Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 28

Thread: Cannot remove Click.GiftLoad

  1. #11
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully first.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  2. #12
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    Combofix detected a rootkit, rebooted and then continued to run to completion. Here is the log:


    ComboFix 11-05-04.02 - Firstname Lastname 05/04/2011 22:42:40.2.4 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2750 [GMT -4:00]
    Running from: c:\documents and settings\Firstname Lastname\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-05 to 2011-05-05 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-03 03:34 . 2011-05-03 03:34 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Temp
    2011-05-03 03:34 . 2011-05-03 03:34 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-05-01 06:01 . 2011-05-01 06:01 -------- d-----w- c:\program files\ESET
    2011-05-01 05:57 . 2011-05-01 05:57 -------- d-----w- c:\program files\CCleaner
    2011-04-28 02:51 . 2011-04-28 02:51 -------- d-----w- c:\program files\ERUNT
    2011-04-25 04:12 . 2011-04-25 04:12 -------- d-----w- c:\documents and settings\Administrator.XPS630
    2011-04-21 02:48 . 2011-04-21 02:48 -------- d-----w- c:\documents and settings\temporary
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-04-19 03:55 . 2011-05-01 05:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2011-04-19 03:55 . 2011-04-19 04:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\program files\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\NCH Software
    2011-04-17 21:45 . 2011-04-17 21:45 -------- d-----w- C:\output media
    2011-04-17 21:44 . 2011-04-17 21:45 -------- d-----w- c:\program files\Free Convert to DIVX AVI WMV MP4 MPEG Converter
    2011-04-17 21:44 . 2007-09-04 16:56 164352 ----a-w- c:\windows\system32\unrar.dll
    2011-04-17 21:44 . 2008-07-04 06:34 860160 ----a-w- c:\windows\system32\lameACM.acm
    2011-04-17 21:44 . 2007-09-21 00:52 118784 ----a-w- c:\windows\system32\ac3acm.acm
    2011-04-17 21:44 . 2008-05-30 23:22 683520 ----a-w- c:\windows\system32\divx.dll
    2011-04-17 21:44 . 2008-05-22 22:22 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
    2011-04-17 21:44 . 2008-05-22 22:19 81920 ----a-w- c:\windows\system32\dpl100.dll
    2011-04-17 21:44 . 2008-01-10 12:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-04-17 21:44 . 2008-01-10 12:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
    2011-04-17 21:44 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
    2011-04-17 21:44 . 2011-04-17 21:44 -------- d-----w- c:\program files\K-Lite Codec Pack
    2011-04-17 21:44 . 2008-06-12 18:36 7680 ----a-w- c:\windows\system32\ff_vfw.dll
    2011-04-17 21:07 . 2011-04-17 21:09 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\HandBrake
    2011-04-17 21:07 . 2011-04-17 21:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Local Settings\Application Data\HandBrake
    2011-04-17 21:06 . 2011-04-17 21:06 -------- d-----w- c:\program files\Handbrake
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\Malwarebytes
    2011-04-17 19:07 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-17 19:07 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-09 00:43 . 2011-04-09 00:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
    2011-04-07 04:25 . 2011-04-07 04:25 -------- d-----w- c:\program files\MSECache
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-25 23:48 . 2011-03-25 23:48 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    2011-02-22 11:41 . 2004-08-04 10:00 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-09 13:53 . 2004-08-04 10:00 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-04 10:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2008-08-16 22:42 . 2008-08-16 22:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 22:42 . 2008-08-16 22:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 22:42 . 2008-08-16 22:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 22:42 . 2008-08-16 22:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 22:43 . 2008-08-16 22:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 22:42 . 2008-08-16 22:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 22:42 . 2008-08-16 22:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 13:41 . 2008-05-21 13:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 18:58 . 2008-06-05 18:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 22:42 . 2008-08-16 22:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    2010-10-14 03:28 . 2010-12-15 03:40 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-05-01_05.43.55 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-05-05 02:40 . 2011-05-05 02:40 16384 c:\windows\Temp\Perflib_Perfdata_578.dat
    + 2011-05-05 02:41 . 2011-05-05 02:41 16384 c:\windows\Temp\Perflib_Perfdata_3a8.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2010-12-05 14:17 . 2011-05-05 00:37 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2010-12-05 14:17 . 2011-05-05 00:37 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2011-05-01 07:19 . 2011-05-05 00:37 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2010-12-22 05:57 . 2011-05-01 05:57 274432 c:\windows\system32\config\systemprofile\ntuser.dat
    - 2010-12-22 05:57 . 2010-12-22 05:57 274432 c:\windows\system32\config\systemprofile\ntuser.dat
    + 2011-05-04 05:46 . 2011-05-04 05:46 344064 c:\windows\ERDNT\AutoBackup\5-4-2011\Users\00000002\UsrClass.dat
    + 2011-05-04 05:46 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-4-2011\ERDNT.EXE
    + 2011-05-04 00:09 . 2011-05-04 00:09 344064 c:\windows\ERDNT\AutoBackup\5-3-2011\Users\00000002\UsrClass.dat
    + 2011-05-04 00:09 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-3-2011\ERDNT.EXE
    + 2011-05-02 04:04 . 2011-05-02 04:04 344064 c:\windows\ERDNT\AutoBackup\5-2-2011\Users\00000002\UsrClass.dat
    + 2011-05-02 04:04 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-2-2011\ERDNT.EXE
    + 2011-05-04 05:46 . 2011-05-04 05:46 3538944 c:\windows\ERDNT\AutoBackup\5-4-2011\Users\00000001\ntuser.dat
    + 2011-05-04 00:09 . 2011-05-04 00:09 3538944 c:\windows\ERDNT\AutoBackup\5-3-2011\Users\00000001\ntuser.dat
    + 2011-05-02 04:04 . 2011-05-02 04:04 3538944 c:\windows\ERDNT\AutoBackup\5-2-2011\Users\00000001\ntuser.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
    @="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
    [HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
    @="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
    [HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2007-10-26 184352]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
    "TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]
    "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
    "nwiz"="nwiz.exe" [2009-01-15 1657376]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    .
    c:\documents and settings\Firstname Lastname\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2003-10-14 299008]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
    Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-7-1 24576]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
    MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2011-2-8 3600184]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    .
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [12/14/2010 12:55 AM 84072]
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [9/6/2010 3:19 AM 169408]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [12/14/2010 12:55 AM 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [12/14/2010 12:43 AM 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [12/14/2010 12:55 AM 55840]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [12/14/2010 12:55 AM 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
    S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [12/14/2010 12:55 AM 84264]
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-04 c:\windows\Tasks\AdobeAAMUpdater-1.0-XPS630-FirstnameLastname.job
    - c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-29 06:25]
    .
    2011-05-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003Core.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-05-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003UA.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-04-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-18 c:\windows\Tasks\prismSevenDays.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    2011-04-18 c:\windows\Tasks\prismShakeIcon.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Trusted Zone: intuit.com\ttlc
    DPF: {18350088-453C-4407-87ED-361E70FD3285} - hxxps://relativity.idiscoverysolutions.com/Relativity/ActiveX/webclientmanager.cab
    FF - ProfilePath - c:\documents and settings\Firstname Lastname\Application Data\Mozilla\Firefox\Profiles\tuvotr3n.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-04 22:58
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(1140)
    c:\windows\system32\WININET.dll
    c:\windows\system32\sxs.dll
    .
    - - - - - - - > 'lsass.exe'(1200)
    c:\windows\system32\WININET.dll
    .
    Completion time: 2011-05-04 23:08:31
    ComboFix-quarantined-files.txt 2011-05-05 03:08
    ComboFix2.txt 2011-05-01 05:54
    .
    Pre-Run: 619,833,913,344 bytes free
    Post-Run: 620,300,697,600 bytes free
    .
    - - End Of File - - 96E1251BB4400343E18FBDD76EC46E82

  3. #13
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    New DDS Log and attach.txt attached. I ran DDS right after Combofix and without restarting.

    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Firstname Lastname at 23:28:30.84 on Wed 05/04/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2304 [GMT -4:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    C:\WINDOWS\system32\mfevtps.exe
    C:\Program Files\MozyHome\mozybackup.exe
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Firstname Lastname\My Documents\Downloads\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local;<local>
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20101214224034.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [StatusClient] c:\program files\hewlett-packard\toolbox2.0\apache tomcat 4.0\webapps\toolbox\statusclient\StatusClient.exe /auto
    mRun: [TomcatStartup] c:\program files\hewlett-packard\toolbox2.0\hpbpsttp.exe
    mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
    mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    StartupFolder: c:\docume~1\brenda~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\brenda~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\HOTSYNC.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\datavi~1.lnk - c:\windows\dvzcommon\DvzMsgr.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mozyho~1.lnk - c:\program files\mozyhome\mozystat.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    Trusted Zone: intuit.com\ttlc
    DPF: {18350088-453C-4407-87ED-361E70FD3285} - hxxps://relativity.idiscoverysolutions.com/Relativity/ActiveX/webclientmanager.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\brenda~1\applic~1\mozilla\firefox\profiles\tuvotr3n.default\
    FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
    FF - plugin: c:\documents and settings\Firstname Lastname\local settings\application data\google\update\1.3.21.53\npGoogleUpdate3.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\mcafee\SiteAdvisor
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-12-14 386840]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-12-14 84072]
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\adobe\elements 9 organizer\PhotoshopElementsFileAgent.exe [2010-9-6 169408]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-12-14 171168]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-12-14 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-12-14 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-12-14 55840]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-12-14 152960]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-12-14 52104]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-12-14 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-12-14 88544]
    S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
    S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-12-14 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-12-14 84264]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-12-14 33832]
    S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-12-14 40488]
    .
    =============== Created Last 30 ================
    .
    2011-05-01 06:01:34 -------- d-----w- c:\program files\ESET
    2011-05-01 05:57:51 -------- d-----w- c:\program files\CCleaner
    2011-05-01 05:28:19 -------- d-sha-r- C:\cmdcons
    2011-05-01 05:23:37 98816 ----a-w- c:\windows\sed.exe
    2011-05-01 05:23:37 89088 ----a-w- c:\windows\MBR.exe
    2011-05-01 05:23:37 256512 ----a-w- c:\windows\PEV.exe
    2011-05-01 05:23:37 161792 ----a-w- c:\windows\SWREG.exe
    2011-04-19 03:55:32 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-19 03:55:32 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2011-04-17 21:50:20 -------- d-----w- c:\program files\NCH Software
    2011-04-17 21:50:18 -------- d-----w- c:\docume~1\brenda~1\applic~1\NCH Software
    2011-04-17 21:45:33 -------- d-----w- C:\output media
    2011-04-17 21:44:45 -------- d-----w- c:\program files\Free Convert to DIVX AVI WMV MP4 MPEG Converter
    2011-04-17 21:44:31 164352 ----a-w- c:\windows\system32\unrar.dll
    2011-04-17 21:44:30 860160 ----a-w- c:\windows\system32\lameACM.acm
    2011-04-17 21:44:30 118784 ----a-w- c:\windows\system32\ac3acm.acm
    2011-04-17 21:44:29 81920 ----a-w- c:\windows\system32\dpl100.dll
    2011-04-17 21:44:29 755027 ----a-w- c:\windows\system32\xvidcore.dll
    2011-04-17 21:44:29 683520 ----a-w- c:\windows\system32\divx.dll
    2011-04-17 21:44:29 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
    2011-04-17 21:44:29 217088 ----a-w- c:\windows\system32\yv12vfw.dll
    2011-04-17 21:44:29 159839 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-04-17 21:44:28 7680 ----a-w- c:\windows\system32\ff_vfw.dll
    2011-04-17 21:44:28 -------- d-----w- c:\program files\K-Lite Codec Pack
    2011-04-17 21:07:02 -------- d-----w- c:\docume~1\brenda~1\locals~1\applic~1\HandBrake
    2011-04-17 21:07:02 -------- d-----w- c:\docume~1\brenda~1\applic~1\HandBrake
    2011-04-17 21:06:51 -------- d-----w- c:\program files\Handbrake
    2011-04-17 19:07:51 -------- d-----w- c:\docume~1\brenda~1\applic~1\Malwarebytes
    2011-04-17 19:07:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-17 19:07:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-04-17 19:07:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-17 19:07:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-17 14:54:36 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-04-17 14:54:36 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-04-17 01:53:48 0 ----a-w- c:\windows\Cqinilaquvacaxo.bin
    2011-04-07 04:25:26 -------- d-----w- c:\program files\MSECache
    .
    ==================== Find3M ====================
    .
    2011-03-25 23:48:06 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    .
    ============= FINISH: 23:29:44.03 ===============

  4. #14
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    Please post contents of ComboFix2.txt file (it should be in c:\qoobox or c:\combofix folder).
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #15
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    Here it is. Thank you for your help!

    ComboFix 11-04-30.03 - Firstname Lastname 05/01/2011 1:31.1.4 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.1898 [GMT -4:00]
    Running from: c:\documents and settings\Firstname Lastname\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Firstname Lastname\g2mdlhlpx.exe
    c:\documents and settings\Firstname Lastname\Local Settings\Application Data\{44C54CD9-6D74-49E1-8D68-B6A23E439D62}
    c:\documents and settings\Firstname Lastname\Local Settings\Application Data\{44C54CD9-6D74-49E1-8D68-B6A23E439D62}\chrome\content\_cfg.js
    c:\documents and settings\Firstname Lastname\Local Settings\Application Data\{44C54CD9-6D74-49E1-8D68-B6A23E439D62}\chrome\content\overlay.xul
    c:\documents and settings\Firstname Lastname\Local Settings\Application Data\{44C54CD9-6D74-49E1-8D68-B6A23E439D62}\install.rdf
    c:\documents and settings\Gateway My Documents\IP Litigation .doc
    c:\documents and settings\Gateway My Documents\winamp1666.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-01 to 2011-05-01 )))))))))))))))))))))))))))))))
    .
    .
    2011-04-28 02:51 . 2011-04-28 02:51 -------- d-----w- c:\program files\ERUNT
    2011-04-25 04:12 . 2011-04-25 04:12 -------- d-----w- c:\documents and settings\Administrator.XPS630
    2011-04-21 02:48 . 2011-04-21 02:48 -------- d-----w- c:\documents and settings\temporary
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-04-19 03:55 . 2011-04-19 04:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2011-04-19 03:55 . 2011-04-19 04:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\program files\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\NCH Software
    2011-04-17 21:45 . 2011-04-17 21:45 -------- d-----w- C:\output media
    2011-04-17 21:44 . 2011-04-17 21:45 -------- d-----w- c:\program files\Free Convert to DIVX AVI WMV MP4 MPEG Converter
    2011-04-17 21:44 . 2007-09-04 16:56 164352 ----a-w- c:\windows\system32\unrar.dll
    2011-04-17 21:44 . 2008-07-04 06:34 860160 ----a-w- c:\windows\system32\lameACM.acm
    2011-04-17 21:44 . 2007-09-21 00:52 118784 ----a-w- c:\windows\system32\ac3acm.acm
    2011-04-17 21:44 . 2008-05-30 23:22 683520 ----a-w- c:\windows\system32\divx.dll
    2011-04-17 21:44 . 2008-05-22 22:22 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
    2011-04-17 21:44 . 2008-05-22 22:19 81920 ----a-w- c:\windows\system32\dpl100.dll
    2011-04-17 21:44 . 2008-01-10 12:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-04-17 21:44 . 2008-01-10 12:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
    2011-04-17 21:44 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
    2011-04-17 21:44 . 2011-04-17 21:44 -------- d-----w- c:\program files\K-Lite Codec Pack
    2011-04-17 21:44 . 2008-06-12 18:36 7680 ----a-w- c:\windows\system32\ff_vfw.dll
    2011-04-17 21:07 . 2011-04-17 21:09 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\HandBrake
    2011-04-17 21:07 . 2011-04-17 21:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Local Settings\Application Data\HandBrake
    2011-04-17 21:06 . 2011-04-17 21:06 -------- d-----w- c:\program files\Handbrake
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\Malwarebytes
    2011-04-17 19:07 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-17 19:07 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-09 00:43 . 2011-04-09 00:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
    2011-04-07 04:25 . 2011-04-07 04:25 -------- d-----w- c:\program files\MSECache
    2011-04-01 06:45 . 2011-04-01 06:46 -------- d-----w- c:\documents and settings\Firstname Lastname\Local Settings\Application Data\ManyCam
    2011-04-01 06:44 . 2011-04-01 06:45 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\ManyCam
    2011-04-01 06:44 . 2011-04-01 06:44 -------- d-----w- c:\program files\ManyCam
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-03-25 23:48 . 2011-03-25 23:48 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    2011-02-22 11:41 . 2004-08-04 10:00 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-09 13:53 . 2004-08-04 10:00 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-04 10:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58 . 2010-12-05 14:11 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2008-08-16 22:42 . 2008-08-16 22:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 22:42 . 2008-08-16 22:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 22:42 . 2008-08-16 22:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 22:42 . 2008-08-16 22:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 22:43 . 2008-08-16 22:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 22:42 . 2008-08-16 22:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 22:42 . 2008-08-16 22:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 13:41 . 2008-05-21 13:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 18:58 . 2008-06-05 18:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 22:42 . 2008-08-16 22:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    2010-10-14 03:28 . 2010-12-15 03:40 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
    @="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
    [HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
    @="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
    [HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2007-10-26 184352]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
    "TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]
    "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
    "nwiz"="nwiz.exe" [2009-01-15 1657376]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    .
    c:\documents and settings\Firstname Lastname\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2003-10-14 299008]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
    Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-7-1 24576]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
    MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2011-2-8 3600184]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    .
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [12/14/2010 12:55 AM 84072]
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [9/6/2010 3:19 AM 169408]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [12/14/2010 12:55 AM 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [12/14/2010 12:43 AM 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [12/14/2010 12:55 AM 55840]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [12/14/2010 12:55 AM 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
    S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [12/14/2010 12:55 AM 84264]
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-25 c:\windows\Tasks\AdobeAAMUpdater-1.0-XPS630-FirstnameLastname.job
    - c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-29 06:25]
    .
    2011-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003Core.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-04-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003UA.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-04-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-18 c:\windows\Tasks\prismSevenDays.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    2011-04-18 c:\windows\Tasks\prismShakeIcon.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Trusted Zone: intuit.com\ttlc
    DPF: {18350088-453C-4407-87ED-361E70FD3285} - hxxps://relativity.idiscoverysolutions.com/Relativity/ActiveX/webclientmanager.cab
    FF - ProfilePath - c:\documents and settings\Firstname Lastname\Application Data\Mozilla\Firefox\Profiles\tuvotr3n.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
    .
    - - - - ORPHANS REMOVED - - - -
    .
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-01 01:43
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(1128)
    c:\windows\system32\WININET.dll
    .
    - - - - - - - > 'lsass.exe'(1188)
    c:\windows\system32\WININET.dll
    .
    Completion time: 2011-05-01 01:54:03
    ComboFix-quarantined-files.txt 2011-05-01 05:53
    .
    Pre-Run: 619,626,549,248 bytes free
    Post-Run: 620,168,044,544 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - 2E48C8546F81245EC398A4437BF198A4

  6. #16
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again,


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    File::
    c:\windows\Cqinilaquvacaxo.bin

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 25.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u25-windows-i586-p.exe to install the newest version. Uncheck Carbonite online backup trial if it's offered there.



    Run ESET Online scanner. Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #17
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    I updated Java and ran ComboFix with the script you provided. It asked to be updated to the latest version and I did. A restart was prompted and took several tries to work, as the computer often doesn't fully boot to Windows desktop icons. It did eventually complete, however, and here is the log:

    ComboFix 11-05-06.03 - Firstname Lastname 05/06/2011 22:59:40.3.4 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2754 [GMT -4:00]
    Running from: c:\documents and settings\Firstname Lastname\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Firstname Lastname\Desktop\CFScript.txt
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
    .
    PEV Error: AppFolder
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-07 to 2011-05-07 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-07 00:41 . 2011-05-07 00:41 -------- d-----w- c:\program files\Common Files\Java
    2011-05-03 03:34 . 2011-05-03 03:34 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Temp
    2011-05-03 03:34 . 2011-05-03 03:34 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
    2011-05-01 06:01 . 2011-05-01 06:01 -------- d-----w- c:\program files\ESET
    2011-05-01 05:57 . 2011-05-01 05:57 -------- d-----w- c:\program files\CCleaner
    2011-04-28 02:51 . 2011-04-28 02:51 -------- d-----w- c:\program files\ERUNT
    2011-04-25 04:12 . 2011-04-25 04:12 -------- d-----w- c:\documents and settings\Administrator.XPS630
    2011-04-21 02:48 . 2011-04-21 02:48 -------- d-----w- c:\documents and settings\temporary
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
    2011-04-19 13:53 . 2011-04-19 13:53 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-04-19 03:55 . 2011-05-01 05:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2011-04-19 03:55 . 2011-04-19 04:20 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\program files\NCH Software
    2011-04-17 21:50 . 2011-04-17 21:50 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\NCH Software
    2011-04-17 21:45 . 2011-04-17 21:45 -------- d-----w- C:\output media
    2011-04-17 21:44 . 2011-04-17 21:45 -------- d-----w- c:\program files\Free Convert to DIVX AVI WMV MP4 MPEG Converter
    2011-04-17 21:44 . 2007-09-04 16:56 164352 ----a-w- c:\windows\system32\unrar.dll
    2011-04-17 21:44 . 2008-07-04 06:34 860160 ----a-w- c:\windows\system32\lameACM.acm
    2011-04-17 21:44 . 2007-09-21 00:52 118784 ----a-w- c:\windows\system32\ac3acm.acm
    2011-04-17 21:44 . 2008-05-30 23:22 683520 ----a-w- c:\windows\system32\divx.dll
    2011-04-17 21:44 . 2008-05-22 22:22 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
    2011-04-17 21:44 . 2008-05-22 22:19 81920 ----a-w- c:\windows\system32\dpl100.dll
    2011-04-17 21:44 . 2008-01-10 12:16 159839 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-04-17 21:44 . 2008-01-10 12:15 755027 ----a-w- c:\windows\system32\xvidcore.dll
    2011-04-17 21:44 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
    2011-04-17 21:44 . 2011-04-17 21:44 -------- d-----w- c:\program files\K-Lite Codec Pack
    2011-04-17 21:44 . 2008-06-12 18:36 7680 ----a-w- c:\windows\system32\ff_vfw.dll
    2011-04-17 21:07 . 2011-04-17 21:09 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\HandBrake
    2011-04-17 21:07 . 2011-04-17 21:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Local Settings\Application Data\HandBrake
    2011-04-17 21:06 . 2011-04-17 21:06 -------- d-----w- c:\program files\Handbrake
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\Firstname Lastname\Application Data\Malwarebytes
    2011-04-17 19:07 . 2010-12-20 22:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-04-17 19:07 . 2011-04-17 19:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-17 19:07 . 2010-12-20 22:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-09 00:43 . 2011-04-09 00:43 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
    2011-04-07 04:25 . 2011-04-07 04:25 -------- d-----w- c:\program files\MSECache
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-14 09:07 . 2011-01-17 18:58 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-04-14 06:40 . 2011-01-17 18:58 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-03-25 23:48 . 2011-03-25 23:48 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    2011-02-22 11:41 . 2004-08-04 10:00 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-09 13:53 . 2004-08-04 10:00 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53 . 2004-08-04 10:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2008-08-16 22:42 . 2008-08-16 22:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2008-08-16 22:42 . 2008-08-16 22:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2008-08-16 22:42 . 2008-08-16 22:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2008-08-16 22:42 . 2008-08-16 22:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2008-08-16 22:43 . 2008-08-16 22:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2008-08-16 22:42 . 2008-08-16 22:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2008-08-16 22:42 . 2008-08-16 22:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2008-05-21 13:41 . 2008-05-21 13:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
    2008-05-21 13:41 . 2008-05-21 13:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
    2008-06-05 18:58 . 2008-06-05 18:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2008-08-16 22:42 . 2008-08-16 22:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    2010-10-14 03:28 . 2010-12-15 03:40 24376 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-05-01_05.43.55 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2011-05-07 02:56 . 2011-05-07 02:56 16384 c:\windows\Temp\Perflib_Perfdata_5e4.dat
    + 2011-05-07 02:56 . 2011-05-07 02:56 16384 c:\windows\Temp\Perflib_Perfdata_3c8.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2010-12-05 14:17 . 2011-05-07 02:32 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2010-12-05 14:17 . 2011-05-07 02:32 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2010-12-05 14:17 . 2011-05-01 01:49 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2011-05-07 02:29 . 2011-05-07 02:32 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2011-05-07 00:41 . 2011-04-14 09:08 157472 c:\windows\system32\javaws.exe
    + 2011-05-07 00:41 . 2011-04-14 09:08 145184 c:\windows\system32\javaw.exe
    - 2011-01-17 18:58 . 2011-01-17 18:58 145184 c:\windows\system32\javaw.exe
    + 2011-05-07 00:41 . 2011-04-14 09:08 145184 c:\windows\system32\java.exe
    - 2011-01-17 18:58 . 2011-01-17 18:58 145184 c:\windows\system32\java.exe
    - 2010-12-22 05:57 . 2010-12-22 05:57 274432 c:\windows\system32\config\systemprofile\ntuser.dat
    + 2010-12-22 05:57 . 2011-05-01 05:57 274432 c:\windows\system32\config\systemprofile\ntuser.dat
    + 2011-05-07 00:41 . 2011-05-07 00:41 180224 c:\windows\Installer\5007b.msi
    + 2011-05-07 00:35 . 2011-05-07 00:35 344064 c:\windows\ERDNT\AutoBackup\5-6-2011\Users\00000002\UsrClass.dat
    + 2011-05-07 00:35 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-6-2011\ERDNT.EXE
    + 2011-05-06 00:41 . 2011-05-06 00:41 344064 c:\windows\ERDNT\AutoBackup\5-5-2011\Users\00000002\UsrClass.dat
    + 2011-05-06 00:41 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-5-2011\ERDNT.EXE
    + 2011-05-04 05:46 . 2011-05-04 05:46 344064 c:\windows\ERDNT\AutoBackup\5-4-2011\Users\00000002\UsrClass.dat
    + 2011-05-04 05:46 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-4-2011\ERDNT.EXE
    + 2011-05-04 00:09 . 2011-05-04 00:09 344064 c:\windows\ERDNT\AutoBackup\5-3-2011\Users\00000002\UsrClass.dat
    + 2011-05-04 00:09 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-3-2011\ERDNT.EXE
    + 2011-05-02 04:04 . 2011-05-02 04:04 344064 c:\windows\ERDNT\AutoBackup\5-2-2011\Users\00000002\UsrClass.dat
    + 2011-05-02 04:04 . 2005-10-20 16:02 163328 c:\windows\ERDNT\AutoBackup\5-2-2011\ERDNT.EXE
    + 2011-05-07 00:35 . 2011-05-07 00:35 3538944 c:\windows\ERDNT\AutoBackup\5-6-2011\Users\00000001\ntuser.dat
    + 2011-05-06 00:41 . 2011-05-06 00:41 3538944 c:\windows\ERDNT\AutoBackup\5-5-2011\Users\00000001\ntuser.dat
    + 2011-05-04 05:46 . 2011-05-04 05:46 3538944 c:\windows\ERDNT\AutoBackup\5-4-2011\Users\00000001\ntuser.dat
    + 2011-05-04 00:09 . 2011-05-04 00:09 3538944 c:\windows\ERDNT\AutoBackup\5-3-2011\Users\00000001\ntuser.dat
    + 2011-05-02 04:04 . 2011-05-02 04:04 3538944 c:\windows\ERDNT\AutoBackup\5-2-2011\Users\00000001\ntuser.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
    @="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
    [HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
    @="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
    [HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
    2011-02-08 18:24 3443000 ----a-w- c:\program files\MozyHome\mozyshell.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NVRaidService"="c:\windows\system32\nvraidservice.exe" [2007-10-26 184352]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
    "TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648]
    "EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-05-07 591696]
    "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2008-04-17 98616]
    "nwiz"="nwiz.exe" [2009-01-15 1657376]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
    .
    c:\documents and settings\Firstname Lastname\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    HotSync Manager.lnk - c:\program files\Palm\HOTSYNC.EXE [2003-10-14 299008]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-4 113664]
    Dataviz Messenger.lnk - c:\windows\DvzCommon\DvzMsgr.exe [2003-7-1 24576]
    McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
    MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2011-2-8 3600184]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    .
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [12/14/2010 12:55 AM 84072]
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [9/6/2010 3:19 AM 169408]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [12/14/2010 12:55 AM 271480]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [12/14/2010 12:55 AM 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [12/14/2010 12:43 AM 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [12/14/2010 12:55 AM 55840]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [12/14/2010 12:55 AM 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [10/4/2004 5:47 AM 98304]
    S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [10/4/2004 4:40 AM 118784]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [12/14/2010 12:55 AM 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [12/14/2010 12:55 AM 84264]
    .
    --- Other Services/Drivers In Memory ---
    .
    *Deregistered* - mfeavfk01
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-04 c:\windows\Tasks\AdobeAAMUpdater-1.0-XPS630-FirstnameLastname.job
    - c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2010-07-29 06:25]
    .
    2011-05-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003Core.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-05-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-1409082233-839522115-1003UA.job
    - c:\documents and settings\Firstname Lastname\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-19 02:46]
    .
    2011-04-15 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-01 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2010-12-14 18:32]
    .
    2011-04-18 c:\windows\Tasks\prismSevenDays.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    2011-04-18 c:\windows\Tasks\prismShakeIcon.job
    - c:\program files\NCH Software\Prism\prism.exe [2011-04-17 21:50]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Trusted Zone: intuit.com\ttlc
    DPF: {18350088-453C-4407-87ED-361E70FD3285} - hxxps://relativity.idiscoverysolutions.com/Relativity/ActiveX/webclientmanager.cab
    FF - ProfilePath - c:\documents and settings\Firstname Lastname\Application Data\Mozilla\Firefox\Profiles\tuvotr3n.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\McAfee\SiteAdvisor
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-05-06 23:14
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(1140)
    c:\windows\system32\WININET.dll
    .
    - - - - - - - > 'lsass.exe'(1204)
    c:\windows\system32\WININET.dll
    .
    Completion time: 2011-05-06 23:34:54
    ComboFix-quarantined-files.txt 2011-05-07 03:34
    ComboFix2.txt 2011-05-05 03:08
    ComboFix3.txt 2011-05-01 05:54
    .
    Pre-Run: 619,382,665,216 bytes free
    Post-Run: 620,109,336,576 bytes free
    .
    - - End Of File - - A9473B959574B835D7919E13B918B67E

  8. #18
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    Here is the ESET log. I think the first part is from an earlier run a week ago.

    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6427
    # api_version=3.0.2
    # EOSSerial=876388be31a1ea4ca1df91bfcf5b492e
    # end=finished
    # remove_checked=true
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=true
    # antistealth_checked=true
    # utc_time=2011-05-01 07:14:49
    # local_time=2011-05-01 03:14:49 (-0500, Eastern Daylight Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 3
    # compatibility_mode=5121 16776549 100 75 255062 16806564 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=245253
    # found=1
    # cleaned=1
    # scan_time=4256
    C:\System Volume Information\_restore{A5836B6F-4A49-4E8C-8E45-204A87340818}\RP159\A0031138.dll a variant of Win32/Kryptik.MTG trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
    ESETSmartInstaller@High as downloader log:
    all ok
    # version=7
    # OnlineScannerApp.exe=1.0.0.1
    # OnlineScanner.ocx=1.0.0.6427
    # api_version=3.0.2
    # EOSSerial=876388be31a1ea4ca1df91bfcf5b492e
    # end=finished
    # remove_checked=true
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2011-05-07 04:50:30
    # local_time=2011-05-07 12:50:30 (-0500, Eastern Daylight Time)
    # country="United States"
    # lang=1033
    # osver=5.1.2600 NT Service Pack 3
    # compatibility_mode=5121 16776549 100 75 765385 17316887 0 0
    # compatibility_mode=8192 67108863 100 0 0 0 0 0
    # scanned=245873
    # found=0
    # cleaned=0
    # scan_time=3674
    ESETSmartInstaller@High as downloader log:
    all ok
    esets_scanner_update returned -1 esets_gle=53251

  9. #19
    Junior Member
    Join Date
    Apr 2011
    Posts
    16

    Default

    Here is the new DDS log. Note that I am still getting random popups and Generic Host Process error messages.

    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Firstname Lastname at 1:17:11.92 on Sat 05/07/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_25
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2443 [GMT -4:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Firewall *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
    C:\WINDOWS\system32\mfevtps.exe
    C:\Program Files\MozyHome\mozybackup.exe
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Documents and Settings\Firstname Lastname\My Documents\Downloads\dds.com
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local;<local>
    uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll
    BHO: McAfee Phishing Filter: {377c180e-6f0e-4d4c-980f-f45bd3d40cf4} - c:\progra~1\mcafee\msk\mcapbho.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20101214224034.dll
    BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
    mRun: [NVRaidService] c:\windows\system32\nvraidservice.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [StatusClient] c:\program files\hewlett-packard\toolbox2.0\apache tomcat 4.0\webapps\toolbox\statusclient\StatusClient.exe /auto
    mRun: [TomcatStartup] c:\program files\hewlett-packard\toolbox2.0\hpbpsttp.exe
    mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
    mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
    mRun: [nwiz] nwiz.exe /install
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    StartupFolder: c:\docume~1\brenda~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\brenda~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palm\HOTSYNC.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\datavi~1.lnk - c:\windows\dvzcommon\DvzMsgr.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mozyho~1.lnk - c:\program files\mozyhome\mozystat.exe
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    Trusted Zone: intuit.com\ttlc
    DPF: {18350088-453C-4407-87ED-361E70FD3285} - hxxps://relativity.idiscoverysolutions.com/Relativity/ActiveX/webclientmanager.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
    Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\brenda~1\applic~1\mozilla\firefox\profiles\tuvotr3n.default\
    FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
    FF - plugin: c:\documents and settings\Firstname Lastname\local settings\application data\google\update\1.3.21.53\npGoogleUpdate3.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
    FF - Ext: Easy Youtube Video Downloader: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} - %profile%\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: McAfee SiteAdvisor: {B7082FAA-CB62-4872-9106-E42DD88EDE45} - c:\program files\mcafee\SiteAdvisor
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-12-14 386840]
    R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-12-14 84072]
    R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\adobe\elements 9 organizer\PhotoshopElementsFileAgent.exe [2010-9-6 169408]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McProxy;McAfee Proxy Service;"c:\program files\common files\mcafee\mcsvchost\McSvHost.exe" /McCoreSvc [2010-12-14 271480]
    R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-12-14 171168]
    R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-12-14 188136]
    R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-12-14 141792]
    R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-12-14 55840]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-12-14 152960]
    R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-12-14 313288]
    R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-12-14 88544]
    S2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
    S2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
    S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
    S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-12-14 52104]
    S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-12-14 88544]
    S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-12-14 84264]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-12-14 33832]
    S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2010-12-14 40488]
    .
    =============== Created Last 30 ================
    .
    2011-05-01 06:01:34 -------- d-----w- c:\program files\ESET
    2011-05-01 05:57:51 -------- d-----w- c:\program files\CCleaner
    2011-05-01 05:28:19 -------- d-sha-r- C:\cmdcons
    2011-05-01 05:23:37 98816 ----a-w- c:\windows\sed.exe
    2011-05-01 05:23:37 89088 ----a-w- c:\windows\MBR.exe
    2011-05-01 05:23:37 256512 ----a-w- c:\windows\PEV.exe
    2011-05-01 05:23:37 161792 ----a-w- c:\windows\SWREG.exe
    2011-04-19 03:55:32 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-19 03:55:32 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2011-04-17 21:50:20 -------- d-----w- c:\program files\NCH Software
    2011-04-17 21:50:18 -------- d-----w- c:\docume~1\brenda~1\applic~1\NCH Software
    2011-04-17 21:45:33 -------- d-----w- C:\output media
    2011-04-17 21:44:45 -------- d-----w- c:\program files\Free Convert to DIVX AVI WMV MP4 MPEG Converter
    2011-04-17 21:44:31 164352 ----a-w- c:\windows\system32\unrar.dll
    2011-04-17 21:44:30 860160 ----a-w- c:\windows\system32\lameACM.acm
    2011-04-17 21:44:30 118784 ----a-w- c:\windows\system32\ac3acm.acm
    2011-04-17 21:44:29 81920 ----a-w- c:\windows\system32\dpl100.dll
    2011-04-17 21:44:29 755027 ----a-w- c:\windows\system32\xvidcore.dll
    2011-04-17 21:44:29 683520 ----a-w- c:\windows\system32\divx.dll
    2011-04-17 21:44:29 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
    2011-04-17 21:44:29 217088 ----a-w- c:\windows\system32\yv12vfw.dll
    2011-04-17 21:44:29 159839 ----a-w- c:\windows\system32\xvidvfw.dll
    2011-04-17 21:44:28 7680 ----a-w- c:\windows\system32\ff_vfw.dll
    2011-04-17 21:44:28 -------- d-----w- c:\program files\K-Lite Codec Pack
    2011-04-17 21:07:02 -------- d-----w- c:\docume~1\brenda~1\locals~1\applic~1\HandBrake
    2011-04-17 21:07:02 -------- d-----w- c:\docume~1\brenda~1\applic~1\HandBrake
    2011-04-17 21:06:51 -------- d-----w- c:\program files\Handbrake
    2011-04-17 19:07:51 -------- d-----w- c:\docume~1\brenda~1\applic~1\Malwarebytes
    2011-04-17 19:07:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-17 19:07:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-04-17 19:07:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-17 19:07:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-17 14:54:36 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-04-17 14:54:36 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-04-17 01:53:48 0 ----a-w- c:\windows\Cqinilaquvacaxo.bin
    .
    ==================== Find3M ====================
    .
    2011-04-14 09:07:59 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-04-14 06:40:22 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-03-25 23:48:06 4284416 ----a-w- c:\windows\system32\GPhotos.scr
    2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    .
    ============= FINISH: 1:18:15.96 ===============

  10. #20
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi,

    1. Download TDSSKiller and extract its contents into a folder in desired location (i.e. c:\tdsskiller).
    2. Execute the file TDSSKiller.exe.
    3. Click Start Scan. If threats are found, select cure and click Continue (tool may prompt for a reboot).
    4. Post back contents of log file in c: drive root (name should be in UtilityName.Version_Date_Time_log.txt format)
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •