mirror Driver;c:\windows\system32\drivers\smrtdrv.sys [4/22/2004 10:38 AM 2432]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
netsvc REG_MULTI_SZ SPService
.
Contents of the 'Scheduled Tasks' folder
2009-11-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
2009-12-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-26 04:53]
2009-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
2009-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 05:00]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.Google.com/
FF - ProfilePath - c:\documents and settings\Don\Application Data\Mozilla\Firefox\Profiles\m6tf3mhu.default\
FF - prefs.js: browser.startup.homepage - www.google.ca
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {A42A97C1-1509-481F-97FF-37F073F7C132} - c:\documents and settings\Don\Local Settings\Application Data\{A42A97C1-1509-481F-97FF-37F073F7C132}
FF - HiddenExtension: XULRunner: {22400F1B-A246-4997-83B4-BD1963E86E19} - c:\documents and settings\Don\Local Settings\Application Data\{22400F1B-A246-4997-83B4-BD1963E86E19}
FF - HiddenExtension: XULRunner: {799FCEF6-870A-454D-A1AD-7CC39161BE85} - c:\documents and settings\Don\Local Settings\Application Data\{799FCEF6-870A-454D-A1AD-7CC39161BE85}
FF - HiddenExtension: XULRunner: {9830D2C5-7C79-41C5-969C-3D9F7E97BD0D} - c:\documents and settings\Don\Local Settings\Application Data\{9830D2C5-7C79-41C5-969C-3D9F7E97BD0D}
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-01 19:56
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:6f,b3,c7,b1,b2,d8,ed,7a,c8,bb,09,b2,89,68,d6,95,ed,ac,2c,33,01,53,8c,
50,78,5e,47,a3,86,ea,a1,96,27,06,5e,22,0e,2a,30,2c,b0,d7,c1,de,fd,93,db,f7,\
"??"=hex:a1,5e,47,db,25,65,bb,27,8b,92,55,34,10,3f,d9,49
[HKEY_USERS\S-1-5-21-746137067-606747145-682003330-1004\Software\SecuROM\License information*]
"datasecu"=hex:b7,e1,ed,21,d2,38,df,6c,e3,19,80,da,f2,c2,a5,27,aa,53,be,5d,62,
b7,84,2e,ce,86,fc,62,b3,1e,24,c0,df,e9,2d,82,f5,c4,4e,21,ec,a6,9e,50,a0,85,\
"rkeysecu"=hex:6c,33,7b,3b,e2,25,e6,76,ff,a4,29,b1,81,c5,11,57
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(708)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(2684)
c:\windows\system32\WININET.dll
.
Completion time: 2009-12-01 19:57
ComboFix-quarantined-files.txt 2009-12-02 03:57
ComboFix2.txt 2009-11-30 22:42
ComboFix3.txt 2009-11-28 16:56
Pre-Run: 380,404,858,880 bytes free
Post-Run: 380,377,788,416 bytes free
- - End Of File - - 7D67C0B0B478BD52CD60BEB8EA2F90AC
Reboot went well. Here is the Hijack This. The Fast Web Browser seems to be gone. Wow things are working so much better!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:05:57 PM, on 12/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PowerColor\Real Angel 330\Remote.exe
C:\Program Files\PowerColor\Real Angel 330\Schedule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Remote] "C:\Program Files\PowerColor\Real Angel 330\Remote.exe"
O4 - HKLM\..\Run: [Schedule] "C:\Program Files\PowerColor\Real Angel 330\Schedule.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AVG Free Tray Icon.lnk = C:\Program Files\AVG\AVG8\avgtray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Update Service (gupdate1c9c62bfc4ddf28) (gupdate1c9c62bfc4ddf28) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SMART SNMP Agent Service - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe (file missing)
--
End of file - 6819 bytes
I am sorry, I have missed your reply.
Do you still have same issues?
Hey thanks for everything. My system seems to be running much better. So unless something in my logs suggestion otherwise, I think my system is good!
Don
Good :)
Let's however run this before:
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
Here is the virus scan...
