Removing Exploit Links to known exploit sites

Comments

• dodanto

  October 2009 edited October 2009

  bump ... this is continuing to happen and seems to be getting worse with more files listed.

  0
• chiaz

  November 2009 edited November 2009

  Hello, sorry for the late reply.
  
  If you still need help,
  A few things before we start....
  1. Please Read All Instructions Carefully.
  2. If you don't understand something, stop and ask! Don't keep going on.
  3. Please do not run any other tools or scans whilst I am helping you.
  4. If you have to go away for an extended period of time, let me know.
  5. Please continue to respond until I give you the "All Clear".
  (Just because you can't see a problem doesn't mean it isn't there)
  
  
  
  Please download Malwarebytes' Anti-Malware by clicking the link below:
  Malwarebytes Anti-Malware - Reviews and free Malwarebytes Anti-Malware downloads at Download.com
  
  Double Click mbam-setup.exe to install the application.
  
  * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  * If an update is found, it will download and install the latest version.
  * Once the program has loaded, select "Perform Quick Scan", then click Scan.
  * The scan may take some time to finish,so please be patient.
  * When the scan is complete, click OK, then Show Results to view the results.
  * Make sure that everything is checked, and click Remove Selected.
  * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  * You'll be required to post the contents of this log later.
  
  Please Note:
  If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
  
  
  
  Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:
  
  Go here ======> A guide and tutorial on using ComboFix <====== Go here
  
  Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.
  
  The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
  
  Once installed, you should get a prompt that says:
  
  The Recovery Console was successfully installed.
  
  Please continue as follows:
  
  (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  (2) Click Yes to allow ComboFix to continue scanning for malware.
  
  When the tool is finished, it will produce a report for you.
  
  
  Please include MBAM log, C:\ComboFix.txt and a new HijackThis log for further review, so that we may continue cleansing the system.
  
  
  Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.

  0
• dodanto

  November 2009 edited November 2009

  Thanks Chiaz ...
  
  I was getting tired of the errors so I went in and renamed the files that were listed and figured if I had problems running my computer I could go rename them again. I haven't had any issues running my computer nor the errors. However, I don't think that necessarily means the problem has been fixed. I've run the steps requested but did NOT change the filenames back before I did. Here are the logs:
  
  Malwarebytes' Anti-Malware 1.41
  Database version: 3081
  Windows 5.1.2600 Service Pack 2
  
  11/1/2009 4:42:00 PM
  mbam-log-2009-11-01 (16-42-00).txt
  
  Scan type: Quick Scan
  Objects scanned: 115418
  Time elapsed: 5 minute(s), 33 second(s)
  
  Memory Processes Infected: 0
  Memory Modules Infected: 0
  Registry Keys Infected: 0
  Registry Values Infected: 0
  Registry Data Items Infected: 0
  Folders Infected: 0
  Files Infected: 0
  
  Memory Processes Infected:
  (No malicious items detected)
  
  Memory Modules Infected:
  (No malicious items detected)
  
  Registry Keys Infected:
  (No malicious items detected)
  
  Registry Values Infected:
  (No malicious items detected)
  
  Registry Data Items Infected:
  (No malicious items detected)
  
  Folders Infected:
  (No malicious items detected)
  
  Files Infected:
  (No malicious items detected)

  ---

  ComboFix 09-10-30.01 - ****** 11/01/2009 16:50.2.2 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2339 [GMT -8:00]
  Running from: c:\documents and settings\******\My Documents\Utilities\ComboFix.exe
  AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
  .
  
  ((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 )))))))))))))))))))))))))))))))
  .
  
  2009-10-27 23:29 . 2009-10-27 23:29

  ---

  d

  ---

  w- c:\documents and settings\******\Local Settings\Application Data\Help
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-11-02 00:30 . 2008-12-22 13:44

  ---

  d

  ---

  w- c:\program files\Malwarebytes' Anti-Malware
  2009-11-02 00:28 . 2009-11-02 00:28 693760 ----a-w- c:\windows\isRS-000.tmp
  2009-10-30 06:36 . 2008-11-21 18:51

