Page 1 of 3 123 LastLast
Results 1 to 10 of 21

Thread: Virtumonde.prx Infection, Please Help

  1. #1
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default Virtumonde.prx Infection, Please Help

    I have a Virtumonde.prx infection that so far has eluded Spybot, Malwarebytes Anti-malware, Superantispyware and even Combo.fix.

    I have the following issues: Hardware Manager sees my printer (HP8450), Control Panel does not. I am unable to reinstall a printer. HP's online troubleshooting tool does not fix the problem. My CD and DVD-RW drives are seen twice by Windows, each device gets TWO drive letters. This has pushed my external data drive to a new letter, so shortcuts to music files are no good. Disk Management does not see anything so I am unable to reassign drive letters.

    System restore sees restore points, when when I attempt to use it, nothing happens.

    I also had a persistent Win32.TDSS.rtk infection that Combo.fix was able to remove yesterday.

    Here's my log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:28:19 PM, on 7/31/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
    C:\WINDOWS\system32\hphmon06.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {60BD0CDD-0924-405F-9411-85DBD3D8E9ED} - (no file)
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: (no name) - {D15446BA-50A4-4D18-B8D8-5C2BA567FE33} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Urebilim] rundll32.exe "C:\WINDOWS\iqapaqekojotohu.dll",g
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Registry Repair Wizard Scheduler] "C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe" /startup
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143432524859
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee Application Installer Cleanup (0070561247172847) (0070561247172847mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\007056~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 10280 bytes

  2. #2
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hello stoogetoconga

    Welcome to Safer Networking.

    Please read Before You Post
    That said, All advice given by anyone volunteering here, is taken at your own risk.
    While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

    First let me start off by asking, Malwarebytes, did you run it correctly? By not posting the log I have no idea what was and what was not removed. By not seeing the log , there may be clues to other malware thats not currently present on HJT.


    Combofix, this is a very powerful tool, what it fixes on one system it may damage another, this is not a general all purpose cleaning tool and should only be run with supervision. Did you run it correctly? What did it remove, what did it not remove, don't know, you did not post the log.




    C:\Program Files\SmartPCTools\Registry Repair Wizard <--This may or maynot be related to your problems. Are you a windows expert, are you a registry expert, if not why are you having this tool remove registry entries that you know nothing about.
    Read this please.
    http://miekiemoes.blogspot.com/2008/...eaking_13.html


    The reason for all the rant is because you have done so much on your own I have no idea what damage you have caused your system, its always best to post and wait for an expert to guide you though fixing your system.

    So now its back to square one. If your system is damaged from running a reg cleaner and Combofix on your own it may not be repairable.




    Do this first...Important

    Disable the TeaTimer, leave it disabled, do not turn it back on until we're done or it will prevent fixes from taking

    • Run Spybot-S&D in Advanced Mode.
    • If it is not already set to do this Go to the Mode menu select "Advanced Mode"
    • On the left hand side, Click on Tools
    • Then click on the Resident Icon in the List
    • Uncheck "Resident TeaTimer" and OK any prompts.
    • Restart your computer.<--You need to do this for it to take effect

    Please do not proceed until the TeaTimer is disabled





    Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

    O2 - BHO: (no name) - {60BD0CDD-0924-405F-9411-85DBD3D8E9ED} - (no file)
    O2 - BHO: (no name) - {D15446BA-50A4-4D18-B8D8-5C2BA567FE33} - (no file)
    O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)

    O4 - HKLM\..\Run: [Urebilim] rundll32.exe "C:\WINDOWS\iqapaqekojotohu.dll",g






    Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean





    Run Malwarebytes this way.

    Please download Malwarebytes' Anti-Malware to your desktop.

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected .
    • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
    Post the report and also a new HJT log please
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  3. #3
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default

    [QUOTE=ken545;325909]Hello stoogetoconga

    Welcome to Safer Networking.

    First let me start off by asking, Malwarebytes, did you run it correctly? By not posting the log I have no idea what was and what was not removed. By not seeing the log , there may be clues to other malware thats not currently present on HJT.


    I have been running Malwarebytes every few days for about six months on my PC, updating definitions each time. Mostly I run a Quick Scan, periodically I will run a full scan.

