Random Popups and possible Virus
Hi I believe I have a virus on my computer because of the random popups I get. Its not that bad but it gets very annoying. I might have opened a infected file from a torrent. I just need another walk-thru. Thanks.
0
Comments
Please download Malwarebytes' Anti-Malware by clicking the link below:
http://www.besttechie.net/tools/mbam-setup.exe
Double Click mbam-setup.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* You'll be required to post the contents of this log later.
Please Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:
Go here ======> A guide and tutorial on using ComboFix <====== Go here
Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.
The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should get a prompt that says:
The Recovery Console was successfully installed.
Please continue as follows:
(1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
(2) Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the MBAM log and C:\ComboFix.txt for further review, so that we may continue cleansing the system.
Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
Malwarebytes' Anti-Malware 1.38
Database version: 2399
Windows 6.0.6001 Service Pack 1
7/14/2009 1:27:28 PM
mbam-log-2009-07-14 (13-27-28).txt
Scan type: Quick Scan
Objects scanned: 87253
Time elapsed: 5 minute(s), 10 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ComboFix 09-07-13.01 - Shivam 07/14/2009 13:37.5.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3581.2463 [GMT -4:00]
Running from: c:\users\Shivam\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\20D8.tmp
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\2f9285cf-1189-13db-15a9-9ce378c40be5
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 1
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\Antiphishing Component Update 5
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\Component Update 765
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\Component Update 960
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp4000.tmp
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp5CC3.tmp
c:\users\Shivam\AppData\Local\Microsoft\Windows\Temporary Internet Files\tmp9E41.tmp
c:\windows\system32\549971b9-1c5e-af38-8811-7a6ce236dcb2.exe
.
((((((((((((((((((((((((( Files Created from 2009-06-14 to 2009-07-14 )))))))))))))))))))))))))))))))
.
2009-07-09 16:56 . 2009-06-17 15:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-09 16:56 . 2009-07-09 16:57
d
w- c:\program files\Malwarebytes' Anti-Malware
2009-07-09 16:56 . 2009-06-17 15:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-09 03:19 . 2009-07-09 03:19 10684866 ----a-w- c:\users\Shivam\AppData\Roaming\Azureus\plugins\azump\mplayer.exe
2009-07-05 17:23 . 2009-07-06 03:32
d
w- c:\program files\Panda Security
2009-07-05 02:34 . 2009-07-14 17:41
d
w- c:\users\Shivam\AppData\Local\temp
2009-07-04 17:24 . 2009-07-04 17:24
d
w- c:\users\Shivam\AppData\Roaming\Malwarebytes
2009-07-04 17:24 . 2009-07-04 17:24
d
w- c:\programdata\Malwarebytes
2009-07-03 20:15 . 2009-03-09 19:27 453456 ----a-w- c:\windows\system32\d3dx10_41.dll
2009-07-03 20:15 . 2009-03-09 19:27 1846632 ----a-w- c:\windows\system32\D3DCompiler_41.dll
2009-07-03 20:15 . 2009-03-09 19:27 4178264 ----a-w- c:\windows\system32\D3DX9_41.dll
2009-07-03 20:15 . 2009-03-16 18:18 69448 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-07-03 20:15 . 2009-03-16 18:18 517448 ----a-w- c:\windows\system32\XAudio2_4.dll
2009-07-03 20:15 . 2009-03-16 18:18 235352 ----a-w- c:\windows\system32\xactengine3_4.dll
2009-07-03 20:15 . 2009-03-16 18:18 22360 ----a-w- c:\windows\system32\X3DAudio1_6.dll
2009-07-03 18:24 . 2009-07-03 18:24
d
w- c:\program files\AVG
2009-07-02 21:34 . 2009-07-02 21:35 558 ----a-w- c:\windows\system32\ealregsnapshot1.reg
2009-07-02 21:34 . 2009-07-02 21:34
d
w- c:\users\Shivam\AppData\Local\Downloaded Installations
2009-07-02 20:55 . 2009-07-02 20:55
d
w- c:\users\Shivam\AppData\Roaming\Leadertech
2009-07-02 17:51 . 2009-07-02 17:51
d
w- c:\program files\Alwil Software
2009-07-02 00:54 . 2009-07-02 00:54
d
w- c:\program files\Common Files\Microsoft Games
2009-07-01 01:09 . 2009-06-30 21:50
d
w- c:\windows\Panther
2009-07-01 01:08 . 2008-03-11 06:44 305176 ----a-w- c:\windows\system32\drivers\iaStor.sys