  ---

  d

  ---

  w- c:\program files\Common Files\Adobe
  2009-10-21 10:43 . 2009-04-10 13:16

  ---

  d

  ---

  w- c:\program files\Quicken
  2009-10-20 02:34 . 2009-03-26 01:44

  ---

  d

  ---

  w- c:\program files\Finale 2007
  2009-10-19 05:31 . 2009-10-19 05:31 59501 ----a-w- c:\documents and settings\All Users\Application Data\tmpE.tmp
  2009-10-01 07:05 . 2009-10-01 07:04

  ---

  d

  ---

  w- c:\program files\iTunes
  2009-10-01 07:05 . 2009-10-01 07:05

  ---

  d

  ---

  w- c:\program files\iPod
  2009-10-01 07:05 . 2009-09-18 06:32

  ---

  d

  ---

  w- c:\program files\Common Files\Apple
  2009-10-01 07:01 . 2009-02-14 01:58

  ---

  d

  ---

  w- c:\program files\QuickTime Alternative
  2009-10-01 04:50 . 2009-08-20 06:27

  ---

  d

  ---

  w- c:\program files\Digsby
  2009-09-23 06:47 . 2009-09-23 06:47

  ---

  d

  ---

  w- c:\program files\activePDF
  2009-09-20 14:49 . 2009-09-20 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\McAfee
  2009-09-19 00:31 . 2009-09-18 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\NOS
  2009-09-18 14:49 . 2009-09-18 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
  2009-09-18 07:42 . 2009-09-18 06:36

  ---

  d

  ---

  w- c:\documents and settings\******\Application Data\Apple Computer
  2009-09-18 07:39 . 2009-02-14 01:53

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\Apple
  2009-09-18 06:36 . 2009-09-18 06:35

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
  2009-09-18 06:34 . 2009-01-11 07:55

  ---

  d

  ---

  w- c:\program files\Bonjour
  2009-09-18 06:33 . 2009-02-14 01:58

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\Apple Computer
  2009-09-18 06:04 . 2009-09-18 06:04 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
  2009-09-18 06:04 . 2009-09-18 06:04

  ---

  d

  ---

  w- c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
  2009-09-18 06:04 . 2008-11-21 18:46

  ---

  d--h--w- c:\program files\InstallShield Installation Information
  2009-09-14 03:19 . 2009-09-14 00:39 256 ----a-w- c:\documents and settings\******\pool.bin
  2009-09-10 22:54 . 2008-12-22 13:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
  2009-09-10 22:53 . 2008-12-22 13:44 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
  2009-08-29 02:42 . 2009-09-18 06:32 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
  2009-08-29 02:42 . 2009-09-18 06:32 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
  2009-08-27 03:06 . 2009-08-27 03:06 85492 ---ha-w- c:\windows\system32\mlfcache.dat
  2009-08-17 16:12 . 2008-12-01 06:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
  2009-08-17 16:12 . 2008-12-01 06:02 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
  2009-08-17 16:12 . 2008-12-01 06:02 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
  2009-08-07 02:24 . 2004-08-11 22:12 327896 ----a-w- c:\windows\system32\wucltui.dll
  2009-08-07 02:24 . 2004-08-11 22:12 209632 ----a-w- c:\windows\system32\wuweb.dll
  2009-08-07 02:24 . 2008-12-13 17:06 44768 ----a-w- c:\windows\system32\wups2.dll
  2009-08-07 02:24 . 2004-08-11 22:12 35552 ----a-w- c:\windows\system32\wups.dll
  2009-08-07 02:24 . 2004-08-11 22:12 53472 ----a-w- c:\windows\system32\wuauclt.exe
  2009-08-07 02:24 . 2004-08-11 22:00 96480 ----a-w- c:\windows\system32\cdm.dll
  2009-08-07 02:23 . 2004-08-11 22:12 575704 ----a-w- c:\windows\system32\wuapi.dll
  2009-08-07 02:23 . 2008-12-22 13:52 274288 ----a-w- c:\windows\system32\mucltui.dll
  2009-08-07 02:23 . 2008-12-22 13:52 215920 ----a-w- c:\windows\system32\muweb.dll
  2009-08-07 02:23 . 2004-08-11 22:12 1929952 ----a-w- c:\windows\system32\wuaueng.dll
  2009-08-04 01:03 . 2008-11-21 18:50 113744 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
  2009-04-01 13:43 . 2009-04-01 13:43 13583 ----a-w- c:\program files\setuplog.txt
  2009-04-01 13:43 . 2009-04-01 13:43 12548 ----a-w- c:\program files\uninstal.log
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
  "PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
  "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
  "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-19 2025752]
  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
  "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
  "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-11-18 623880]
  "Turtle Beach USB MIDI 1x1"="c:\program files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe" [2006-08-02 1839104]
  "OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-21 98304]
  "QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2009-09-05 417792]
  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
  "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
  "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-07-17 16132608]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
  2008-11-21 18:57 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
  2009-08-17 16:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel Desktop Application Director 8.LNK]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Corel Desktop Application Director 8.LNK
  backup=c:\windows\pss\Corel Desktop Application Director 8.LNKCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
  backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
  backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
  "c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
  "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
  "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
  "c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
  "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\ScanSoft\\OmniPagePro11.0\\EregEng\\NAVBrowser.exe"=
  "c:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
  "c:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
  "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  "c:\\Program Files\\EZTest\\mysql\\bin\\mysqld.exe"=
  "c:\\WINDOWS\\system32\\java.exe"=
  "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "c:\\Program Files\\iTunes\\iTunes.exe"=
  
  R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/30/2008 10:02 PM 335240]
  R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/30/2008 10:02 PM 108552]
  R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/30/2008 10:02 PM 908056]
  R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [11/30/2008 10:02 PM 297752]
  R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 4:45 AM 13088]
  R3 QCAbsee;Logitech QuickCam Web (0801);c:\windows\system32\drivers\OVCA.sys [12/7/2008 7:47 PM 25088]
  S2 2BD54E0B45CB2024;2BD54E0B45CB2024;\??\c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024 --> c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024 [?]
  S3 TBU11;Turtle Beach USB MIDI 1x1 Driver;c:\windows\system32\drivers\tbu11.sys [5/3/2009 7:33 PM 13824]
  
  --- Other Services/Drivers In Memory ---
  
  *NewlyCreated* - CLASSPNP_2
  *NewlyCreated* - MBR
  *Deregistered* - CLASSPNP_2
  *Deregistered* - mbr
  .
  Contents of the 'Scheduled Tasks' folder
  
  2009-11-01 c:\windows\Tasks\Daily Backup.job
  - c:\windows\system32\ntbackup.exe [2004-08-11 10:00]
  .
  .

  ---

  Supplementary Scan

  ---

  .
  uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5081121
  mStart Page = hxxp://www.dell.com
  uInternet Settings,ProxyOverride = *.local
  uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
  IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
  IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
  Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll
  FF - ProfilePath - c:\documents and settings\******\Application Data\Mozilla\Firefox\Profiles\emplnxry.******\
  FF - prefs.js: browser.search.selectedEngine - GoodSearch
  FF - prefs.js: browser.startup.homepage - hxxp://my.iwon.com/index.jsp
  FF - plugin: c:\documents and settings\******\Application Data\Mozilla\Firefox\Profiles\emplnxry.******\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
  FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll
  
  ---- FIREFOX POLICIES ----
  c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
  .
  - - - - ORPHANS REMOVED - - - -
  
  WebBrowser-{D0523BB4-21E7-11DD-9AB7-415B56D89593} - (no file)
  AddRemove-SearchAssist - c:\dell\SearchAssist\UninstSA.bat
  
  
  
  **************************************************************************
  
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2009-11-01 16:54
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Turtle Beach USB MIDI 1x1 = c:\program files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe??????????????H?????A~x???????????????????X?????A~??A~"????????????}F?"????????@??????"???????????????????????????????????????4rG?????????????????t@??????????p?A??@???@???@???????aG??????????aG
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\2BD54E0B45CB2024]
  "ImagePath"="\??\c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024"
  .