    Combofix, this is a very powerful tool, what it fixes on one system it may damage another, this is not a general all purpose cleaning tool and should only be run with supervision. Did you run it correctly? What did it remove, what did it not remove, don't know, you did not post the log.

    Sorry, I don't have a Combofix log (as far as I know). It removed Win32.TDSS.rtk.

    C:\Program Files\SmartPCTools\Registry Repair Wizard <--This may or maynot be related to your problems. Are you a windows expert, are you a registry expert, if not why are you having this tool remove registry entries that you know nothing about.
    Read this please.
    http://miekiemoes.blogspot.com/2008/...eaking_13.html

    The reason for all the rant is because you have done so much on your own I have no idea what damage you have caused your system, its always best to post and wait for an expert to guide you though fixing your system.

    So now its back to square one. If your system is damaged from running a reg cleaner and Combofix on your own it may not be repairable.


    All of the infections and hardware issues were present before I ran Combofix as well as the registry software.

    For the past several days, Malwarebytes has NOT detected Virtumonde.prx. Spybot Search and Destroy does detect it, I have the software remove it, but when I reboot, it returns. Here is my Malwarebytes log as requested.

    Malwarebytes' Anti-Malware 1.39
    Database version: 2548
    Windows 5.1.2600 Service Pack 2

    8/2/2009 7:06:59 PM
    mbam-log-2009-08-02 (19-06-59).txt

    Scan type: Quick Scan
    Objects scanned: 92977
    Time elapsed: 4 minute(s), 58 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    Also, as requested, here's my Hijack log.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:07:41 PM, on 8/2/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
    C:\WINDOWS\system32\hphmon06.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Registry Repair Wizard Scheduler] "C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe" /startup
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143432524859
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee Application Installer Cleanup (0070561247172847) (0070561247172847mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\007056~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 9414 bytes

    Ken545, lastly, I just checked Control Panel, and my CD and DVD-RW drives now have only one drive letter. Windows Disk management also sees both my hard drives. I did NOT reassign the drive letter for my external data drive, I thought it best to leave everything alone while taking your direction on working on a solution with you on this forum. Regrettably, however, Control panel still does not see an installed printer which is my biggest problem right now.

  4. #4
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    Once we determine that your system is clean I will direct you to some windows support sites that can help you with your windows issues..

    Let me ask you this, you have Mcafee installed but the uninstaller is running as a service, have you tried to remove Mcafee?

    Remove these with HJT.

    O2 - BHO: (no name) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - (no file)

    O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab




    C:\ComboFix.txt <-- The log should be here, if it still is copy and paste it for me to see please
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  5. #5
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default

    OK, two entries deleted with HijackThis.

    I have not attempted to remove McAfee. I use it primarily for the firewall. I have cable internet.

