PDA

View Full Version : Another Multiple iexplore's popups, system wave muted.


spud101
2010-07-20, 15:53
Hey there everyone. Thanks very much in advance for your assistance. Below is my DDS log. I've also run Sophos which detected/quarantined some Sus/ComPack-B & Sus/ComPack-C files but I'm still getting these popups.

Spybot S&D, malwarebytes & Adaware all report I'm clean and clear.

Thanks again:


DDS (Ver_10-03-17.01) - NTFSx86
Run by craig.murphy at 13:42:21.85 on 20/07/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.985 [GMT 1:00]

AV: Sophos Anti-Virus *On-access scanning enabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

============== Running Processes ===============

svchost.exe 4
C:\Program Files\lotus\notes\nslsvice.exe
svchost.exe 4
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\WINDOWS\system32\DWRCS.exe
C:\Program Files\Common Files\Juniper Networks\JUNS\dsAccessService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\system32\DWRCST.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\Documents and Settings\craig.murphy\Local Settings\Application Data\Google\Google Talk, Labs Edition\GoogleTalkLabsEdition.exe
C:\Program Files\lotus\notes\nminder.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\lotus\notes\NLNOTES.EXE
C:\Program Files\lotus\notes\ntaskldr.EXE
C:\Program Files\Defraggler\df.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\craig.murphy\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uWindow Title = Windows Internet Explorer provided by Ricoh Europe PLC
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [DameWare MRC Agent] c:\windows\system32\DWRCST.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\craig~1.mur\startm~1\programs\startup\google~1.lnk - c:\documents and settings\craig.murphy\local settings\application data\google\google talk, labs edition\GoogleTalkLabsEdition.exe
StartupFolder: c:\docume~1\craig~1.mur\startm~1\programs\startup\notesm~1.lnk - c:\windows\installer\{3dfb275e-92f1-4d4a-a546-c5475917fa41}\NMinder_1.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoup~1.lnk - c:\program files\sophos\autoupdate\ALMon.exe
uPolicies-explorer: NoWelcomeScreen = 1 (0x1)
uPolicies-explorer: ForceStartMenuLogOff = 1 (0x1)
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
uPolicies-explorer: DisablePersonalDirChange = 1 (0x1)
mPolicies-explorer: NoWelcomeScreen = 1 (0x1)
dPolicies-explorer: NoRecentDocsNetHood = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237287686234
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1258645615559
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}
DPF: {CAFECAFE-0013-0001-0026-ABCDEFABCDEF}
DPF: {CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} - hxxps://juniper.net/dana-cached/setup/JuniperSetupSP1.cab
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\craig~1.mur\applic~1\mozilla\firefox\profiles\e8r1sx0h.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/|http://translate.google.com/#en|fr|
FF - prefs.js: network.proxy.ftp - 10.146.222.6
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - 10.146.222.6
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - 10.146.222.6
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 10.146.222.6
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 10.146.222.6
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\craig.murphy\application data\mozilla\firefox\profiles\e8r1sx0h.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll
FF - plugin: c:\documents and settings\craig.murphy\local settings\application data\google\update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPJinit13126.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-7-14 64288]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2010-6-15 111232]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2010-6-15 38912]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-7-14 95024]
R2 JuniperAccessService;Juniper Unified Network Service;c:\program files\common files\juniper networks\juns\dsAccessService.exe [2009-8-19 99704]
R2 RapportMgmtService;Rapport Management Service;c:\program files\trusteer\rapport\bin\RapportMgmtService.exe [2010-7-1 840936]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2010-6-16 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2010-6-16 98304]
R2 Sophos Agent;Sophos Agent;c:\program files\sophos\remote management system\ManagementAgentNT.exe [2010-6-16 266240]
R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2010-6-2 172032]
R2 Sophos Message Router;Sophos Message Router;c:\program files\sophos\remote management system\RouterNT.exe [2010-6-16 794624]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-21 135664]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1352832]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\google\google desktop search\GoogleDesktop.exe [2009-12-21 30192]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\drivers\Gt51Ip.sys [2010-1-11 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\drivers\gt72ubus.sys [2010-1-11 51968]
S3 INQ1usbser;INQ1 USB Device for Legacy Serial Communication;c:\windows\system32\drivers\INQ1usbser.sys [2009-11-26 103680]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3b.tmp --> c:\windows\system32\3B.tmp [?]
S3 RapportKELL;RapportKELL;c:\program files\trusteer\rapport\bin\RapportKELL.sys [2010-7-1 59240]
S3 RapportPG;RapportPG;c:\program files\trusteer\rapport\bin\RapportPG.sys [2010-7-1 166632]
S3 S2usbser;S2 USB Device for Legacy Serial Communication;c:\windows\system32\drivers\S2usbser.sys [2009-11-17 103680]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2010-6-15 14976]