2009-07-01 01:08 . 2008-06-26 11:10 380928 ----a-w- c:\windows\system32\drivers\stwrt.sys
2009-07-01 01:08 . 2008-06-26 11:10 678912 ----a-w- c:\windows\system32\stapo.dll
2009-07-01 01:08 . 2008-06-26 11:10 344576 ----a-w- c:\windows\system32\stcplx.dll
2009-07-01 01:08 . 2008-06-26 11:10 405504 ----a-w- c:\windows\system32\stapi32.dll
2009-07-01 01:08 . 2008-06-26 11:09 173568 ----a-w- c:\windows\system32\st326017.dll
2009-07-01 01:08 . 2008-03-13 11:45 548352 ----a-w- c:\windows\system32\drivers\ATSwpWDF.sys
2009-07-01 01:06 . 2009-07-01 01:06
d
w- c:\windows\system32\OEM
2009-07-01 00:38 . 2008-10-22 01:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-07-01 00:27 . 2009-07-01 00:27
d
w- c:\windows\PCHEALTH
2009-07-01 00:17 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-07-01 00:17 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-07-01 00:17 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-07-01 00:17 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-07-01 00:17 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-07-01 00:16 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-07-01 00:16 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-07-01 00:10 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-07-01 00:10 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-07-01 00:10 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-07-01 00:10 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-07-01 00:10 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll
2009-07-01 00:08 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-01 00:08 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 23:50 . 2008-11-01 03:44 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-06-30 23:49 . 2009-06-30 23:49
d
w- c:\users\Shivam\AppData\Local\Deployment
2009-06-30 23:49 . 2008-02-29 07:14 19000 ----a-w- c:\windows\system32\kd1394.dll
2009-06-30 23:49 . 2008-02-29 07:11 988216 ----a-w- c:\windows\system32\winload.exe
2009-06-30 23:49 . 2008-02-22 05:05 615992 ----a-w- c:\windows\system32\ci.dll
2009-06-30 23:49 . 2008-02-29 07:11 927288 ----a-w- c:\windows\system32\winresume.exe
2009-06-30 23:49 . 2008-02-29 06:53 378368 ----a-w- c:\windows\system32\srcore.dll
2009-06-30 23:49 . 2008-02-29 06:53 46592 ----a-w- c:\windows\system32\setbcdlocale.dll
2009-06-30 23:49 . 2008-02-29 06:53 40960 ----a-w- c:\windows\system32\srclient.dll
2009-06-30 23:49 . 2008-02-29 06:35 6656 ----a-w- c:\windows\system32\kbd106n.dll
2009-06-30 23:49 . 2008-02-29 04:12 318464 ----a-w- c:\windows\system32\rstrui.exe
2009-06-30 23:49 . 2008-02-29 04:12 14848 ----a-w- c:\windows\system32\srdelayed.exe
2009-06-30 23:48 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-30 23:48 . 2008-08-27 01:05 212480 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2009-06-30 23:48 . 2008-12-06 04:42 376832 ----a-w- c:\windows\system32\winhttp.dll
2009-06-30 23:48 . 2008-04-26 08:26 891448 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-06-30 23:48 . 2008-04-05 03:34 15360 ----a-w- c:\windows\system32\pacerprf.dll
2009-06-30 23:48 . 2008-04-05 01:21 72192 ----a-w- c:\windows\system32\drivers\pacer.sys
2009-06-30 23:48 . 2008-06-19 03:31 361984 ----a-w- c:\windows\system32\IPSECSVC.DLL
2009-06-30 23:48 . 2008-09-05 05:14 1191936 ----a-w- c:\windows\system32\msxml3.dll
2009-06-30 23:46 . 2008-04-18 05:48 269312 ----a-w- c:\windows\system32\es.dll
2009-06-30 23:44 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-30 23:44 . 2008-10-29 06:29 2927104 ----a-w- c:\windows\explorer.exe
2009-06-30 23:44 . 2008-06-26 01:45 12240896 ----a-w- c:\windows\system32\NlsLexicons0007.dll
2009-06-30 23:44 . 2008-06-26 01:45 2644480 ----a-w- c:\windows\system32\NlsLexicons0009.dll
2009-06-30 23:43 . 2008-06-26 03:29 801280 ----a-w- c:\windows\system32\NaturalLanguage6.dll
2009-06-30 23:42 . 2009-02-13 08:49 1255936 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-30 23:42 . 2009-03-17 03:38 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-06-30 23:42 . 2009-02-13 08:49 72704 ----a-w- c:\windows\system32\secur32.dll
2009-06-30 23:42 . 2009-03-17 03:38 24064 ----a-w- c:\windows\system32\amxread.dll
2009-06-30 23:42 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-30 23:42 . 2008-04-10 05:12 738304 ----a-w- c:\windows\system32\inetcomm.dll