    Here's the Combo.fox log

    ComboFix 09-07-29.04 - GW 07/30/2009 20:33.1.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1599 [GMT -7:00]
    Running from: c:\documents and settings\GW\Desktop\ComboFix.exe
    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\GW\Application Data\Microsoft\Internet Explorer\Quick Launch\SUPERAntiSpyware Free Edition.lnk
    c:\program files\AskSearch\bin\DefaultSearch.dll
    c:\program files\Dealio Toolbar
    c:\program files\Dealio Toolbar\config.ini
    c:\program files\Dealio Toolbar\DealioToolbarIE.dll
    c:\program files\Dealio Toolbar\Res\amazon.gif
    c:\program files\Dealio Toolbar\Res\apple.gif
    c:\program files\Dealio Toolbar\Res\barnes.gif
    c:\program files\Dealio Toolbar\Res\bestbuy.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo.gif
    c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
    c:\program files\Dealio Toolbar\Res\ebay.gif
    c:\program files\Dealio Toolbar\Res\icon_settings.gif
    c:\program files\Dealio Toolbar\Res\macys.gif
    c:\program files\Dealio Toolbar\Res\newegg.gif
    c:\program files\Dealio Toolbar\Res\overstock.gif
    c:\program files\Dealio Toolbar\Res\search-button-hover.gif
    c:\program files\Dealio Toolbar\Res\search-button.gif
    c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
    c:\program files\Dealio Toolbar\Res\search-chevron.gif
    c:\program files\Dealio Toolbar\Res\search_amazon.gif
    c:\program files\Dealio Toolbar\Res\search_dealio.gif
    c:\program files\Dealio Toolbar\Res\search_ebay.gif
    c:\program files\Dealio Toolbar\Res\search_yahoo.gif
    c:\program files\Dealio Toolbar\Res\separator.gif
    c:\program files\Dealio Toolbar\Res\target.gif
    c:\program files\Dealio Toolbar\Res\walmart.gif
    c:\program files\Dealio Toolbar\Res\widgets.xml
    c:\program files\Dealio Toolbar\SearchSettingsKit.exe
    c:\program files\Dealio Toolbar\WidgiHelper.exe
    c:\program files\Search Settings
    c:\program files\Search Settings\kb128\SearchSettings.dll
    c:\program files\Search Settings\kb128\SearchSettingsRes409.dll
    c:\program files\Search Settings\SearchSettings.exe
    c:\windows\Downloaded Program Files\Quarantine
    c:\windows\Fonts\mlog
    c:\windows\Installer\30fa8a9.msi
    c:\windows\system32\Data
    c:\windows\system32\drivers\hjgruidmyodorg.sys
    c:\windows\system32\hjgruibelqcwje.dll
    c:\windows\system32\hjgruiiuspwsyc.dat
    c:\windows\system32\hjgruijbjmadtc.dll
    c:\windows\system32\hjgruijpkrpaty.dat
    c:\windows\system32\tmp.reg
    c:\windows\system32\UACrccxqkehngooplbow.db

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_hjgruijvrvekdn
    -------\Legacy_6TO4
    -------\Legacy_PCMSTUB
    -------\Service_6to4


    ((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-31 )))))))))))))))))))))))))))))))
    .