  ---

  DLLs Loaded Under Running Processes

  ---

  
  - - - - - - - > 'winlogon.exe'(736)
  c:\windows\system32\GTGina.dll
  c:\windows\system32\cscdll.dll
  c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
  
  - - - - - - - > 'explorer.exe'(3544)
  c:\windows\system32\msi.dll
  .
  Completion time: 2009-11-02 16:55
  ComboFix-quarantined-files.txt 2009-11-02 00:55
  ComboFix2.txt 2009-06-07 15:33
  
  Pre-Run: 416,559,460,352 bytes free
  Post-Run: 416,785,715,200 bytes free
  
  - - End Of File - - D197B7DC0723EAB72C403C583DF5E481

  ---

  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 4:58:11 PM, on 11/1/2009
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
  C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\PROGRA~1\AVG\AVG8\avgnsx.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\Program Files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe
  C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
  C:\Program Files\AVG\AVG8\avgcsrvx.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Documents and Settings\******\Desktop\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5081121
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5081121
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
  O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
  O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
  O4 - HKLM\..\Run: [Turtle Beach USB MIDI 1x1] C:\Program Files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe
  O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229187984593
  O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
  O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
  O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
  O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
  O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
  O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
  O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
  O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
  O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
  O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
  O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
  O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
  O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
  O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
  O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
  
  --
  End of file - 10507 bytes

  0
• chiaz

  November 2009 edited November 2009

  Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
  
  It's IMPORTANT to carry out the instructions in the sequence listed below.
  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  Open *notepad* and copy/paste the text in the quotebox below into it:
  

  File::
  c:\windows\isRS-000.tmp
  

  
  Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.
  
  
  
  
  Refering to the picture above, drag CFScript.txt into ComboFix.exe
  
  When finished, it shall produce a log for you at C:\ComboFix.txt
  
  Please copy and paste the ComboFix.txt in your new reply later.
  
  *Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*
  
  ==========
  
  Please go HERE to run Panda ActiveScan 2.0

  • Click the big green Scan now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • Once the scan is completed, please hit the notepad icon next to the text Export to:
  • Save it to a convenient location such as your Desktop
  • Post the contents of the ActiveScan.txt in your next reply, along with ComboFix.txt.

  0
• dodanto

  November 2009 edited November 2009

  ComboFix 09-10-30.01 - ****** 11/01/2009 19:34.3.2 - NTFSx86
  Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3070.2347 [GMT -8:00]
  Running from: c:\documents and settings\******\Desktop\ComboFix.exe
  Command switches used :: c:\documents and settings\******\Desktop\cfscript.txt
  AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
  
  FILE ::
  "c:\windows\isRS-000.tmp"
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  c:\windows\isRS-000.tmp
  
  .
  ((((((((((((((((((((((((( Files Created from 2009-10-02 to 2009-11-02 )))))))))))))))))))))))))))))))
  .
  
  2009-10-27 23:29 . 2009-10-27 23:29

  ---

  d

  ---

  w- c:\documents and settings\******\Local Settings\Application Data\Help
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2009-11-02 00:30 . 2008-12-22 13:44

  ---

  d

  ---

  w- c:\program files\Malwarebytes' Anti-Malware
  2009-10-30 06:36 . 2008-11-21 18:51

  ---

  d

  ---

  w- c:\program files\Common Files\Adobe
  2009-10-21 10:43 . 2009-04-10 13:16

  ---

  d

  ---

  w- c:\program files\Quicken
  2009-10-20 02:34 . 2009-03-26 01:44

  ---

  d

  ---

  w- c:\program files\Finale 2007
  2009-10-19 05:31 . 2009-10-19 05:31 59501 ----a-w- c:\documents and settings\All Users\Application Data\tmpE.tmp
  2009-10-01 07:05 . 2009-10-01 07:04

  ---

  d

  ---

  w- c:\program files\iTunes
  2009-10-01 07:05 . 2009-10-01 07:05

  ---

  d

  ---

  w- c:\program files\iPod
  2009-10-01 07:05 . 2009-09-18 06:32

  ---

  d

  ---

  w- c:\program files\Common Files\Apple
  2009-10-01 07:01 . 2009-02-14 01:58

  ---

  d

  ---

  w- c:\program files\QuickTime Alternative
  2009-10-01 04:50 . 2009-08-20 06:27

  ---

  d

  ---

  w- c:\program files\Digsby
  2009-09-23 06:47 . 2009-09-23 06:47

  ---

  d

  ---

  w- c:\program files\activePDF
  2009-09-20 14:49 . 2009-09-20 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\McAfee
  2009-09-19 00:31 . 2009-09-18 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\NOS
  2009-09-18 14:49 . 2009-09-18 14:49