2009-06-30 23:39 . 2008-04-26 08:08 1314816 ----a-w- c:\windows\system32\quartz.dll
2009-06-30 23:23 . 2008-09-10 03:40 1334272 ----a-w- c:\windows\system32\msxml6.dll
2009-06-30 23:20 . 2009-07-01 00:58 70176 ----a-w- c:\users\Shivam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-30 23:15 . 2008-10-16 21:09 51224 ----a-w- c:\windows\system32\wuauclt.exe
2009-06-30 23:15 . 2008-10-16 21:09 43544 ----a-w- c:\windows\system32\wups2.dll
2009-06-30 23:15 . 2008-10-16 20:56 1524736 ----a-w- c:\windows\system32\wucltux.dll
2009-06-30 23:15 . 2008-10-16 21:13 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2009-06-30 23:14 . 2008-10-16 21:12 561688 ----a-w- c:\windows\system32\wuapi.dll
2009-06-30 23:14 . 2008-10-16 21:08 34328 ----a-w- c:\windows\system32\wups.dll
2009-06-30 23:14 . 2008-10-16 20:55 83456 ----a-w- c:\windows\system32\wudriver.dll
2009-06-30 23:13 . 2008-10-16 18:08 162064 ----a-w- c:\windows\system32\wuwebv.dll
2009-06-30 23:13 . 2008-10-16 17:56 31232 ----a-w- c:\windows\system32\wuapp.exe
2009-06-30 23:11 . 2009-06-30 23:33
d
w- c:\windows\Debug
2009-06-30 21:42 . 2009-06-30 21:42 21316 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-30 21:36 . 2009-06-30 21:36
d
w- c:\users\Default\video
2009-06-30 21:18 . 2009-06-30 21:18 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-30 21:18 . 2009-06-30 21:18
d
w- c:\program files\IDT
2009-06-30 21:18 . 2008-06-26 11:09 45568 ----a-w- c:\windows\system32\ctppld.dll
2009-06-30 21:18 . 2008-06-26 11:09 492544 ----a-w- c:\windows\system32\ctapo32.dll
2009-06-30 21:18 . 2008-06-26 11:09 372736 ----a-w- c:\windows\system32\aestecap.dll
2009-06-30 21:18 . 2008-06-26 11:09 53248 ----a-w- c:\windows\system32\aestaren.dll
2009-06-30 21:18 . 2008-06-26 11:09 133632 ----a-w- c:\windows\system32\aestacap.dll
2009-06-30 21:18 . 2008-06-26 11:10 2473984 ----a-w- c:\windows\system32\stlang.dll
2009-06-30 21:18 . 2008-06-26 11:09 516096 ----a-w- c:\windows\system32\idtmini1.exe
2009-06-30 21:18 . 2008-06-26 11:09 73728 ----a-w- c:\windows\system32\AESTCom.dll
2009-06-30 21:18 . 2009-06-30 21:18
d
w- c:\program files\DellTPad
2009-06-30 17:54 . 2009-07-03 22:12
d
w- c:\users\Public\SHIVAM-LAPTOP
2009-06-30 17:48 . 2009-06-30 17:48 528 ----a-r- c:\users\Public\MediaID.bin
2009-06-30 00:56 . 2009-07-02 19:02
d-sh--w- c:\users\Shivam\AppData\Roaming\lowsec
2009-06-29 23:41 . 2009-06-30 21:25
d
w- c:\programdata\Azureus
2009-06-29 23:41 . 2009-07-09 22:35
d
w- c:\users\Shivam\AppData\Roaming\Azureus
2009-06-28 00:12 . 2009-06-28 00:12 746744 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-17 21:17 . 2009-06-30 21:33
d
w- c:\users\Shivam\AppData\Local\MicroVision Applications
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-09 16:34 . 2009-06-11 16:58
d
w- c:\program files\iTunes
2009-07-05 02:28 . 2008-08-03 18:06
d
w- c:\programdata\Viewpoint
2009-07-02 00:55 . 2008-07-28 15:47
d--h--w- c:\program files\InstallShield Installation Information
2009-07-02 00:35 . 2008-08-06 22:12
d
w- c:\program files\PowerISO
2009-07-01 00:49 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-07-01 00:29 . 2008-09-22 22:19
d
w- c:\programdata\Microsoft Help
2009-06-30 21:25 . 2009-05-21 17:49
d
w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-06-30 21:24 . 2008-07-28 16:00
d
w- c:\program files\McAfee.com
2009-06-30 21:24 . 2006-11-02 12:37
d
w- c:\program files\Microsoft Games
2009-06-30 21:24 . 2008-07-28 16:00
d
w- c:\program files\McAfee
2009-06-30 21:24 . 2009-05-20 23:40
d
w- c:\program files\Leaf Networks
2009-06-30 21:24 . 2008-07-28 15:44
d
w- c:\program files\Java
2009-06-30 21:22 . 2008-07-28 15:48
d
w- c:\program files\Creative
2009-06-30 21:19 . 2009-06-30 21:19 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ATSwpWDF_01005.Wdf
2009-06-30 21:18 . 2009-06-30 21:18 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
2009-06-30 17:27 . 2008-07-28 15:58 12 ----a-w- c:\windows\bthservsdp.dat
2009-06-17 21:17 . 2008-08-06 22:22
d
w- c:\programdata\Roxio
2009-06-13 16:59 . 2009-06-13 16:59 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbA0B3.tmp.exe
2009-06-11 16:51 . 2009-06-11 16:51 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-11 16:34 . 2009-06-11 16:34 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbB4B0.tmp.exe