    2009-07-31 01:56 . 2009-07-31 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 -------- d-----w- c:\program files\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 -------- d-----w- c:\documents and settings\GW\Local Settings\Application Data\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 61224 ----a-w- c:\documents and settings\GW\GoToAssistDownloadHelper.exe
    2009-07-27 06:04 . 2009-07-27 06:04 -------- d-----w- c:\program files\SmartPCTools
    2009-07-26 03:25 . 2009-07-26 03:25 -------- d-----w- c:\program files\Lavalys
    2009-07-26 02:56 . 2009-07-26 02:56 -------- d-----w- c:\program files\Belarc
    2009-07-26 02:56 . 2008-03-06 18:51 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2009-07-25 19:05 . 2009-07-25 19:09 -------- d-----w- c:\temp\FixEngine
    2009-07-25 19:04 . 2009-07-25 19:04 10134 ----a-r- c:\documents and settings\GW\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
    2009-07-25 18:19 . 2009-06-29 16:12 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
    2009-07-25 18:19 . 2009-06-29 16:12 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-07-25 18:19 . 2009-06-29 16:12 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
    2009-07-25 18:19 . 2009-06-29 16:12 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
    2009-07-25 18:19 . 2009-06-29 16:12 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
    2009-07-25 18:19 . 2009-06-29 11:07 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
    2009-07-25 18:19 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
    2009-07-25 18:19 . 2009-07-19 13:32 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
    2009-07-25 17:57 . 2009-07-25 17:57 45056 ----a-r- c:\documents and settings\GW\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
    2009-07-25 17:55 . 2006-01-07 04:54 9505 ----a-w- c:\windows\system32\hphmon06.dat
    2009-07-25 04:43 . 2009-07-25 04:43 -------- d-----w- c:\program files\MSECache
    2009-07-25 03:20 . 2009-07-25 03:20 -------- d-----w- c:\documents and settings\GW\Application Data\avidemux
    2009-07-25 03:10 . 2009-07-25 03:11 -------- d-----w- c:\program files\Common Files\DivX Shared
    2009-07-14 04:55 . 2009-07-14 04:55 -------- d-----w- c:\windows\system32\NtmsData
    2009-07-12 02:11 . 2009-07-12 02:11 -------- d-----w- c:\program files\Common Files\DirectX
    2009-07-03 23:57 . 2009-07-03 23:57 -------- d-----w- C:\Music
    2009-07-03 17:59 . 2009-07-04 15:41 -------- d-----w- c:\program files\7-Zip
    2009-07-03 03:18 . 2009-07-03 03:18 737280 ----a-w- c:\windows\iun6002.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-07-31 03:47 . 2009-01-20 04:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-07-31 03:17 . 2006-03-08 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-07-31 03:13 . 2007-07-05 06:35 -------- d-----w- c:\program files\Windows Media Connect 2
    2009-07-29 14:01 . 2006-03-08 02:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-07-28 02:25 . 2009-03-24 05:23 117760 ----a-w- c:\documents and settings\GW\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2009-07-25 21:53 . 2006-03-22 23:34 67480 ----a-w- c:\documents and settings\GW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-07-25 19:04 . 2006-03-08 03:28 -------- d-----w- c:\program files\HP
    2009-07-25 17:58 . 2006-03-08 03:28 93426 ----a-w- c:\windows\HPHins03.dat
    2009-07-25 06:19 . 2006-03-07 23:12 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
    2009-07-25 03:11 . 2007-08-13 18:25 -------- d-----w- c:\program files\DivX
    2009-07-25 01:11 . 2009-03-20 01:14 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-07-14 01:14 . 2008-12-06 19:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-07-14 01:13 . 2009-01-20 05:46 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-07-13 20:36 . 2008-12-06 19:44 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-13 20:36 . 2008-12-06 19:44 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-07-13 06:55 . 2009-01-19 07:04 -------- d-----w- c:\program files\SUPERAntiSpyware
    2009-07-10 01:25 . 2006-07-29 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
    2009-07-09 20:53 . 2006-08-03 01:41 -------- d-----w- c:\program files\McAfee
    2009-07-05 06:31 . 2009-04-22 18:36 -------- d-----w- c:\program files\Songbird
    2009-06-29 16:12 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2004-08-04 12:00 17408 ------w- c:\windows\system32\corpol.dll
    2009-06-28 19:57 . 2009-06-28 17:23 -------- d-----w- c:\program files\Nircmd
    2009-06-28 17:17 . 2009-06-28 17:17 -------- d-----w- c:\documents and settings\GW\Application Data\Search Settings
    2009-06-28 17:17 . 2009-06-28 17:17 -------- d-----w- c:\documents and settings\GW\Application Data\Dealio
    2009-06-27 17:48 . 2009-06-27 17:48 -------- d-----w- c:\program files\Defraggler
    2009-06-19 11:13 . 2006-10-22 21:04 -------- d-----w- c:\documents and settings\GW\Application Data\DeepBurner
    2009-06-16 14:55 . 2004-08-04 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:55 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-12 05:14 . 2009-06-12 03:43 -------- d-----w- c:\program files\Garmin
    2009-06-12 05:13 . 2009-06-12 05:13 -------- d-----w- c:\documents and settings\All Users\Application Data\GARMIN
    2009-06-12 05:13 . 2009-06-12 03:43 -------- d-----w- c:\documents and settings\GW\Application Data\GARMIN
    2009-06-12 04:48 . 2009-06-12 03:58 -------- d-----w- c:\documents and settings\GW\Application Data\Download Manager
    2009-06-12 03:43 . 2009-06-12 03:43 -------- d-----w- c:\program files\Garmin GPS Plugin
    2009-06-12 03:43 . 2009-06-12 03:43 -------- d-----w- c:\program files\DIFX
    2009-06-03 19:27 . 2004-08-04 12:00 1290752 ----a-w- c:\windows\system32\quartz.dll
    2009-05-29 17:08 . 2009-05-29 17:08 390664 ----a-w- c:\documents and settings\GW\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
    2009-05-07 15:44 . 2004-08-04 12:00 344064 ----a-w- c:\windows\system32\localspl.dll
    2009-07-23 01:05 . 2008-09-15 01:24 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "Registry Repair Wizard Scheduler"="c:\program files\SmartPCTools\Registry Repair Wizard\RCHelper.exe" [2009-05-13 1052928]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]
    "HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2006-01-07 49152]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
    "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
    "HPHmon06"="c:\windows\system32\hphmon06.exe" [2006-01-07 659456]
    "DIGServices"="c:\program files\ESPNRunTime\DIGServices.exe" [2005-10-31 101888]
    "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-02 289576]
    "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-18 185896]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

    c:\documents and settings\GW\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-3-7 113664]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-1-1 91440]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-1-1 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 10:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "IDriverT"=3 (0x3)
    "Bonjour Service"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "%windir%\\system32\\drivers\\svchost.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [1/13/2008 3:52 PM 3026]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/15/2009 5:17 PM 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/15/2009 5:17 PM 55024]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [12/23/2008 8:13 PM 210216]
    R2 UdfJs;Jet Storage UDF;c:\windows\system32\drivers\jsudf.sys [11/22/2005 11:28 AM 241235]
    S2 0070561247172847mcinstcleanup;McAfee Application Installer Cleanup (0070561247172847);c:\windows\TEMP\007056~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\007056~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
    S3 CdrwJs;Jet Storage CDRW Driver;c:\windows\system32\drivers\jscdrw.sys [11/22/2005 11:28 AM 76800]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/15/2009 5:17 PM 7408]
    S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
    S3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter;c:\windows\system32\drivers\RTL8150.SYS [3/7/2006 5:19 PM 25983]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 20:34]

    2009-07-15 c:\windows\Tasks\McDefragTask.job
    - c:\windows\system32\defrag.exe [2004-08-04 12:00]

    2009-07-01 c:\windows\Tasks\McQcTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2006-08-03 18:53]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\DealioToolbarIE.dll
    BHO-{60BD0CDD-0924-405F-9411-85DBD3D8E9ED} - (no file)
    BHO-{D15446BA-50A4-4D18-B8D8-5C2BA567FE33} - (no file)
    BHO-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
    Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\Dealio Toolbar\DealioToolbarIE.dll
    HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe
    HKLM-Run-Urebilim - c:\windows\iqapaqekojotohu.dll


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    FF - ProfilePath - c:\documents and settings\GW\Application Data\Mozilla\Firefox\Profiles\lvl53xmx.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct=&gc=1&q=
    FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
    FF - plugin: c:\documents and settings\GW\Application Data\Mozilla\Firefox\Profiles\lvl53xmx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF - HiddenExtension: XUL Cache: {B59B3178-EE58-4679-8B3A-358226672929} - c:\documents and settings\GW\Local Settings\Application Data\{B59B3178-EE58-4679-8B3A-358226672929}\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-07-30 20:46
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(604)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\WININET.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll

    - - - - - - - > 'explorer.exe'(3752)
    c:\windows\system32\WININET.dll
    c:\program files\McAfee\SiteAdvisor\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\progra~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\Common Files\McAfee\MNA\McNASvc.exe
    c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
    c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\program files\McAfee\MSK\msksrver.exe
    c:\windows\system32\HPZipm12.exe
    c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\program files\McAfee\MPF\MpfSrv.exe
    .
    **************************************************************************
    .
    Completion time: 2009-07-31 20:53 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-07-31 03:52

    Pre-Run: 46,323,462,144 bytes free
    Post-Run: 46,198,702,080 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

  6. #6
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default

    I will also mention that in addition to the DVD-RW and CD drives restored to their proper drive letters, Spy Bot as well as Malwarebytes now do not report any infection. The only issue is with my system not recognizing the printer. We're getting close I hope!

  7. #7
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    You need to disable Mcafee and run this Combofix script, usually just right clicking Mcafee on the system tray will give you an option to disable it , upon reboot it will re enable itself, then you can open it and double check to make sure.

    Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::


    Code:
    File::
    c:\windows\system32\drivers\svchost.exe
    
    Registry::
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\drivers\\svchost.exe"=-
    Save this as CFScript to your desktop.

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  8. #8
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default

    Combo.fix:

    ComboFix 09-07-29.04 - GW 08/04/2009 6:38.2.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1554 [GMT -7:00]
    Running from: c:\documents and settings\GW\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\GW\Desktop\CFScript.txt
    AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    FILE ::
    "c:\windows\system32\drivers\svchost.exe"
    .

    ((((((((((((((((((((((((( Files Created from 2009-07-04 to 2009-08-04 )))))))))))))))))))))))))))))))
    .

    2009-08-03 01:12 . 2009-08-03 01:12 -------- d-----w- c:\documents and settings\All Users\Application Data\RoboForm
    2009-07-31 04:39 . 2009-07-31 04:54 -------- d-----w- c:\program files\trend micro
    2009-07-31 04:39 . 2009-07-31 04:39 -------- d-----w- C:\rsit
    2009-07-31 04:01 . 2009-07-31 04:00 410984 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-31 04:00 . 2009-07-31 04:00 -------- d-----w- c:\program files\Java
    2009-07-31 01:56 . 2009-07-31 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 -------- d-----w- c:\program files\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 -------- d-----w- c:\documents and settings\GW\Local Settings\Application Data\Citrix
    2009-07-31 01:36 . 2009-07-31 01:36 61224 ----a-w- c:\documents and settings\GW\GoToAssistDownloadHelper.exe
    2009-07-27 06:04 . 2009-07-27 06:04 -------- d-----w- c:\program files\SmartPCTools
    2009-07-26 03:25 . 2009-07-26 03:25 -------- d-----w- c:\program files\Lavalys
    2009-07-26 02:56 . 2009-07-26 02:56 -------- d-----w- c:\program files\Belarc
    2009-07-26 02:56 . 2008-03-06 18:51 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys
    2009-07-25 19:05 . 2009-07-25 19:09 -------- d-----w- c:\temp\FixEngine
    2009-07-25 19:04 . 2009-07-25 19:04 10134 ----a-r- c:\documents and settings\GW\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
    2009-07-25 18:19 . 2009-06-29 16:12 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
    2009-07-25 18:19 . 2009-06-29 16:12 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-07-25 18:19 . 2009-06-29 16:12 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
    2009-07-25 18:19 . 2009-06-29 16:12 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
    2009-07-25 18:19 . 2009-06-29 16:12 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
    2009-07-25 18:19 . 2009-06-29 11:07 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
    2009-07-25 18:19 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
    2009-07-25 18:19 . 2009-07-19 13:32 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
    2009-07-25 17:57 . 2009-07-25 17:57 45056 ----a-r- c:\documents and settings\GW\Application Data\Microsoft\Installer\{457791C5-D702-4143-A7B2-2744BE9573F2}\NewShortcut1_5B69D3033CA54B39B5ECE7D051297E77.exe
    2009-07-25 17:55 . 2006-01-07 04:54 9505 ----a-w- c:\windows\system32\hphmon06.dat
    2009-07-25 04:43 . 2009-07-25 04:43 -------- d-----w- c:\program files\MSECache
    2009-07-25 03:20 . 2009-07-25 03:20 -------- d-----w- c:\documents and settings\GW\Application Data\avidemux
    2009-07-25 03:10 . 2009-07-25 03:11 -------- d-----w- c:\program files\Common Files\DivX Shared
    2009-07-14 04:55 . 2009-08-03 02:28 -------- d-----w- c:\windows\system32\NtmsData
    2009-07-12 02:11 . 2009-07-12 02:11 -------- d-----w- c:\program files\Common Files\DirectX