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, December 6, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, December 06, 2009 03:59:00
Records in database: 3334432
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
Scan statistics:
Objects scanned: 144203
Threats found: 3
Infected objects found: 4
Suspicious objects found: 0
Scan duration: 02:51:06
File name / Threat / Threats count
C:\Program Files\1701 A.D\Tools\Tages\DrvSetup_x64.exe Infected: Virus.Win32.Virut.ce 1
C:\Program Files\Realtek\Audio\InstallShield\RtlUpd64.exe Infected: Virus.Win32.Virut.ce 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Infected: Rootkit.Win32.TDSS.y 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\etc\hosts.vir Infected: Trojan.Win32.Qhost.mhm 1
Selected area has been scanned.
Here is the Hijack This!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:04:16 AM, on 12/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\PowerColor\Real Angel 330\Remote.exe
C:\Program Files\PowerColor\Real Angel 330\Schedule.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Mail\wlmail.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O3 - Toolbar: Fast Browser Search - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Remote] "C:\Program Files\PowerColor\Real Angel 330\Remote.exe"
O4 - HKLM\..\Run: [Schedule] "C:\Program Files\PowerColor\Real Angel 330\Schedule.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: AVG Free Tray Icon.lnk = C:\Program Files\AVG\AVG8\avgtray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: Google Update Service (gupdate1c9c62bfc4ddf28) (gupdate1c9c62bfc4ddf28) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SMART SNMP Agent Service - Unknown owner - C:\Program Files\SMART Technologies\Classroom Teacher\SMARTSNMPAgent.exe (file missing)
--
End of file - 6932 bytes
Please click this link-->Jotti (http://virusscan.jotti.org/)
Copy/paste the file on the list into the white Upload a file box and click Submit/Send (depends on which one you are using Jotti or VirusTotal).
C:\Program Files\1701 A.D\Tools\Tages\DrvSetup_x64.exe
Please post back the results of the scan in your next post.
If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/
That is a neat little scanner program.
Antivirus Version Last Update Result
a-squared 4.5.0.43 2009.12.08 -
AhnLab-V3 5.0.0.2 2009.12.08 -
AntiVir 7.9.1.102 2009.12.08 -
Antiy-AVL 2.0.3.7 2009.12.07 -
Authentium 5.2.0.5 2009.12.02 -
Avast 4.8.1351.0 2009.12.08 Win64:Vitro
AVG 8.5.0.426 2009.12.08 -
BitDefender 7.2 2009.12.08 Win32.Virtob.Gen.12
CAT-QuickHeal 10.00 2009.12.07 W32.Virut.G
ClamAV 0.94.1 2009.12.08 -
Comodo 3103 2009.12.01 -
DrWeb 5.0.0.12182 2009.12.08 Win32.Virut.56
eSafe 7.0.17.0 2009.12.07 -
eTrust-Vet 35.1.7163 2009.12.07 Win32/Virut.17408
F-Prot 4.5.1.85 2009.12.07 -
F-Secure 9.0.15370.0 2009.12.07 -
Fortinet 4.0.14.0 2009.12.08 -
GData 19 2009.12.08 Win32.Virtob.Gen.12
Ikarus T3.1.1.74.0 2009.12.08 -
Jiangmin 13.0.900 2009.12.02 Win32/Virut.bo
K7AntiVirus 7.10.913 2009.12.07 -
Kaspersky 7.0.0.125 2009.12.08 Virus.Win32.Virut.ce
McAfee 5825 2009.12.07 -
McAfee+Artemis 5825 2009.12.07 -
McAfee-GW-Edition 6.8.5 2009.12.08 -
Microsoft 1.5302 2009.12.08 -
NOD32 4668 2009.12.07 Win32/Virut.NBP
Norman 6.03.02 2009.12.07 -
nProtect 2009.1.8.0 2009.12.07 -
Panda 10.0.2.2 2009.12.08 -
PCTools 7.0.3.5 2009.12.07 Malware.Virut
Rising 22.25.01.01 2009.12.08 -
Sophos 4.48.0 2009.12.08 W32/Scribble-B
Sunbelt 3.2.1858.2 2009.12.08 Virus.Win32.Virut.ce (v)
Symantec 1.4.4.12 2009.12.08 W32.Virut.CF
TheHacker 6.5.0.2.088 2009.12.07 -
TrendMicro 9.100.0.1001 2009.12.07 -
VBA32 3.12.12.0 2009.12.08 -
ViRobot 2009.12.8.2075 2009.12.08 -
VirusBuster 5.0.21.0 2009.12.07 -
Additional information
File size: 432128 bytes
MD5...: 6c6192b19dbfa0e92ab143de69652357
SHA1..: 1b2b5bb8c1f32ac4a7901a0c7cac8edb7d66868b
SHA256: 604889d9aab81702c61912e9f6aee7988a824bc401c572edb0e398defcc6fb0a
ssdeep: 12288:Vx4m2IU/e2qfihJhY5JUduYe9fcq1df+dfg:f4m2IU/e25fhY5wuL9fcq1
df4
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x6e78c
timedatestamp.....: 0x264b26b7 (Fri May 11 20:55:19 1990)
machinetype.......: 0x8664 (AMD64)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xb14e 0xb200 6.21 47e8162c05de750b9c63894bc6e3e815
.rdata 0xd000 0x32b6 0x3400 5.27 87a8df3bc853ccd21b450ee7757b1262
.data 0x11000 0x3580 0x1600 1.71 caecfcb078c353c2f9cc21313463d015
.pdata 0x15000 0xb28 0xc00 4.38 f9e8198526eb87c98da2df705e254deb
.rsrc 0x16000 0x58e00 0x58c00 6.32 0dad4735a0f4997dc5e4582f671e9635
( 4 imports )
> COMCTL32.dll: -
> KERNEL32.dll: GetModuleHandleA, FindResourceA, LoadResource, LockResource, FreeResource, GetSystemDirectoryA, GetLastError, DeleteFileA, DeviceIoControl, SetFileAttributesA, SetLastError, WriteFile, CloseHandle, CreateFileA, GetProcAddress, ExitProcess, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, GetStartupInfoA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlCaptureContext, RtlVirtualUnwind, RtlLookupFunctionEntry, FlsGetValue, FlsSetValue, TlsFree, FlsFree, GetCurrentThreadId, FlsAlloc, GetStdHandle, GetModuleFileNameA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, RtlUnwindEx, LoadLibraryA, InitializeCriticalSection, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapSetInformation, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, SetFilePointer, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, Sleep, HeapSize, MultiByteToWideChar, GetLocaleInfoA, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, HeapReAlloc, FlushFileBuffers
> USER32.dll: MessageBoxA, LoadStringA
> ADVAPI32.dll: RegSetValueExA, ChangeServiceConfigA, CreateServiceA, StartServiceA, RegCreateKeyExA, RegQueryValueExA, RegCloseKey, OpenSCManagerA, OpenServiceA, DeleteService, ControlService, CloseServiceHandle, RegDeleteValueA
( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win64 Executable Generic (95.5%)
Generic Win/DOS Executable (2.2%)
DOS Executable Generic (2.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: Tag_s SA
copyright....: (c) Tag_s SA. All rights reserved.
product......: Application TagesSetup
description..: TagesSetup
original name: TagesSetup.exe
internal name: TagesSetup
file version.: 5.5.2.1
comments.....: Install/Uninstall Tag_s Drivers
signers......: -
signing date.: -
verified.....: Unsigned
Indeed :)
Please delete that file and this as well:
C:\Program Files\Realtek\Audio\InstallShield\RtlUpd64.exe
Empty this folder:
C:\Qoobox\Quarantine
Empty Recycle Bin.
Still problems?
Hey things are working well now. Do you have anything else for me to do or any suggestions?
DOn
Yes, please see from below :)
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Looking over your log, it seems you don't have any evidence of a third party firewall.
As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:
1) Comodo (http://www.personalfirewall.comodo.com/download_firewall.html) (Uncheck during installation "Install COMODO Antivirus (Recommended)"!, "Install Comodo HopSurf..", Make Comodo my default search provider" and "Make HopSurf my homepage")
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) PC Tools (http://www.pctools.com/firewall/download/)
4) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)
If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /uninstall in the runbox and click OK
Next we remove all used tools.
Please download OTCleanIt (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software and keep your other programs up-to-date Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://www.lognrock.com/forum/index.php?showtopic=6926)
Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer. See also a hosts file tutorial here (http://malwareremoval.com/forum/viewtopic.php?t=22187)
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)
Happy surfing and stay clean! :bigthumb:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.