2009-06-01 05:03 . 2008-10-05 01:46
d
w- c:\program files\EA GAMES
2009-05-19 05:36 . 2009-06-13 19:04 97072 ----a-w- c:\programdata\AOL Downloads\SUD4426\bsetutil.exe
2009-05-19 05:36 . 2009-06-13 19:04 2884832 ----a-w- c:\programdata\AOL Downloads\SUD4426\vwpt.exe
2009-05-19 05:36 . 2009-06-13 19:04 28 ----a-w- c:\programdata\AOL Downloads\SUD4426\unregister.bat
2009-05-19 05:36 . 2009-06-13 19:04 25 ----a-w- c:\programdata\AOL Downloads\SUD4426\register.bat
2009-05-19 05:36 . 2009-06-13 19:04 1484856 ----a-w- c:\programdata\AOL Downloads\SUD4426\toolbar.exe
2009-05-19 05:36 . 2009-06-13 19:04 142040 ----a-w- c:\programdata\AOL Downloads\SUD4426\alsetup.exe
2009-05-19 05:36 . 2009-06-13 19:04 30512 ----a-w- c:\programdata\AOL Downloads\SUD4426\Uninstaller.exe
2009-05-19 05:36 . 2009-06-13 19:04 111920 ----a-w- c:\programdata\AOL Downloads\SUD4426\AOLSearch.dll
2009-05-16 17:56 . 2009-05-16 17:56 416128 ----a-w- c:\programdata\Microsoft\eHome\Packages\NetTV\Browse\NetTVResources.dll
2008-07-28 16:05 . 2008-07-28 16:05 74 --sha-r- c:\windows\CT4CET.bin
2008-07-28 18:26 . 2008-07-28 18:26 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-28 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-03-11 163840]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-26 442467]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-02-19 438403]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"DpAgent"="c:\program files\DigitalPersona\Bin\dpagent.exe" [2008-03-26 699456]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-29 17920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-02 582992]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2008-01-14 132392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"VolPanel"="c:\program files\Creative\SBAudigy\Volume Panel\VolPanlu.exe" [2006-11-27 180224]
c:\users\Shivam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-5-13 1058088]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-8 752168]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli DPPWDFLT
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A2CF4301-545E-4E68-97C3-451C07585F8E}"= TCP:c:\program files\Leaf Networks\Leaf\bin\Leaf.exe:Leaf
"{A101863B-C409-4BCE-95A9-1642C21ED13C}"= UDP:c:\program files\Leaf Networks\Leaf\bin\Leaf.exe:Leaf
"{B0E6C0BF-561C-4725-82B5-10324C83A37C}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{0AF08C2E-1363-4A3B-B91B-B8C2E939355B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{AD199216-3337-48BA-8066-8E9AF6ADE256}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{7733CE41-4391-4102-9AF8-1A04765DB008}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B50F9EC9-E962-4212-9C88-94E95F3426A9}"= TCP:c:\program files\Leaf Networks\Leaf\bin\Leaf.exe:Leaf
"{F5DD85B9-FF8F-4EC7-87D8-7D75C60EE31B}"= UDP:c:\program files\Leaf Networks\Leaf\bin\Leaf.exe:Leaf
"{9A271FE6-DEC2-404D-81FA-3529CBC74C83}"= TCP:c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:Veoh Web Player
"{0F1E4289-3C71-4723-893F-36AE33D11174}"= UDP:c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:Veoh Web Player
"{64A0CA4A-FD0D-474D-8276-069EB8946020}"= TCP:c:\windows\System32\dlcccoms.exe:Dell 924 Server
"{F5F7056E-0CFE-4C06-8501-7159464B0510}"= UDP:c:\windows\System32\dlcccoms.exe:Dell 924 Server
"{74013302-1DD7-43E2-B341-42D1B6D7DA0E}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"{201767FF-17B4-4219-A8CC-0089A57DF642}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"{5FC61111-5B42-4A8D-A54D-9D7F5F5F1913}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{77B51D44-E4CB-42E6-8EDD-A15179BDCDD5}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C2C98F2A-3BDF-4AD0-AD37-9B8E85866BAE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{33C1ABEA-E129-46B6-9510-202EC800FF4F}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"{569C3927-709F-425D-BC56-6BB97B5D6D8D}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{ED60CA2B-4CB4-4955-9CF1-3A0318099988}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{BAAB1350-A9CE-44C2-BA5D-11A27A6A5FB1}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{163BA861-094B-4C23-BC66-5BB0284A1CB1}"= TCP:c:\program files\Dell Video Chat\DellVideoChat.exe:SightSpeed
"{D2E49453-0A7B-47D2-8652-D50BB4A4E6F4}"= UDP:c:\program files\Dell Video Chat\DellVideoChat.exe:SightSpeed
"{DDE4F5EC-9622-4525-AF62-821E103ECCF6}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{2D6E79BD-E547-4D20-87D4-60BFD6BC9AB0}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{DDE2C75C-BFAE-42DA-A0E7-D6DAEC5B4376}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{32A979D2-1ECE-4154-807C-256C39C5ADCF}"= c:\program files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{4BB5A887-52E6-4826-80D4-5587125AD77B}"= c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{A897B2F9-2892-445A-8910-9D062723DE92}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3y.exe:Age of Empires III - The Asian Dynasties
"{A0DC2E4C-A878-4240-B5C6-F3817D47C3D5}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3y.exe:Age of Empires III - The Asian Dynasties
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\AEstSrv.exe [6/30/2009 9:08 PM 73728]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [2/29/2008 5:37 AM 1053944]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [4/28/2008 5:56 PM 161048]
R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\System32\drivers\ATSwpWDF.sys [6/30/2009 9:08 PM 548352]
R3 itecir;ITECIR Infrared Receiver;c:\windows\System32\drivers\itecir.sys [6/30/2009 9:09 PM 54784]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\k57nd60x.sys [6/30/2009 9:09 PM 203264]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [7/9/2009 12:56 PM 38160]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\System32\drivers\OA001Ufd.sys [6/30/2009 9:09 PM 149208]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\System32\drivers\OA001Vid.sys [6/30/2009 9:09 PM 277624]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MBAMSWISSARMY
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-06-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-28 18:32]
2009-06-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-28 18:32]
.
.
Supplementary Scan
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-14 13:41
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\users\Shivam\AppData\Local\Temp\catchme.dll 53248 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
DLLs Loaded Under Running Processes
- - - - - - - > 'lsass.exe'(788)
c:\windows\system32\DPPWDFLT.dll
.
Completion time: 2009-07-14 13:43
ComboFix-quarantined-files.txt 2009-07-14 17:43
ComboFix2.txt 2009-07-05 02:34
Pre-Run: 212,047,765,504 bytes free
Post-Run: 212,074,147,840 bytes free
294 --- E O F --- 2009-07-01 04:40
Viewpoint Media Player/Manager/Toolbar is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad".
I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.
If you are having trouble removing Viewpoint, I suggest that you use ViewpointKiller. You may download it from this link.
Once you have downloaded ViewpointKiller, unzip it to a convenient location such as your desktop. Run ViewpointKiller, and select File > Do All Killings. Follow the prompts, selecting Yes or No, depending on which selection you are most comfortable with. A logfile will be created in the folder you unzipped ViewpointKiller to, please paste the contents here later.
===========================================================
Next, please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:
c:\windows\system32\st326017.dll
Then click Submit. Allow the file to be scanned, and then please Copy/Paste the results here for me to see, along with the ViewPointKiller log if you ran the tool.
If Jotti is busy, please go to http://www.virustotal.com.
http://download.cnet.com/ViewpointKiller/3000-8022_4-10610895.html
ViewpointKiller will now create a logfile in the main hard drive, i.e. C:\.
Select File > Open ViewpointKiller.log in the menu and copy and paste the contents of the logfile in the thread.
Go to to Start > Run
Type in box
combofix /u
Note: the space between the X and the /u
Press Enter.
This command will:
Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.
You may also delete any other programs that we used now.
It would be great if you can reply once so that we can have this thread archived.
This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.
If you are not the user who started this thread, you must start your own Thread instead