=============== Created Last 30 ================

2010-07-20 10:04:25 0 d-----w- c:\docume~1\craig~1.mur\applic~1\Malwarebytes
2010-07-20 09:55:32 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-20 09:55:31 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-07-20 09:15:49 6153352 ----a-w- C:\mbam-setup-1.46.exe
2010-07-20 08:46:50 0 d--h--w- c:\windows\PIF
2010-07-20 08:26:29 72670 ----a-w- c:\windows\logo.bmp
2010-07-16 10:45:30 27944 ----a-w- c:\windows\system32\sbbd.exe
2010-07-16 10:43:43 0 d-----w- C:\VIPRERESCUE
2010-07-15 13:25:32 1379818 ----a-w- c:\documents and settings\craig.murphy\default.scr
2010-07-15 12:48:40 0 d-sha-r- C:\cmdcons
2010-07-15 12:35:48 77312 ----a-w- c:\windows\MBR.exe
2010-07-15 12:35:48 256512 ----a-w- c:\windows\PEV.exe
2010-07-15 12:35:48 161792 ----a-w- c:\windows\SWREG.exe
2010-07-15 12:35:47 98816 ----a-w- c:\windows\sed.exe
2010-07-15 11:41:56 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-07-15 11:36:53 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-07-15 09:46:19 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-07-14 14:14:02 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-14 14:13:58 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-14 14:07:31 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-14 14:06:56 0 d-----w- c:\program files\Lavasoft
2010-07-13 09:55:09 19 ----a-w- C:\kill.bat
2010-07-13 09:53:56 621944 ----a-w- C:\pskill.exe
2010-07-13 09:48:29 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-07-13 09:48:29 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-07-01 08:51:17 0 d-----w- C:\Shared
2010-07-01 08:40:36 775686 ----a-w- c:\documents and settings\craig.murphy\jul.bmp
2010-06-30 15:25:16 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-30 09:02:51 775686 ----a-w- c:\documents and settings\craig.murphy\jun.bmp
2010-06-30 08:50:52 0 d-----w- c:\program files\common files\Juniper Networks
2010-06-30 08:50:44 78 ----a-w- c:\windows\init.ini
2010-06-30 08:49:03 0 d-----w- c:\program files\UPHClean
2010-06-30 08:47:33 0 d--h--w- c:\windows\system32\dwrcssft
2010-06-23 14:20:33 135 ----a-w- C:\rexsync.bat
2010-06-23 14:20:16 138 ----a-w- C:\ikonsync.bat
2010-06-23 14:19:34 0 d-----w- C:\Qmigmasterrex

==================== Find3M ====================

2010-06-16 13:49:55 130088 ----a-w- c:\windows\system32\sdccoinstaller.dll
2010-06-16 13:49:35 23552 ----a-w- c:\windows\system32\sophosboottasks.exe
2010-06-15 14:53:00 111232 ----a-w- c:\windows\system32\drivers\savonaccesscontrol.sys
2010-06-15 14:52:57 14976 ----a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2010-06-15 14:52:34 38912 ----a-w- c:\windows\system32\drivers\savonaccessfilter.sys
2010-05-28 14:58:51 32444 ---ha-w- c:\windows\system32\mlfcache.dat
2010-05-12 10:01:36 126 ----a-w- C:\sync.bat
2010-05-06 10:41:53 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys

============= FINISH: 13:44:58.82 ===============
Jack&Jill
2010-07-24, 12:11
Hello and welcome to Safer Networking.

I am currently assessing your situation and will be back with a fix for your problem as soon as possible.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Thread Tools, then click Subscribe to this Thread. Under the Notification Type: title, make sure it is set to Instant notification by email, then click Add Subscription.

Please be patient with me during this time.

Meanwhile, please make a reply to this topic to acknowledge that you have read this and is still with me to tackle the problem until the end. If I do not get any response within 3 days, this topic will be closed.
spud101
2010-07-24, 14:33
Hi there and thanks for your post.

I'm still here and still have the issue.

Thanks again.
Jack&Jill
2010-07-25, 18:38
Hello spud101 :),

Before we go further, there are a few things that I would like to make clear so that we are share the same understanding.

Please observe and follow these Forum Rules (http://forums.spybot.info/showthread.php?t=288).
Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you.
Please read the instructions carefully and follow them closely, in the order they are presented to you.
If you have any doubts or problems during the fix, please stop and ask.
All the tools that I will ask you to download and use are safe. Please allow if prompted by any of your security softwares.
Do not use or run any malware cleaning tools without supervision as they may cause more harm if improperly used.
Refrain from installing any new programs except those that I request during the fix to prevent interference to my diagnosis of the problem.
Lack of malware symptoms does not mean your computer is clean. Stick to this topic until I give the All Clear.
If you do not reply within 3 days, this topic will be closed.
If you are agreeable to the above, then everything should go smoothly :) . We may begin.

--------------------

Please post back Attach.txt from the DDS scan.

--------------------

Please download MBRCheck© by a_d_13 from one of the links below and save it to your desktop.

Link 1 (http://ad13.geekstogo.com/MBRCheck.exe)
Link 2 (http://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe)
Link 3 (http://www.kernelmode.info/MBRCheck.exe)

Preliminary scan

Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running MBRCheck. They will interfere and may cause unexpected results.
If you need help to disable your protection programs see here (http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/490111-how-disable-your-security-applications.html) and here (http://www.bleepingcomputer.com/forums/topic114351.html).
Double click on MBRCheck.exe to run it (Vista and Windows 7 users will have to confirm the UAC prompt).
A command prompt window will open.
If you are presented with options, enter N at the prompt and press Enter twice.
Otherwise, just press Enter.
A log file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop. Please post the contents of that file.

--------------------

Check for Recovery Partition via script

Please download Preformat© by Noviciate and save to your desktop. Click here. (http://images.malwareremoval.com/Noviciate/Preformat.zip)
Extract Preformat.vbs from the zip file to the desktop and double click on it.
A script will run and will prompt that it has completed. Click OK.
A log will be created on the desktop as Preformat.txt. Please post the contents of this log.

--------------------

Do you have the Windows XP Installation disc? Is the Recovery Console installed on your computer?

Is this a business computer?

--------------------

Please post back:
1. Attach.txt
2. MBRCheck log
3. Preformat.txt
4. the answers to my questions
spud101
2010-07-27, 12:26
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 17/03/2009 08:32:33
System Uptime: 20/07/2010 11:00:43 (2 hours ago)

Motherboard: Dell Inc. | | 0F331C
Processor: Intel(R) Core(TM)2 Duo CPU U7700 @ 1.33GHz | Microprocessor | 1330/133mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 74 GiB total, 31.127 GiB free.
H: is NetworkDisk (NTFS) - 0 GiB total, 95.62 GiB free.
O: is NetworkDisk (NTFS) - 20 GiB total, 6.758 GiB free.
P: is NetworkDisk (NTFS) - 1073 GiB total, 22.139 GiB free.
R: is NetworkDisk (NTFS) - 20 GiB total, 6.758 GiB free.
Y: is NetworkDisk (NTFS) - 612 GiB total, 339.031 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\F2E470394FC000
Manufacturer: Microsoft
Name: 1394 Net Adapter #2
PNP Device ID: V1394\NIC1394\F2E470394FC000
Service: NIC1394

==== System Restore Points ===================

RP268: 29/06/2010 10:11:26 - Installed Windows XP KB943729.
RP269: 30/06/2010 09:51:30 - Installed Windows XP KB943729.
RP270: 30/06/2010 09:51:53 - Installed Windows XP KB943729.
RP271: 30/06/2010 10:01:23 - Installed Windows XP KB943729.
RP272: 30/06/2010 10:01:45 - Installed Windows XP KB943729.
RP273: 30/06/2010 10:51:54 - Installed Windows XP KB943729.
RP274: 30/06/2010 10:52:30 - Installed Windows XP KB943729.
RP275: 30/06/2010 17:02:53 - Software Distribution Service 3.0
RP276: 01/07/2010 09:58:33 - Software Distribution Service 3.0
RP277: 01/07/2010 12:25:02 - Installed Windows XP KB943729.
RP278: 01/07/2010 12:25:53 - Installed Windows XP KB943729.
RP279: 02/07/2010 10:34:17 - Installed Windows XP KB943729.
RP280: 02/07/2010 10:35:13 - Installed Windows XP KB943729.
RP281: 02/07/2010 11:04:45 - Installed Windows XP KB943729.
RP282: 02/07/2010 11:05:18 - Installed Windows XP KB943729.
RP283: 06/07/2010 09:38:29 - Installed Windows XP KB943729.
RP284: 06/07/2010 09:39:17 - Installed Windows XP KB943729.
RP285: 07/07/2010 09:36:36 - Installed Windows XP KB943729.
RP286: 07/07/2010 09:37:22 - Installed Windows XP KB943729.
RP287: 08/07/2010 09:42:20 - Installed Windows XP KB943729.
RP288: 08/07/2010 09:43:37 - Installed Windows XP KB943729.
RP289: 08/07/2010 10:24:35 - Installed Windows XP KB943729.
RP290: 08/07/2010 10:25:16 - Installed Windows XP KB943729.
RP291: 09/07/2010 09:15:31 - Installed Windows XP KB943729.
RP292: 09/07/2010 09:16:22 - Installed Windows XP KB943729.
RP293: 13/07/2010 09:31:17 - Installed Windows XP KB943729.
RP294: 13/07/2010 09:33:00 - Installed Windows XP KB943729.
RP295: 13/07/2010 11:58:16 - Removed Java 2 Runtime Environment, SE v1.4.2_19
RP296: 13/07/2010 12:00:10 - Removed Java(TM) 6 Update 17
RP297: 13/07/2010 14:00:23 - Removed product_name_not_used
RP298: 13/07/2010 14:06:52 - Installed Windows XP KB943729.
RP299: 13/07/2010 14:07:33 - Installed Windows XP KB943729.
RP300: 14/07/2010 08:36:02 - Installed Windows XP KB943729.
RP301: 14/07/2010 08:37:07 - Installed Windows XP KB943729.
RP302: 14/07/2010 15:20:18 - Installed Rapport
RP303: 14/07/2010 15:22:27 - Installed Windows XP KB943729.
RP304: 14/07/2010 15:23:03 - Installed Windows XP KB943729.
RP305: 15/07/2010 09:47:29 - Installed Windows XP KB943729.
RP306: 15/07/2010 09:48:52 - Installed Windows XP KB943729.
RP307: 15/07/2010 12:01:32 - Installed Windows XP KB943729.
RP308: 15/07/2010 12:03:54 - Installed Windows XP KB943729.
RP309: 19/07/2010 19:45:03 - System Checkpoint
RP310: 20/07/2010 08:09:12 - Software Distribution Service 3.0
RP311: 20/07/2010 10:10:26 - Removed SolarWinds SCP Server
RP312: 20/07/2010 10:12:25 - Configured SolarWinds Toolset v10.4

==== Installed Programs ======================

.print Client Windows (RDP)
Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.0
Broadcom Gigabit Integrated Controller
CCleaner
Compatibility Pack for the 2007 Office system
Compliance Checker for VMware ESX
Conexant HDA D330 MDC V.92 Modem
DameWare Mini Remote Control Client Agent Service
Defraggler
Dell Resource CD
ERUNT 1.1j
Google Chrome
Google Desktop
Google Gears
Google Talk, Labs Edition
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB954550-v5)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
Java Auto Updater
Juniper Installer Service
Juniper Networks Network Connect 6.0.0
Juniper Networks Network Connect 6.3.0
Juniper Networks Setup Client Activex Control
Lotus Notes 7.0.2
Malwarebytes' Anti-Malware
mCore
mDriver
mDrWiFi
mHlpDell
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Active Directory Topology Diagrammer
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Interop Forms Redistributable Package 2.0a
Microsoft Office Project Standard 2003
Microsoft Office Standard Edition 2003
Microsoft Office Visio Standard 2003
Microsoft Office Visio Viewer 2007
Microsoft RichCopy 4.0
Microsoft Silverlight
mIWA
mLogView
mMHouse
Mozilla Firefox (3.6.6)
mPfMgr
mPfWiz
mProSafe
mSCfg
MSN
mSSO
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB954459)
mWlsSafe
mWMI
mZConfig
Oracle JInitiator 1.3.1.26
OZ776 SCR Driver V1.1.3.9
Quest Secure Password Extension x86
Rapport
Recuva
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB923789)
Segoe UI
SigmaTel Audio
Skype Toolbars
Skype™ 4.2
Sophos Anti-Rootkit 1.5.4
Sophos Anti-Virus
Sophos AutoUpdate
Sophos Remote Management System
Speccy
Spybot - Search & Destroy
TomTom HOME Visual Studio Merge Modules
TreeSize Free V2.3.3
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB980182)
User Profile Hive Cleanup Service
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 1.0.5
WebEx
WebFldrs XP
Windows Driver Package - Amoi Incorporated (INQ1usbser) Modem (01/01/2007 2.0.5.0)
Windows Driver Package - Amoi Incorporated (INQ1usbser) Ports (01/01/2007 2.0.5.0)
Windows Driver Package - Amoi Incorporated (S2usbser) Modem (01/01/2007 2.0.5.0)
Windows Driver Package - Amoi Incorporated (S2usbser) Ports (01/01/2007 2.0.5.0)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows Resource Kit Tools - GPInventory.exe
WinRAR archiver
WinZip

==== Event Viewer Messages From Past Week ========

20/07/2010 10:54:47, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm SAVOnAccessControl SAVOnAccessFilter
19/07/2010 13:38:22, error: SAVOnAccessFilter [63] - Failed to obtain volume information from mount manager.
16/07/2010 11:43:34, error: Service Control Manager [7022] - The Sophos Anti-Virus service hung on starting.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file sstext3d.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssstars.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file sspipes.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssmyst.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssmypics.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssmarque.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssflwbox.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ssbezier.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file ss3dfo.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file scrnsave.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:22:17, information: Windows File Protection [64005] - The protected system file logon.scr was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is craig.murphy. The file version of the bad file is unknown.
15/07/2010 14:12:13, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service Sophos AutoUpdate Service with arguments "-Service" in order to run the server: {ACB50159-5EFF-47D5-B93F-5433C1BD2F3A}
15/07/2010 12:59:25, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\program files\internet explorer\iexplore.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 8.0.6001.18702.
15/07/2010 12:53:41, error: DCOM [10000] - Unable to start a DCOM Server: {0002DF01-0000-0000-C000-000000000046}. The error: "%5" Happened while starting this command: "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
15/07/2010 12:00:03, error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
15/07/2010 11:57:16, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
15/07/2010 11:29:41, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
15/07/2010 10:51:57, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVOnAccessControl SAVOnAccessFilter Tcpip
15/07/2010 10:51:57, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
15/07/2010 10:51:57, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
15/07/2010 10:51:57, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
15/07/2010 10:51:57, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
15/07/2010 10:13:14, error: System Error [1003] - Error code 10000050, parameter1 e5d07a89, parameter2 00000000, parameter3 a5fee997, parameter4 00000001.
15/07/2010 10:09:00, error: NETLOGON [5719] - No Domain Controller is available for domain RICOH-EUROPE due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.
15/07/2010 10:07:20, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {D2B7A809-15DC-40B4-A1E1-C61EA97191DB} to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19). This security permission can be modified using the Component Services administrative tool.
14/07/2010 15:58:25, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Sophos Anti-Virus status reporter service to connect.
14/07/2010 15:58:25, error: Service Control Manager [7000] - The Sophos Anti-Virus status reporter service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
14/07/2010 11:58:12, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: No such service is known. The service cannot be found in the specified name space. (0x8007277C)

==== End Of File ===========================
spud101
2010-07-27, 12:27
MBRCheck, version 1.1.1

(c) 2010, AD



\\.\C: --> \\.\PhysicalDrive0



Size Device Name MBR Status

--------------------------------------------

74 GB \\.\PhysicalDrive0 Known-bad MBR code detected (Whistler / Black Internet)!





Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit:



Done! Press ENTER to exit...
spud101
2010-07-27, 12:29
Partition ID: Disk #0, Partition #0
Size: 180.39 MB

~~~~~~~~~~~~~~~~~~~~~~~~

Partition ID: Disk #0, Partition #1
Size: 74.35 GB

The computer boots from this partition.

~~~~~~~~~~~~~~~~~~~~~~~~

BIOS Manufacturer: Dell Inc.
Name: Phoenix ROM BIOS PLUS Version 1.10 A08
Status: OK

This is the primary BIOS.

~~~~~~~~~~~~~~~~~~~~~~~~
spud101
2010-07-27, 12:39
Do you have the Windows XP Installation disc?
No sorry.

Is the Recovery Console installed on your computer?
Yes.

Is this a business computer?
Not any more, it was an old one that was 'upgraded' so I got to keep it.
Jack&Jill
2010-07-27, 19:14
Hello spud101 :),

Your computer is infected with the Whistler Bootkit. Sorry for the bad news.

It affects the Master Boot Record (MBR), which is located at the first sector of your hard disk and executed for the computer to boot up. Due to your computer being an Original Equipment Manufacturer (OEM) machine, Dell in this case, and having a custom MBR, I will not be able to proceed further due to the possibility making it unbootable.

I suggest that you contact the manufacturer of your computer to assist you in this matter as they will be better equipped to deal with it, more efficiently and effectively. If you have any questions, please ask.
Jack&Jill
2010-07-30, 19:30
Hello spud101 :),

Sorry could not help you further. I see signs of ComboFix being used on your computer.

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.

Now, we need to clear off some of the tools I asked you to download and ComboFix.
Go to Start > Run.... Copy and paste the following text into the white box:
ComboFix /uninstall
Click OK.
Delete the MBRCheck and Preformat files from your desktop.

Some tips to help you stay clean and safe after you get the MBR issue sorted out:

1. Keep your Windows up to date. Enable Automatic Updates (http://www.bleepingcomputer.com/tutorials/tutorial35.html) to always update the latest security patches from Microsoft, or you can download from the Microsoft website. Otherwise, your computer will be vulnerable to new exploits or malwares.

2. Update your Antivirus program regularly, it is a must for constant protection against viruses. Please keep only one AV installed.

3. Install Malwarebytes' Anti-Malware if you haven't and use it occasionally. It is a new and powerful anti-malware tool (http://www.malwarebytes.org/mbam.php), totally free but for real-time protection you will have to pay a small one-time fee.

4. Install WinPatrol, a great protection program (http://www.winpatrol.com/) that helps you monitor for unwanted files or applications.

5. Use a hosts file to block the access of bad sites from your computer. Get yourself a MVPS Hosts (http://www.mvps.org/winhelp2002/hosts.htm) for this purpose.

6. Install Web of Trust (WOT). WOT (http://www.mywot.com/) keeps you from dangerous websites with warnings and blockings.

7. Protect your computer from removable or USB drive infections with Panda USB Vaccine (http://www.pandasecurity.com/homeusers/downloads/usbvaccine/), an effective method to prevent malware from spreading.

8. Keep all your softwares updated. Visit Secunia Software Inspector (http://secunia.com/software_inspector/) to find out if any updates required.

9. If you have been a victim of malware before, Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

10. Also look up How to prevent malware: By miekiemoes (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) and So how did I get infected in the first place? By Tony Klein (http://malwareremoval.com/forum/viewtopic.php?f=11&t=4959).

Stay safe.

--------------------

As we reach a point where we could not proceed further and you need to seek help from alternative sources, this topic is now closed.

We are glad to be of help up to this point. If you are satisfied with our assistance and wish to donate to help with the costs of this volunteer site, please read :
Your donation helps in improving Spybot-S&D! (http://www.safer-networking.org/en/donate/index.html)