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-03 01:59 . 2009-01-20 04:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-08-01 00:57 . 2009-03-20 01:14 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-07-31 04:12 . 2006-03-08 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-07-31 03:13 . 2007-07-05 06:35 -------- d-----w- c:\program files\Windows Media Connect 2
    2009-07-29 14:01 . 2006-03-08 02:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-07-28 02:25 . 2009-03-24 05:23 117760 ----a-w- c:\documents and settings\GW\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2009-07-25 21:53 . 2006-03-22 23:34 67480 ----a-w- c:\documents and settings\GW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-07-25 19:04 . 2006-03-08 03:28 -------- d-----w- c:\program files\HP
    2009-07-25 17:58 . 2006-03-08 03:28 93426 ----a-w- c:\windows\HPHins03.dat
    2009-07-25 06:19 . 2006-03-07 23:12 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
    2009-07-25 03:11 . 2007-08-13 18:25 -------- d-----w- c:\program files\DivX
    2009-07-14 01:14 . 2008-12-06 19:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-07-14 01:13 . 2009-01-20 05:46 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-07-13 20:36 . 2008-12-06 19:44 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-07-13 20:36 . 2008-12-06 19:44 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-07-13 06:55 . 2009-01-19 07:04 -------- d-----w- c:\program files\SUPERAntiSpyware
    2009-07-10 01:25 . 2006-07-29 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
    2009-07-09 20:53 . 2006-08-03 01:41 -------- d-----w- c:\program files\McAfee
    2009-07-05 06:31 . 2009-04-22 18:36 -------- d-----w- c:\program files\Songbird
    2009-07-03 03:18 . 2009-07-03 03:18 737280 ----a-w- c:\windows\iun6002.exe
    2009-07-03 01:27 . 2009-07-03 01:26 -------- d-----w- c:\program files\HJSplit
    2009-06-29 16:12 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2004-08-04 12:00 17408 ------w- c:\windows\system32\corpol.dll
    2009-06-28 19:57 . 2009-06-28 17:23 -------- d-----w- c:\program files\Nircmd
    2009-06-28 17:17 . 2009-06-28 17:17 -------- d-----w- c:\documents and settings\GW\Application Data\Search Settings
    2009-06-28 17:17 . 2009-06-28 17:17 -------- d-----w- c:\documents and settings\GW\Application Data\Dealio
    2009-06-27 17:48 . 2009-06-27 17:48 -------- d-----w- c:\program files\Defraggler
    2009-06-19 11:13 . 2006-10-22 21:04 -------- d-----w- c:\documents and settings\GW\Application Data\DeepBurner
    2009-06-16 14:55 . 2004-08-04 12:00 82432 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:55 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-12 05:14 . 2009-06-12 03:43 -------- d-----w- c:\program files\Garmin
    2009-06-12 05:13 . 2009-06-12 05:13 -------- d-----w- c:\documents and settings\All Users\Application Data\GARMIN
    2009-06-12 05:13 . 2009-06-12 03:43 -------- d-----w- c:\documents and settings\GW\Application Data\GARMIN
    2009-06-12 04:48 . 2009-06-12 03:58 -------- d-----w- c:\documents and settings\GW\Application Data\Download Manager
    2009-06-12 03:43 . 2009-06-12 03:43 -------- d-----w- c:\program files\Garmin GPS Plugin
    2009-06-12 03:43 . 2009-06-12 03:43 -------- d-----w- c:\program files\DIFX
    2009-06-03 19:27 . 2004-08-04 12:00 1290752 ----a-w- c:\windows\system32\quartz.dll
    2009-05-29 17:08 . 2009-05-29 17:08 390664 ----a-w- c:\documents and settings\GW\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
    2009-05-07 15:44 . 2004-08-04 12:00 344064 ----a-w- c:\windows\system32\localspl.dll
    2009-07-23 01:05 . 2008-09-15 01:24 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
    2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-07-31_03.47.27 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-03 01:58 . 2009-08-03 01:58 16384 c:\windows\Temp\Perflib_Perfdata_660.dat
    - 2006-03-07 23:31 . 2009-07-31 02:28 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2006-03-07 23:31 . 2009-08-04 11:41 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2006-03-07 23:31 . 2009-07-31 02:28 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2006-03-07 23:31 . 2009-08-04 11:41 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2009-07-31 04:01 . 2009-07-31 04:00 148888 c:\windows\system32\javaws.exe
    + 2009-07-31 04:01 . 2009-07-31 04:00 144792 c:\windows\system32\javaw.exe
    + 2009-07-31 04:01 . 2009-07-31 04:00 144792 c:\windows\system32\java.exe
    + 2009-07-31 04:00 . 2009-07-31 04:00 1563648 c:\windows\Installer\e1684.msi
    + 2009-07-31 12:00 . 2009-07-31 12:00 15705600 c:\windows\Installer\1b5bdac.msp
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "Registry Repair Wizard Scheduler"="c:\program files\SmartPCTools\Registry Repair Wizard\RCHelper.exe" [2009-05-13 1052928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]
    "HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2006-01-07 49152]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
    "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
    "HPHmon06"="c:\windows\system32\hphmon06.exe" [2006-01-07 659456]
    "DIGServices"="c:\program files\ESPNRunTime\DIGServices.exe" [2005-10-31 101888]
    "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-02 289576]
    "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-01-09 1176808]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-18 185896]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 148888]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-02-29 76304]

    c:\documents and settings\GW\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-3-7 113664]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\digital imaging\bin\hpqtra08.exe [2004-5-28 241664]
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-1-1 91440]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-1-1 805392]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 10:42 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "IDriverT"=3 (0x3)
    "Bonjour Service"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [1/13/2008 3:52 PM 3026]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/15/2009 5:17 PM 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/15/2009 5:17 PM 55024]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [12/23/2008 8:13 PM 210216]
    R2 UdfJs;Jet Storage UDF;c:\windows\system32\drivers\jsudf.sys [11/22/2005 11:28 AM 241235]
    S2 0070561247172847mcinstcleanup;McAfee Application Installer Cleanup (0070561247172847);c:\windows\TEMP\007056~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\007056~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
    S3 CdrwJs;Jet Storage CDRW Driver;c:\windows\system32\drivers\jscdrw.sys [11/22/2005 11:28 AM 76800]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/15/2009 5:17 PM 7408]
    S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
    S3 USB-100;Realtek RTL8150 USB 10/100 Fast Ethernet Adapter;c:\windows\system32\drivers\RTL8150.SYS [3/7/2006 5:19 PM 25983]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-07-24 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 20:34]

    2009-07-15 c:\windows\Tasks\McDefragTask.job
    - c:\windows\system32\defrag.exe [2004-08-04 12:00]

    2009-08-01 c:\windows\Tasks\McQcTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2006-08-03 18:53]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    FF - ProfilePath - c:\documents and settings\GW\Application Data\Mozilla\Firefox\Profiles\lvl53xmx.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13161&gct=&gc=1&q=
    FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
    FF - plugin: c:\documents and settings\GW\Application Data\Mozilla\Firefox\Profiles\lvl53xmx.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF - HiddenExtension: XUL Cache: {B59B3178-EE58-4679-8B3A-358226672929} - c:\documents and settings\GW\Local Settings\Application Data\{B59B3178-EE58-4679-8B3A-358226672929}\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-04 06:46
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(600)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\WININET.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll

    - - - - - - - > 'explorer.exe'(1824)
    c:\windows\system32\WININET.dll
    c:\program files\McAfee\SiteAdvisor\saHook.dll
    c:\program files\Logitech\SetPoint\lgscroll.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2009-08-04 6:49
    ComboFix-quarantined-files.txt 2009-08-04 13:49
    ComboFix2.txt 2009-07-31 03:53

    Pre-Run: 45,886,578,688 bytes free
    Post-Run: 45,846,073,344 bytes free



    HiJackthis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:08:30 PM, on 8/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\program files\common files\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\hphmon06.exe
    C:\Program Files\ESPNRunTime\DIGServices.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\trend micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
    O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Registry Repair Wizard Scheduler] "C:\Program Files\SmartPCTools\Registry Repair Wizard\RCHelper.exe" /startup
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1143432524859
    O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: McAfee Application Installer Cleanup (0070561247172847) (0070561247172847mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\007056~1.EXE (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
    O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    --
    End of file - 9383 bytes

  9. #9
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Good Morning,

    Logs are looking good.

    You can fix this with HJT
    O23 - Service: McAfee Application Installer Cleanup (0070561247172847) (0070561247172847mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\007056~1.EXE (file missing)

    How are things running now??
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  10. #10
    Junior Member
    Join Date
    Aug 2009
    Location
    Seattle, WA
    Posts
    11

    Default

    The PC seems fine except that I still do not have access to my printer. This problem first appeared when the PC was infected, it did not occur during or after cleaning. HP's online troubleshooter doesn't solve the problem. I am unable to reinstall the printer; I have the original install CD and when prompted, Windows install wizard doesn't recognize the files on the CD. Trying a version of the software downloaded from HP's website, the install sees the printer device but cannot complete the install. I can't uninstall the printer because Control Panel doesn't recognize it as being installed. The printer is connected via USB cable and my other USB devices (mouse, ipod, camera port, external hard drive) all work as they should. The printer was fully operational before the virus infections (Virtumonde.prx and Win32.TDSS.rtk).

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •