Win32.TDSS.ntf

Skeeter180 · Sep 5, 2009

Hi.

Been having a few problems with my internet browsers redirecting etc. S&D is telling me i have a few hidden files in my temp and system32 folders, that it hasn't been able to get rid of :fear:.

Here is my HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:58:51, on 05/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\kuah4325.exe
C:\Progs\protection\HiJackThis-2.02.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.isara.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6889] command.com /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5534] cmd.exe /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA419] command /c del "C:\WINDOWS\system32\drivers\kbiwkmtxtdgopx.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6649] cmd /c del "C:\WINDOWS\system32\drivers\kbiwkmtxtdgopx.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7940] command /c del "C:\WINDOWS\system32\kbiwkmmttavyqj.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9425] cmd /c del "C:\WINDOWS\system32\kbiwkmmttavyqj.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1630] command /c del "C:\WINDOWS\system32\kbiwkmxdqpsxml.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7264] cmd /c del "C:\WINDOWS\system32\kbiwkmxdqpsxml.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9439] command /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3051] cmd /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8095] command /c del "C:\WINDOWS\system32\kbiwkmtfqfcmyu.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1160] cmd /c del "C:\WINDOWS\system32\kbiwkmtfqfcmyu.dat"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB5058] command.com /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6213] cmd.exe /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9061] command /c del "C:\WINDOWS\system32\drivers\kbiwkmtxtdgopx.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6439] cmd /c del "C:\WINDOWS\system32\drivers\kbiwkmtxtdgopx.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB343] command /c del "C:\WINDOWS\system32\kbiwkmmttavyqj.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9685] cmd /c del "C:\WINDOWS\system32\kbiwkmmttavyqj.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8133] command /c del "C:\WINDOWS\system32\kbiwkmxdqpsxml.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1684] cmd /c del "C:\WINDOWS\system32\kbiwkmxdqpsxml.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7877] command /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8814] cmd /c del "C:\WINDOWS\system32\kbiwkmmhmjbpjd.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9440] command /c del "C:\WINDOWS\system32\kbiwkmtfqfcmyu.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7709] cmd /c del "C:\WINDOWS\system32\kbiwkmtfqfcmyu.dat"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1957994488-789336058-1060284298-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181670368092
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A75E0679-3287-46D1-B75D-B7E90931D6A5}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7379 bytes

Any help appreciated. I'm nearly at the end of my tether trying to remove this :snorkle:

shelf life · Sep 6, 2009

hi,

We will get a download to use. There is a guide for you to read first. Read through the guide, download Combofix to your desktop, disable any AV as explained in the guide, double click the icon and follow the prompts. Post the combofix log in your reply:

Guide to using Combofix

Skeeter180 · Sep 6, 2009

Thanks for the reply Shelf Life! :thanks:

Ran ComboFix as instructed. Here is my log:

ComboFix 09-09-06.02 - Marky 06/09/2009 20:21.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2559.2128 [GMT 1:00]
Running from: c:\progs\protection\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1644491937-1677128483-725345543-1003
c:\windows\Installer\15960b.msi
c:\windows\Installer\179212.msp
c:\windows\Installer\17921d.msp
c:\windows\Installer\179228.msp
c:\windows\Installer\17f291e.msi
c:\windows\Installer\1e997b8.msi
c:\windows\Installer\21f96.msi
c:\windows\Installer\36bf13.msi
c:\windows\Installer\36bf95.msi
c:\windows\Installer\94350b.msi
c:\windows\Installer\943513.msi
c:\windows\Installer\94351b.msi
c:\windows\Installer\943528.msi
c:\windows\Installer\943530.msi
c:\windows\Installer\a08b8.msi
c:\windows\patch.exe
c:\windows\system32\config\systemprofile\Desktop\Total Security 2009.lnk
c:\windows\system32\config\systemprofile\Start Menu\Programs\Total Security
c:\windows\system32\config\systemprofile\Start Menu\Programs\Total Security\Total Security 2009.lnk
c:\windows\system32\drivers\kbiwkmtxtdgopx.sys
c:\windows\system32\drivers\UACualkrvikky.sys
c:\windows\system32\kbiwkmmhmjbpjd.dat
c:\windows\system32\kbiwkmmttavyqj.dll
c:\windows\system32\kbiwkmtfqfcmyu.dat
c:\windows\system32\kbiwkmxdqpsxml.dll
c:\windows\system32\lowsec
c:\windows\system32\UACchesixdqmn.db
c:\windows\system32\UACfuymswpfvm.dat
c:\windows\system32\UACgduxtpgkyw.dll
c:\windows\system32\UACjoufdbycvk.dll
c:\windows\system32\uacserf.dll
c:\windows\system32\UACvppqxxnbsx.dll
c:\windows\system32\UACwcvoaoetjq.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmbmlwaibw
-------\Legacy_kbiwkmbmlwaibw
-------\Service_UACd.sys
-------\Legacy_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-08-06 to 2009-09-06 )))))))))))))))))))))))))))))))
.

2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\documents and settings\Marky\Application Data\Safer Networking
2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\program files\Safer Networking
2009-09-03 21:50 . 2009-09-03 21:50 -------- d-----w- c:\documents and settings\Marky\Local Settings\Application Data\GHISLER
2009-09-03 19:59 . 2009-09-03 20:01 -------- d-----w- C:\totalcmd
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\UC.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\RAR.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKUNZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\NOCLOSE.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\LHA.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\ARJ.PIF
2009-09-03 19:00 . 2009-09-03 19:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue
2009-08-21 10:31 . 2009-08-21 10:31 -------- d-----w- c:\documents and settings\Marky\Application Data\AVG8
2009-08-20 23:25 . 2009-08-20 23:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-20 21:03 . 2009-08-20 23:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 17:55 . 2009-08-20 17:55 30208 ----a-w- c:\windows\system32\uacrem.dll
2009-08-20 17:47 . 2009-08-20 17:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-17 22:40 . 2009-08-17 22:40 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-17 22:30 . 2009-08-17 22:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-12 18:54 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-06 19:31 . 2008-04-06 16:19 82446368 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\XviD
2009-09-03 19:41 . 2008-10-14 19:13 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-03 19:41 . 2004-08-04 14:56 -------- d-----w- c:\program files\Winamp
2009-09-03 19:41 . 2007-04-18 15:50 -------- d-----w- c:\program files\Rose Enterprise Edition for Windows
2009-09-03 19:41 . 2006-11-24 13:14 -------- d-----w- c:\program files\netbeans-5.5
2009-09-03 19:41 . 2005-12-29 17:34 -------- d-----w- c:\program files\QuickTime
2009-09-03 19:41 . 2006-01-31 15:43 -------- d-----w- c:\program files\Macromedia
2009-09-03 19:41 . 2005-11-17 00:31 -------- d-----w- c:\program files\Folding@Home
2009-09-03 19:41 . 2004-08-14 21:41 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\DivX
2009-08-22 16:57 . 2009-02-15 10:35 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-21 10:38 . 2009-02-15 10:35 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-21 10:38 . 2009-02-15 10:35 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-21 10:38 . 2009-02-15 10:35 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-21 10:37 . 2009-02-15 10:35 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-20 10:48 . 2004-12-19 22:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-18 20:43 . 2006-07-24 21:54 -------- d-----w- c:\program files\Lavasoft
2009-08-18 18:01 . 2004-12-19 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-17 22:51 . 2008-04-06 16:19 968636 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-08-05 09:11 . 2004-08-04 17:37 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2001-11-25 11:52 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 09:08 . 2006-12-01 15:39 286720 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2001-11-25 11:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-02 18:33 . 2006-12-24 14:49 14616 ----a-w- c:\documents and settings\Marky\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 18:36 . 2001-11-25 11:54 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2001-11-25 11:54 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2001-11-25 11:54 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2001-11-25 11:54 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2001-11-25 11:54 471552 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2001-11-25 11:54 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2001-11-25 11:54 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2001-11-25 11:54 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2001-11-25 11:54 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2001-11-25 11:54 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2001-11-25 11:54 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2001-11-25 11:54 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:44 . 2001-11-25 11:55 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2001-11-25 11:55 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2001-11-25 11:55 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2001-11-25 11:54 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2001-11-25 11:54 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2001-11-25 11:54 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2001-11-25 11:54 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2001-11-25 11:54 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2001-11-25 11:54 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2001-11-25 11:54 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2001-11-25 11:54 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2001-11-25 11:55 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-11-25 11:53 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 11:50 . 2001-11-25 11:55 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 11:50 . 2001-11-25 11:55 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2001-11-25 11:52 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2001-11-25 11:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-21 10:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marky^Start Menu^Programs^Startup^Folding@Home 5.03.lnk]
backup=c:\windows\pss\Folding@Home 5.03.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\19606254
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_Run
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_CC
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KillAndClean
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monopod
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NordBull

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"TapiSrv"=3 (0x3)
"stisvc"=2 (0x2)
"SharedAccess"=2 (0x2)
"NVSvc"=2 (0x2)
"Messenger"=2 (0x2)
"IDriverT"=3 (0x3)
"BITS"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"usnjsvc"=3 (0x3)
"WZCSVC"=2 (0x2)
"WebClient"=2 (0x2)
"WmdmPmSN"=3 (0x3)
"Nla"=3 (0x3)
"NBService"=3 (0x3)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"aawservice"=2 (0x2)
"NMIndexingService"=3 (0x3)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Progs\\utorrent1.6.1.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [12/01/2006 12:56 102528]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15/02/2009 11:35 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15/02/2009 11:35 108552]
S2 fwirpfz;fwirpfz;\??\c:\windows\system32\drivers\fomtji.sys --> c:\windows\system32\drivers\fomtji.sys [?]
S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\FIDE.SYS [18/12/2005 18:16 14601]
S3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [17/01/2002 16:18 166656]
S3 tbntnd5;USB Cable Modem NDIS driver;c:\windows\system32\drivers\tbntnd5.sys [21/09/2005 00:25 17552]
S3 tbntunic;USB Cable Modem WDM driver;c:\windows\system32\drivers\tbntunic.sys [21/09/2005 00:25 69360]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [15/02/2009 11:35 908056]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [15/02/2009 11:35 297752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

Notify-WgaLogon - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.isara.org/
uInternet Settings,ProxyOverride = *.local
IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {A75E0679-3287-46D1-B75D-B7E90931D6A5} = 208.67.220.220,208.67.222.222
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Marky\Application Data\Mozilla\Firefox\Profiles\cf2p2bv6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-06 20:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1957994488-789336058-1060284298-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2009-09-06 20:36
ComboFix-quarantined-files.txt 2009-09-06 19:35

Pre-Run: 17,423,651,840 bytes free
Post-Run: 17,455,386,112 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

272 --- E O F --- 2009-09-03 23:46

shelf life · Sep 7, 2009

ok we will use combofix to remove some items.

Click Start, then Run and type Notepad and click OK.
Copy/paste the text in the code box below into notepad:

Code:

File::
c:\windows\system32\uacrem.dll
c:\windows\system32\drivers\fomtji.sys

Driver::
fomtji

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\19606254]

Name the Notepad file CFScript.txt and Save it to your desktop.
now locate the file you just saved and the combofix icon, both on your desktop
using your mouse drag the CFScript right on top of the combofix icon and release, combofix will run and produce a new log
please post the new combofix log.

Next download and install Malwarebytes. Link and directions:

Please download Malwarebytes to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.

Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select Perform FULL SCAN, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click *Remove Selected.*

*A restart of your computer most likely will be required to remove some items.*

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post the log in your reply.
NOTE: The free version must be updated manually.

Skeeter180 · Sep 7, 2009

:cowboy:

ComboFix 09-09-06.06 - Marky 07/09/2009 17:28.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2559.2025 [GMT 1:00]
Running from: c:\progs\protection\ComboFix.exe
Command switches used :: c:\documents and settings\Marky\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2009-08-07 to 2009-09-07 )))))))))))))))))))))))))))))))
.

2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\documents and settings\Marky\Application Data\Safer Networking
2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\program files\Safer Networking
2009-09-03 21:50 . 2009-09-03 21:50 -------- d-----w- c:\documents and settings\Marky\Local Settings\Application Data\GHISLER
2009-09-03 19:59 . 2009-09-03 20:01 -------- d-----w- C:\totalcmd
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\UC.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\RAR.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKUNZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\NOCLOSE.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\LHA.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\ARJ.PIF
2009-09-03 19:00 . 2009-09-03 19:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue
2009-08-21 10:31 . 2009-08-21 10:31 -------- d-----w- c:\documents and settings\Marky\Application Data\AVG8
2009-08-20 23:25 . 2009-08-20 23:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-20 21:03 . 2009-08-20 23:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 17:55 . 2009-08-20 17:55 30208 ----a-w- c:\windows\system32\uacrem.dll
2009-08-20 17:47 . 2009-08-20 17:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-17 22:40 . 2009-08-17 22:40 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-17 22:30 . 2009-08-17 22:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-12 18:54 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-07 16:37 . 2008-04-06 16:19 82599968 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-06 23:35 . 2008-04-06 16:19 970220 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\XviD
2009-09-03 19:41 . 2008-10-14 19:13 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-03 19:41 . 2004-08-04 14:56 -------- d-----w- c:\program files\Winamp
2009-09-03 19:41 . 2007-04-18 15:50 -------- d-----w- c:\program files\Rose Enterprise Edition for Windows
2009-09-03 19:41 . 2006-11-24 13:14 -------- d-----w- c:\program files\netbeans-5.5
2009-09-03 19:41 . 2005-12-29 17:34 -------- d-----w- c:\program files\QuickTime
2009-09-03 19:41 . 2006-01-31 15:43 -------- d-----w- c:\program files\Macromedia
2009-09-03 19:41 . 2005-11-17 00:31 -------- d-----w- c:\program files\Folding@Home
2009-09-03 19:41 . 2004-08-14 21:41 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\DivX
2009-08-22 16:57 . 2009-02-15 10:35 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-21 10:38 . 2009-02-15 10:35 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-21 10:38 . 2009-02-15 10:35 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-21 10:38 . 2009-02-15 10:35 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-21 10:37 . 2009-02-15 10:35 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-20 10:48 . 2004-12-19 22:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-18 20:43 . 2006-07-24 21:54 -------- d-----w- c:\program files\Lavasoft
2009-08-18 18:01 . 2004-12-19 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-05 09:11 . 2004-08-04 17:37 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2001-11-25 11:52 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 09:08 . 2006-12-01 15:39 286720 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2001-11-25 11:56 915456 ------w- c:\windows\system32\wininet.dll
2009-07-02 18:33 . 2006-12-24 14:49 14616 ----a-w- c:\documents and settings\Marky\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 18:36 . 2001-11-25 11:54 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2001-11-25 11:54 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2001-11-25 11:54 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2001-11-25 11:54 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2001-11-25 11:54 471552 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2001-11-25 11:54 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2001-11-25 11:54 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2001-11-25 11:54 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2001-11-25 11:54 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2001-11-25 11:54 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2001-11-25 11:54 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2001-11-25 11:54 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:44 . 2001-11-25 11:55 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2001-11-25 11:55 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2001-11-25 11:55 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2001-11-25 11:54 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2001-11-25 11:54 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2001-11-25 11:54 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2001-11-25 11:54 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2001-11-25 11:54 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2001-11-25 11:54 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2001-11-25 11:54 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2001-11-25 11:54 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2001-11-25 11:55 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-11-25 11:53 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 11:50 . 2001-11-25 11:55 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 11:50 . 2001-11-25 11:55 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2001-11-25 11:52 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2001-11-25 11:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-06_19.31.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-11-25 11:55 . 2009-04-16 16:24 52880 c:\windows\system32\perfc009.dat
+ 2001-11-25 11:55 . 2009-09-06 19:47 52880 c:\windows\system32\perfc009.dat
+ 2001-11-25 11:55 . 2009-09-06 19:47 380658 c:\windows\system32\perfh009.dat
- 2001-11-25 11:55 . 2009-04-16 16:24 380658 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-21 10:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marky^Start Menu^Programs^Startup^Folding@Home 5.03.lnk]
backup=c:\windows\pss\Folding@Home 5.03.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"TapiSrv"=3 (0x3)
"stisvc"=2 (0x2)
"SharedAccess"=2 (0x2)
"NVSvc"=2 (0x2)
"Messenger"=2 (0x2)
"IDriverT"=3 (0x3)
"BITS"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"usnjsvc"=3 (0x3)
"WZCSVC"=2 (0x2)
"WebClient"=2 (0x2)
"WmdmPmSN"=3 (0x3)
"Nla"=3 (0x3)
"NBService"=3 (0x3)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"aawservice"=2 (0x2)
"NMIndexingService"=3 (0x3)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Progs\\utorrent1.6.1.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [12/01/2006 12:56 102528]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15/02/2009 11:35 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15/02/2009 11:35 108552]
S2 fwirpfz;fwirpfz;\??\c:\windows\system32\drivers\fomtji.sys --> c:\windows\system32\drivers\fomtji.sys [?]
S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\FIDE.SYS [18/12/2005 18:16 14601]
S3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [17/01/2002 16:18 166656]
S3 tbntnd5;USB Cable Modem NDIS driver;c:\windows\system32\drivers\tbntnd5.sys [21/09/2005 00:25 17552]
S3 tbntunic;USB Cable Modem WDM driver;c:\windows\system32\drivers\tbntunic.sys [21/09/2005 00:25 69360]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [15/02/2009 11:35 908056]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [15/02/2009 11:35 297752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.isara.org/
uInternet Settings,ProxyOverride = *.local
IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {A75E0679-3287-46D1-B75D-B7E90931D6A5} = 208.67.220.220,208.67.222.222
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Marky\Application Data\Mozilla\Firefox\Profiles\cf2p2bv6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-07 17:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1957994488-789336058-1060284298-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(596)
c:\windows\system32\COMRes.dll

- - - - - - - > 'explorer.exe'(916)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-09-07 17:41
ComboFix-quarantined-files.txt 2009-09-07 16:41
ComboFix2.txt 2009-09-06 19:36

Pre-Run: 17,500,945,408 bytes free
Post-Run: 17,457,879,552 bytes free

227 --- E O F --- 2009-09-03 23:46

____________________________________________________________

Malwarebytes' Anti-Malware 1.40
Database version: 2751
Windows 5.1.2600 Service Pack 2

07/09/2009 19:06:01
mbam-log-2009-09-07 (19-06-01).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 304602
Time elapsed: 1 hour(s), 15 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\TypeLib\{67450775-3b18-49b1-aa83-0e010f07f4df} (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{69b3ebfa-0015-4914-9312-e7758eacfac1} (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{30de9920-2e84-40a2-88a5-b8d256e15101} (Trojan.Dropper) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Common Files\ACD Systems\Filters\EITCC_LinearBlur.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmmttavyqj.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmxdqpsxml.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACgduxtpgkyw.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\uacserf.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8B653C89-66A8-4889-BD1E-55293AF865DB}\RP159\A0063765.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8B653C89-66A8-4889-BD1E-55293AF865DB}\RP159\A0063763.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8B653C89-66A8-4889-BD1E-55293AF865DB}\RP159\A0063764.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{8B653C89-66A8-4889-BD1E-55293AF865DB}\RP160\A0063815.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\ACD Systems\Filters\EITCC_LinearBlur.dll (Trojan.Dropper) -> Quarantined and deleted successfully.
F:\Program Files\Common Files\ACD Systems\Filters\EITCC_LinearBlur.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

shelf life · Sep 8, 2009

ok thanks for the info. We will use a script with combofix again:

Click Start, then Run and type Notepad and click OK.
Copy/paste the text in the code box below into notepad:

Code:

File::
c:\windows\system32\drivers\fomtji.sys

Driver::
fwirpfz

Name the Notepad file CFScript.txt and Save it to your desktop.
now locate the file you just saved and the combofix icon, both on your desktop
using your mouse drag the CFScript right on top of the combofix icon and release, combofix will run and produce a new log
please post the new combofix log.

Skeeter180 · Sep 9, 2009

Have done!

:

ComboFix 09-09-08.02 - Marky 09/09/2009 0:23.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2559.1875 [GMT 1:00]
Running from: c:\progs\protection\ComboFix.exe
Command switches used :: c:\documents and settings\Marky\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

FILE ::
"c:\windows\system32\drivers\fomtji.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FWIRPFZ
-------\Service_fwirpfz

((((((((((((((((((((((((( Files Created from 2009-08-08 to 2009-09-08 )))))))))))))))))))))))))))))))
.

2009-09-07 16:48 . 2009-09-07 16:48 -------- d-----w- c:\documents and settings\Marky\Application Data\Malwarebytes
2009-09-07 16:48 . 2009-08-03 12:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-07 16:48 . 2009-09-07 16:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-07 16:48 . 2009-09-07 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-07 16:48 . 2009-08-03 12:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\documents and settings\Marky\Application Data\Safer Networking
2009-09-04 23:01 . 2009-09-04 23:01 -------- d-----w- c:\program files\Safer Networking
2009-09-03 21:50 . 2009-09-03 21:50 -------- d-----w- c:\documents and settings\Marky\Local Settings\Application Data\GHISLER
2009-09-03 19:59 . 2009-09-03 20:01 -------- d-----w- C:\totalcmd
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\UC.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\RAR.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\PKUNZIP.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\NOCLOSE.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\LHA.PIF
2009-09-03 19:59 . 2008-08-08 06:04 545 ----a-w- c:\windows\ARJ.PIF
2009-09-03 19:00 . 2009-09-03 19:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Uniblue
2009-08-21 10:31 . 2009-08-21 10:31 -------- d-----w- c:\documents and settings\Marky\Application Data\AVG8
2009-08-20 23:25 . 2009-08-20 23:25 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-20 21:03 . 2009-08-20 23:21 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-20 17:55 . 2009-08-20 17:55 30208 ----a-w- c:\windows\system32\uacrem.dll
2009-08-20 17:47 . 2009-08-20 17:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-08-20 16:53 . 2009-08-20 16:53 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-17 22:40 . 2009-08-17 22:40 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-08-17 22:30 . 2009-08-17 22:30 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-12 18:54 . 2009-06-05 07:42 655872 -c----w- c:\windows\system32\dllcache\mstscax.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-08 23:33 . 2008-04-06 16:19 82913312 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-08 23:31 . 2008-04-06 16:19 974732 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\XviD
2009-09-03 19:41 . 2008-10-14 19:13 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-03 19:41 . 2004-08-04 14:56 -------- d-----w- c:\program files\Winamp
2009-09-03 19:41 . 2007-04-18 15:50 -------- d-----w- c:\program files\Rose Enterprise Edition for Windows
2009-09-03 19:41 . 2006-11-24 13:14 -------- d-----w- c:\program files\netbeans-5.5
2009-09-03 19:41 . 2005-12-29 17:34 -------- d-----w- c:\program files\QuickTime
2009-09-03 19:41 . 2006-01-31 15:43 -------- d-----w- c:\program files\Macromedia
2009-09-03 19:41 . 2005-11-17 00:31 -------- d-----w- c:\program files\Folding@Home
2009-09-03 19:41 . 2004-08-14 21:41 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-09-03 19:41 . 2004-08-04 15:03 -------- d-----w- c:\program files\DivX
2009-08-22 16:57 . 2009-02-15 10:35 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-21 10:38 . 2009-02-15 10:35 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-08-21 10:38 . 2009-02-15 10:35 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-21 10:38 . 2009-02-15 10:35 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-21 10:37 . 2009-02-15 10:35 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-08-20 10:48 . 2004-12-19 22:45 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-18 20:43 . 2006-07-24 21:54 -------- d-----w- c:\program files\Lavasoft
2009-08-18 18:01 . 2004-12-19 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-05 09:11 . 2004-08-04 17:37 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-17 18:55 . 2001-11-25 11:52 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 09:08 . 2006-12-01 15:39 286720 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2001-11-25 11:56 915456 ------w- c:\windows\system32\wininet.dll
2009-07-02 18:33 . 2006-12-24 14:49 14616 ----a-w- c:\documents and settings\Marky\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 18:36 . 2001-11-25 11:54 95744 ----a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2001-11-25 11:54 661504 ----a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2001-11-25 11:54 517120 ----a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2001-11-25 11:54 48640 ----a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2001-11-25 11:54 471552 ----a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2001-11-25 11:54 47104 ----a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2001-11-25 11:54 225280 ----a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2001-11-25 11:54 186880 ----a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2001-11-25 11:54 177152 ----a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2001-11-25 11:54 16896 ----a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2001-11-25 11:54 138240 ----a-w- c:\windows\system32\mqad.dll
2009-06-25 18:36 . 2001-11-25 11:54 123392 ----a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 08:44 . 2001-11-25 11:55 59392 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2001-11-25 11:55 56320 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2001-11-25 11:55 168448 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2001-11-25 11:54 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2001-11-25 11:54 724480 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2001-11-25 11:54 298496 ----a-w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2001-11-25 11:54 19968 ----a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2001-11-25 11:54 117248 ----a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2001-11-25 11:54 4608 ----a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2001-11-25 11:54 91776 ----a-w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:34 . 2001-11-25 11:54 92544 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:55 . 2001-11-25 11:55 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2001-11-25 11:53 82432 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 11:50 . 2001-11-25 11:55 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 11:50 . 2001-11-25 11:55 76288 ----a-w- c:\windows\system32\telnet.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-09-06_19.31.35 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-11-25 11:55 . 2009-04-16 16:24 52880 c:\windows\system32\perfc009.dat
+ 2001-11-25 11:55 . 2009-09-06 19:47 52880 c:\windows\system32\perfc009.dat
+ 2001-11-25 11:55 . 2009-09-06 19:47 380658 c:\windows\system32\perfh009.dat
- 2001-11-25 11:55 . 2009-04-16 16:24 380658 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-21 10:37 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Marky^Start Menu^Programs^Startup^Folding@Home 5.03.lnk]
backup=c:\windows\pss\Folding@Home 5.03.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)
"WmiApSrv"=3 (0x3)
"Wmi"=3 (0x3)
"TapiSrv"=3 (0x3)
"stisvc"=2 (0x2)
"SharedAccess"=2 (0x2)
"NVSvc"=2 (0x2)
"Messenger"=2 (0x2)
"IDriverT"=3 (0x3)
"BITS"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"usnjsvc"=3 (0x3)
"WZCSVC"=2 (0x2)
"WebClient"=2 (0x2)
"WmdmPmSN"=3 (0x3)
"Nla"=3 (0x3)
"NBService"=3 (0x3)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"ERSvc"=2 (0x2)
"aawservice"=2 (0x2)
"NMIndexingService"=3 (0x3)
"avg8wd"=2 (0x2)
"avg8emc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Progs\\utorrent1.6.1.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [12/01/2006 12:56 102528]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [15/02/2009 11:35 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [15/02/2009 11:35 108552]
S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\FIDE.SYS [18/12/2005 18:16 14601]
S3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\system32\drivers\sis7012.sys [17/01/2002 16:18 166656]
S3 tbntnd5;USB Cable Modem NDIS driver;c:\windows\system32\drivers\tbntnd5.sys [21/09/2005 00:25 17552]
S3 tbntunic;USB Cable Modem WDM driver;c:\windows\system32\drivers\tbntunic.sys [21/09/2005 00:25 69360]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [15/02/2009 11:35 908056]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [15/02/2009 11:35 297752]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.isara.org/
uInternet Settings,ProxyOverride = *.local
IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html
IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: {A75E0679-3287-46D1-B75D-B7E90931D6A5} = 208.67.220.220,208.67.222.222
DPF: Microsoft XML Parser for Java
FF - ProfilePath - c:\documents and settings\Marky\Application Data\Mozilla\Firefox\Profiles\cf2p2bv6.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll
FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPZoneSB.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-09 00:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1957994488-789336058-1060284298-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(496)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVG\AVG8\avgrsx.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-09-08 0:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-08 23:41
ComboFix2.txt 2009-09-06 19:36

Pre-Run: 17,352,811,520 bytes free
Post-Run: 17,232,936,448 bytes free

243 --- E O F --- 2009-09-03 23:46

shelf life · Sep 10, 2009

hi,

ok good. check Malwarebytes for updates and do another scan with it and post the log.

RE:utorrent1.6.1.exe
There is plenty of malware that is distributed via p2p networks.

Skeeter180 · Sep 10, 2009

Thanks! Done :crowned:

Malwarebytes' Anti-Malware 1.40
Database version: 2773
Windows 5.1.2600 Service Pack 2

10/09/2009 22:36:59
mbam-log-2009-09-10 (22-36-59).txt

Scan type: Full Scan (C:\|F:\|)
Objects scanned: 305888
Time elapsed: 1 hour(s), 38 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
F:\System Volume Information\_restore{8B653C89-66A8-4889-BD1E-55293AF865DB}\RP160\A0064115.dll (Trojan.Dropper) -> Quarantined and deleted successfully.

_______________________________________

shelf life said:
RE:utorrent1.6.1.exe
There is plenty of malware that is distributed via p2p networks.

No worries. I've not used it for literally years

:

shelf life · Sep 11, 2009

ok good.

No worries. I've not used it for literally years

I thought it might just be a left over as the current version is 1.8.. something

you can remove combofix like this:

start>run and type in combofix /u
click ok or enter
Note: there is a space after the x and before the /

Always check malwarebytes for updates before a scan.
You can make a new restore point, the how and the why:

One of the features of Windows ME,XP and Vista is the System Restore option, however if malware infects a computer it is possible that the malware could be backed up in the System Restore archive. Therefore, clearing the restore points is a good idea after malware is removed and your computer appears to be functioning ok.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore. (deletes old possibly infected restore point)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.(creates a new restore points on a clean system)
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK, then reboot

And last:

10 Tips for Reducing/Preventing Your Risk To Malware:

Simply knowing what constitutes a safe action on a computer and what may not will help you tremendously.

1) It is essential to Keep your OS,(Windows) browser (IE, FireFox) and other software up to date to "patch" vulnerabilities that could be exploited. Visit Windows Update frequently or use the auto-update feature. Staying updated is also necessary for web based applications like Java, Adobe Flash/Reader, QuickTime etc. Check there version status here.

2) Know what you are installing to your computer. Alot of software can come bundled with unwanted add-ons, like adware, toolbars and malware. Do not install any files from ads, popups or random links. Do not fall for fake warnings about virus and trojans being found on your computer and your then prompted to install software to remedy this. See also the signs that you may have malware on your computer.

3) Install and keep updated: one antivirus and two or three anti-malware applications. If not updated they will soon be worthless. Scanning frequency is a function of your computer habits. If you frequently have malware then you should review your computer habits.

4) Refrain from clicking on links or attachments you receive via E-Mail, IM, IRC, Chat Rooms or Social Networking Sites, no matter how tempting or legitimate the message may seem.

5) Don't click on ads/pop ups or offers from websites requesting that you need to install software, media players or codecs to your computer--for any reason.

6) Don't click on offers to "scan" your computer. Install ActiveX Objects with care. Do you trust the website?

7) Set up and use limited (non-privileged) accounts for everyday use, rather than administrator accounts. Limited accounts can help prevent *malware from installing and lessen its potential impact.*

8) Install and understand the limitations of a software firewall.

9) Consider using an alternate browser and E-mail client. Internet Explorer and OutLook Express are popular targets for malicious code because they are widely used. All browsers can have vulnerabilities but statistically it is the most commonly used browser that will tend to be targeted the most. See also: Hardening or Securing Internet Explorer.

10) Warez, cracks etc are very popular for carrying malware payloads. Avoid. If you install files via p2p networks then you are much more likely to encounter malicious code. Do you trust the source of the file? Do you really need another malware source?

A longer version in link below.

Happy Safe Surfing.

Skeeter180 · Sep 12, 2009

Awesome.

Thanks shelf life, really appreciate the good work you guys are doing! :thanks::bow:

Win32.TDSS.ntf

Skeeter180

New member

shelf life

Emeritus

Skeeter180

New member

shelf life

Emeritus

Skeeter180

New member

shelf life

Emeritus

Skeeter180

New member

shelf life

Emeritus

Skeeter180

New member

shelf life

Emeritus

Skeeter180

New member