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
  2009-09-18 07:42 . 2009-09-18 06:36

  ---

  d

  ---

  w- c:\documents and settings\******\Application Data\Apple Computer
  2009-09-18 07:39 . 2009-02-14 01:53

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\Apple
  2009-09-18 06:36 . 2009-09-18 06:35

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
  2009-09-18 06:34 . 2009-01-11 07:55

  ---

  d

  ---

  w- c:\program files\Bonjour
  2009-09-18 06:33 . 2009-02-14 01:58

  ---

  d

  ---

  w- c:\documents and settings\All Users\Application Data\Apple Computer
  2009-09-18 06:04 . 2009-09-18 06:04 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys
  2009-09-18 06:04 . 2009-09-18 06:04

  ---

  d

  ---

  w- c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor
  2009-09-18 06:04 . 2008-11-21 18:46

  ---

  d--h--w- c:\program files\InstallShield Installation Information
  2009-09-14 03:19 . 2009-09-14 00:39 256 ----a-w- c:\documents and settings\******\pool.bin
  2009-09-10 22:54 . 2008-12-22 13:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
  2009-09-10 22:53 . 2008-12-22 13:44 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
  2009-08-29 02:42 . 2009-09-18 06:32 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
  2009-08-29 02:42 . 2009-09-18 06:32 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
  2009-08-27 03:06 . 2009-08-27 03:06 85492 ---ha-w- c:\windows\system32\mlfcache.dat
  2009-08-17 16:12 . 2008-12-01 06:02 11952 ----a-w- c:\windows\system32\avgrsstx.dll
  2009-08-17 16:12 . 2008-12-01 06:02 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
  2009-08-17 16:12 . 2008-12-01 06:02 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
  2009-08-07 02:24 . 2004-08-11 22:12 327896 ----a-w- c:\windows\system32\wucltui.dll
  2009-08-07 02:24 . 2004-08-11 22:12 209632 ----a-w- c:\windows\system32\wuweb.dll
  2009-08-07 02:24 . 2008-12-13 17:06 44768 ----a-w- c:\windows\system32\wups2.dll
  2009-08-07 02:24 . 2004-08-11 22:12 35552 ----a-w- c:\windows\system32\wups.dll
  2009-08-07 02:24 . 2004-08-11 22:12 53472

  ---

  w- c:\windows\system32\wuauclt.exe
  2009-08-07 02:24 . 2004-08-11 22:00 96480 ----a-w- c:\windows\system32\cdm.dll
  2009-08-07 02:23 . 2004-08-11 22:12 575704 ----a-w- c:\windows\system32\wuapi.dll
  2009-08-07 02:23 . 2008-12-22 13:52 274288 ----a-w- c:\windows\system32\mucltui.dll
  2009-08-07 02:23 . 2008-12-22 13:52 215920 ----a-w- c:\windows\system32\muweb.dll
  2009-08-07 02:23 . 2004-08-11 22:12 1929952 ----a-w- c:\windows\system32\wuaueng.dll
  2009-04-01 13:43 . 2009-04-01 13:43 13583 ----a-w- c:\program files\setuplog.txt
  2009-04-01 13:43 . 2009-04-01 13:43 12548 ----a-w- c:\program files\uninstal.log
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
  "PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2007-09-17 124200]
  "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
  "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-19 2025752]
  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-20 136600]
  "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
  "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
  "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
  "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
  "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
  "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-11-18 623880]
  "Turtle Beach USB MIDI 1x1"="c:\program files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe" [2006-08-02 1839104]
  "OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-21 98304]
  "QuickTime Task"="c:\program files\QuickTime Alternative\QTTask.exe" [2009-09-05 417792]
  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
  "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
  "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-07-17 16132608]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
  2008-11-21 18:57 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
  2009-08-17 16:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Corel Desktop Application Director 8.LNK]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Corel Desktop Application Director 8.LNK
  backup=c:\windows\pss\Corel Desktop Application Director 8.LNKCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
  backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
  
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
  path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
  backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "c:\\Program Files\\CyberLink\\PowerDVD DX\\PowerDVD.exe"=
  "c:\\Program Files\\CyberLink\\PowerDVD DX\\PDVDDXSrv.exe"=
  "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
  "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
  "c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
  "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
  "c:\\Program Files\\ScanSoft\\OmniPagePro11.0\\EregEng\\NAVBrowser.exe"=
  "c:\\Program Files\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
  "c:\\Program Files\\CyberLink\\PCM4Everio\\EverioService.exe"=
  "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
  "c:\\Program Files\\EZTest\\mysql\\bin\\mysqld.exe"=
  "c:\\WINDOWS\\system32\\java.exe"=
  "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
  "c:\\Program Files\\iTunes\\iTunes.exe"=
  
  R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/30/2008 10:02 PM 335240]
  R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/30/2008 10:02 PM 108552]
  R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/30/2008 10:02 PM 908056]
  R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [11/30/2008 10:02 PM 297752]
  R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 4:45 AM 13088]
  R3 QCAbsee;Logitech QuickCam Web (0801);c:\windows\system32\drivers\OVCA.sys [12/7/2008 7:47 PM 25088]
  S2 2BD54E0B45CB2024;2BD54E0B45CB2024;\??\c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024 --> c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024 [?]
  S3 TBU11;Turtle Beach USB MIDI 1x1 Driver;c:\windows\system32\drivers\tbu11.sys [5/3/2009 7:33 PM 13824]
  
  --- Other Services/Drivers In Memory ---
  
  *NewlyCreated* - CLASSPNP_2
  *NewlyCreated* - MBR
  *Deregistered* - CLASSPNP_2
  *Deregistered* - mbr
  .
  Contents of the 'Scheduled Tasks' folder
  
  2009-11-01 c:\windows\Tasks\Daily Backup.job
  - c:\windows\system32\ntbackup.exe [2004-08-11 10:00]
  .
  .

  ---

  Supplementary Scan

  ---

  .
  uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5081121
  mStart Page = hxxp://www.dell.com
  uInternet Settings,ProxyOverride = *.local
  uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
  IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
  IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
  Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll
  FF - ProfilePath - c:\documents and settings\******\Application Data\Mozilla\Firefox\Profiles\emplnxry.******\
  FF - prefs.js: browser.search.selectedEngine - GoodSearch
  FF - prefs.js: browser.startup.homepage - hxxp://my.iwon.com/index.jsp
  FF - plugin: c:\documents and settings\******\Application Data\Mozilla\Firefox\Profiles\emplnxry.******\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
  FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll
  FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll
  
  ---- FIREFOX POLICIES ----
  c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
  .
  
  **************************************************************************
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Turtle Beach USB MIDI 1x1 = c:\program files\Turtle Beach\Turtle Beach USB MIDI 1x1\TBUM11.exe??????????????H?????A~x???????????????????X?????A~??A~"????????????}F?"????????@??????"???????????????????????????????????????4rG?????????????????t@??????????p?A??@???@???@???????aG??????????aG
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files:
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\2BD54E0B45CB2024]
  "ImagePath"="\??\c:\program files\Yahoo!\Messenger\2BD54E0B45CB2024\2BD54E0B45CB2024"
  .

  ---

  DLLs Loaded Under Running Processes

  ---

  
  - - - - - - - > 'winlogon.exe'(736)
  c:\windows\system32\GTGina.dll
  c:\windows\system32\cscdll.dll
  c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
  .
  Completion time: 2009-11-02 19:38
  ComboFix-quarantined-files.txt 2009-11-02 03:37
  ComboFix2.txt 2009-11-02 00:55
  ComboFix3.txt 2009-06-07 15:33
  
  Pre-Run: 416,857,358,336 bytes free
  Post-Run: 416,850,055,168 bytes free
  
  - - End Of File - - 1BD56391294E0252BA2924A1B3A7E19F

  ---

  ;***********************************************************************************************************************************************************************************
  ANALYSIS: 2009-11-02 07:13:36
  PROTECTIONS: 1
  MALWARE: 7
  SUSPECTS: 0
  ;***********************************************************************************************************************************************************************************
  PROTECTIONS
  Description Version Active Updated
  ;===================================================================================================================================================================================
  AVG Anti-Virus Free 8.5 No Yes
  ;===================================================================================================================================================================================
  MALWARE
  Id Description Type Active Severity Disinfectable Disinfected Location
  ;===================================================================================================================================================================================
  00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@doubleclick[1].txt
  00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@atdmt[1].txt
  00167753 Cookie/Statcounter TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@statcounter[1].txt
  00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@ad.yieldmanager[2].txt
  00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@apmebf[1].txt
  00169190 Cookie/Advertising TrackingCookie No 0 Yes No c:\documents and settings\******\cookies\******@advertising[2].txt
  02329864 Trj/BedeTres.R Virus/Trojan No 1 Yes No c:\documents and settings\******\desktop\5694204bfaf11f24\5694204bfaf11f24
  ;===================================================================================================================================================================================
  SUSPECTS
  Sent Location
  ;===================================================================================================================================================================================
  ;===================================================================================================================================================================================
  VULNERABILITIES
  Id Severity Description
  ;===================================================================================================================================================================================
  214076 HIGH MS09-059
  971486 HIGH MS09-058
  214074 HIGH MS09-057
  214073 HIGH MS09-056
  214072 HIGH MS09-055
  214071 HIGH MS09-054
  213109 HIGH MS09-046
  212494 HIGH MS09-042
  212493 HIGH MS09-041
  212490 HIGH MS09-038
  212530 HIGH MS09-034
  211784 HIGH MS09-032
  211781 HIGH MS09-029
  210625 HIGH MS09-026
  210624 HIGH MS09-025
  210621 HIGH MS09-022
  210618 HIGH MS09-019
  208380 HIGH MS09-015
  208379 HIGH MS09-014
  208378 HIGH MS09-013
  208377 HIGH MS09-012
  206981 HIGH MS09-007
  206980 HIGH MS09-006
  204670 HIGH MS09-001
  203806 HIGH MS08-078
  203508 HIGH MS08-073
  203505 HIGH MS08-071
  202465 HIGH MS08-068
  201258 HIGH MS08-066
  201256 HIGH MS08-064
  201255 HIGH MS08-063
  201253 HIGH MS08-061
  201250 HIGH MS08-058
  196455 MEDIUM MS08-037
  194862 HIGH MS08-032
  191616 HIGH MS08-023
  133386 MEDIUM MS06-064
  120823 MEDIUM MS06-030
  120818 HIGH MS06-025
  117384 MEDIUM MS06-018
  108744 MEDIUM MS06-008
  93395 HIGH MS05-051
  93454 MEDIUM MS05-049
  ;===================================================================================================================================================================================

  0
• chiaz

  November 2009 edited November 2009

  Navigate to this folder:
  c:\documents and settings\******\desktop\5694204bfaf11f24\
  
  Please see what it contains, and let me know whether you intend for the folder to be there.

  0
• dodanto

  November 2009 edited November 2009

  That folder does not show on my when I follow the path to where it should be. I made sure I was viewing hidden files and it was not there. I also did a search of my hard drive for that folder searching all hidden, system, and sub-folders and could not find it either. Given where it says it is, it should be showing on my desktop and it is not.

  0
• chiaz

  November 2009 edited November 2009

  OK how is your PC running now?

  0
• dodanto

  November 2009 edited November 2009

  It seems to be working fine. I haven't seen the errors.
  
  Thanks for your help.

  0
• chiaz

  November 2009 edited November 2009

  I think our work is done here - your PC should be clean now.
  
  It's time to remove ComboFix.
  
  Go to to Start > Run
  Type in box
  
  combofix /u
  
  Note: the space between the X and the /u
  
  Press Enter.
  
  This command will:
  
  Delete the following:
  ComboFix and its associated files and folders.
  VundoFix backups, if present
  The C:\Deckard folder, if present
  The C:_OtMoveIt folder, if present
  
  Reset the clock settings.
  Hide file extensions, if required.
  Hide System/Hidden files, if required.
  Reset System Restore.
  
  
  Even if you have no more queries, I would appreciate if you can reply once more to this thread so that I will be able to have this archived. Thanks.

  0
• dodanto

  November 2009 edited November 2009

  ComboFix removed. Thanks again!!!

  0
• chiaz

  November 2009 edited November 2009

  You're welcome. Moving this to the Resolved section now.

  0