virus/popups please help

deion21deion21
edited September 2009 in Spyware & Virus Removal
Hi,

Having major issues on my desktop,

here is my hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:57:40 PM, on 8/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PrivacyCenter\protector.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {93E601D3-978D-4D52-AC7F-D541E5F7CA51} - C:\DOCUME~1\Mike\LOCALS~1\Temp\~1B.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [PSDrvCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\RunOnce: [PrivacyCenter] C:\Program Files\PrivacyCenter\protector.exe -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: PrivacyCenter - {5199201E-60B4-11DE-85CF-260556D89593} - C:\Program Files\PrivacyCenter\protector.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mlslink.mlxchange.com/Control/MultiSelectComboBox.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mlslink.mlxchange.com/Control/MLXClientUtils.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mlslink.mlxchange.com/4.2.04.18/Control/IRCSharc.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://costco.pnimedia.com/upload/activex/v2_0_0_9/PCAXSetupv2.0.0.9.cab?
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 6145 bytes

thanks for your help
«1

Comments

  • chiazchiaz
    edited August 2009
    Hey there, welcome. :)

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log, C:\ComboFix.txt as well as a new HijackThis log for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • deion21deion21
    edited August 2009
    first issue.....the website comes up for a second, and then it says access denied when I click on your link. It seems to do that for any spyware site. What now?
  • chiazchiaz
    edited August 2009
    Does this work?
    http://74.125.153.132/search?q=cache:co6Gsc_3zHEJ:www.bleepingcomputer.com/combofix/how-to-use-combofix+http://www.bleepingcomputer.com/combofix/how-to-use-combofix&cd=1&hl=en&ct=clnk&gl=sg
  • deion21deion21
    edited August 2009
    yes, but you told me to get Malwarebytes' Anti-Malware, and that is what I can not download. I click on your link, and it says access denied. Should I skip that step, and go toi combofix?

    Thanks,
  • chiazchiaz
    edited August 2009
    Oh I thought you weren't able to access the ComboFix instructions....

    For alternative MBAM links, try these:
    http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html
    http://www.filehippo.com/download_malwarebytes_anti_malware/
    http://majorgeeks.com/download.php?det=5756
  • deion21deion21
    edited August 2009
    Thanks Chiaz.

    ok, I downloaded MBAM. I ran the install, but when it gets finished, the program does not start. Also, if I try clicking on the desktop icon, it brings up the hourglass for a second, and then nothing. So the program will not run.

    So I have the program on my computer, I tried uninstall, and reinstalling it, and nothing.
  • chiazchiaz
    edited August 2009
    Rename the MBAM icon on your desktop, and try running it again.

    If that doesn't work, go on with ComboFix.
  • deion21deion21
    edited August 2009
    got combofix to run. here is the log:

    ComboFix 09-08-20.07 - Mike 08/21/2009 15:43.1.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.512.241 [GMT -7:00]
    Running from: c:\documents and settings\Mike\Desktop\test.exe
    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    * Created a new restore point
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\documents and settings\Mike\Application Data\Google\Shell32.dll
    c:\windows\Fonts\WPHV07NB.TTF
    c:\windows\Install.txt
    c:\windows\system32\42KJE738.ocx
    c:\windows\system32\Data
    c:\windows\system32\drivers\UAClvdwmxuhnkvoafd.sys
    c:\windows\system32\Process.exe
    c:\windows\system32\SrchSTS.exe
    c:\windows\system32\twain.dll
    c:\windows\system32\UACauppnvqufjenjug.dll
    c:\windows\system32\UACfawtfdnslcbmyay.log
    c:\windows\system32\UACiehphsfodexjekn.dat
    c:\windows\system32\UACildcbsjjacuqopu.log
    c:\windows\system32\uacinit.dll
    c:\windows\system32\UACkbldcknrvkbncrp.dll
    c:\windows\system32\UACoafbwkrrdqcbwtm.dll
    c:\windows\system32\UACrnaomsyrcevvhuy.log
    c:\windows\system32\UACupchrhybbtculqd.dll
    c:\windows\system32\UACwovptnntdgsiibb.dll
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Service_UACd.sys
    \Legacy_UACd.sys

    ((((((((((((((((((((((((( Files Created from 2009-07-21 to 2009-08-21 )))))))))))))))))))))))))))))))
    .
    2009-08-20 23:35 . 2009-08-03 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-20 23:35 . 2009-08-20 23:35
    d
    w- c:\program files\the program
    2009-08-20 23:35 . 2009-08-20 23:35
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-20 23:35 . 2009-08-03 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 04:57 . 2009-08-19 04:57
    d
    w- c:\program files\Trend Micro
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-21 22:28 . 2008-12-30 21:21
    d
    w- c:\documents and settings\All Users\Application Data\avg8
    2009-08-19 04:42 . 2009-05-26 19:01
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-07-01 17:03 . 2008-12-30 21:22 335752 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-06-28 16:53 . 2008-12-30 21:22 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-06-28 16:53 . 2008-12-30 21:22 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-06-01 06:31 . 2009-06-01 06:31 422 ----a-w- c:\documents and settings\Mike\Application Data\Ahead\socks1.exe
    2009-06-01 06:31 . 2009-06-01 06:31 16141 ----a-w- c:\documents and settings\Mike\Application Data\ArcSoft\lego.exe
    2009-06-01 06:31 . 2009-06-01 06:31 145131 ----a-w- c:\documents and settings\Mike\Application Data\Apple Computer\nomad.exe
    2009-06-01 06:31 . 2009-06-01 06:31 13221 ----a-w- c:\documents and settings\Mike\Application Data\AdobeUM\rengo.dll
    2009-06-01 06:31 . 2009-06-01 06:31 11410 ----a-w- c:\documents and settings\Mike\Application Data\Corel\msgdi.dll
    2009-06-01 06:31 . 2009-06-01 06:31 10121 ----a-w- c:\documents and settings\Mike\Application Data\CyberLink\kern.dll
    2009-06-01 06:31 . 2009-06-01 06:31 11232 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\shalom.exe
    2009-06-01 06:30 . 2009-06-01 06:30 118272 ----a-w- c:\documents and settings\Mike\Application Data\Google\vsjyn859746.exe
    2009-05-29 22:28 . 2009-05-29 22:28 280832 ----a-w- C:\052909.reg
    2009-05-29 21:53 . 2009-05-29 22:03 3371360 ----a-w- C:\mbam-setup.exe
    2009-05-26 18:24 . 2009-05-26 18:24 177 ----a-w- c:\documents and settings\Mike\Application Data\asd.bat
    2009-05-26 18:24 . 2009-05-26 18:24 177 ----a-w- c:\documents and settings\Mike\Application Data\asd.bat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
    "PSDrvCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-02-23 377856]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-06 282624]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-28 1948440]
    "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
    "realteks"="c:\documents and settings\Mike\Application Data\Google\vsjyn859746.exe" [2009-06-01 118272]
    c:\documents and settings\Mike\Start Menu\Programs\Startup\
    CorelCENTRAL Alarms.LNK - c:\program files\Corel\WordPerfect Office 2000\programs\alarm.exe [2006-1-10 249856]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-06-28 16:53 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"="1"
    "AntiVirusOverride"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\WS_FTP Pro\\wsftppro.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\MSN Messenger\\livecall.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "%windir%\\system32\\drivers\\svchost.exe"=
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [12/30/2008 2:22 PM 335752]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [12/30/2008 2:21 PM 298776]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 1:44 PM 24652]
    S3 ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;\??\d:\cds300\cds300.dll --> d:\cds300\cds300.dll [?]
    .
    - - - - ORPHANS REMOVED - - - -
    BHO-{93E601D3-978D-4D52-AC7F-D541E5F7CA51} - c:\docume~1\Mike\LOCALS~1\Temp\~1B.dll
    SafeBoot-AVG Anti-Spyware Driver
    SafeBoot-AVG Anti-Spyware Guard

    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.ca/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    Trusted Zone: aol.com\free
    DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} - hxxp://mlslink.mlxchange.com/Control/MultiSelectComboBox.cab
    DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} - hxxp://mlslink.mlxchange.com/Control/MLXClientUtils.cab
    DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://mlslink.mlxchange.com/4.2.04.18/Control/IRCSharc.cab
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-21 15:53
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(640)
    c:\windows\system32\NavLogon.dll
    .
    Completion time: 2009-08-21 15:55
    ComboFix-quarantined-files.txt 2009-08-21 22:55
    Pre-Run: 40,216,678,400 bytes free
    Post-Run: 40,836,546,560 bytes free
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    143
  • deion21deion21
    edited August 2009
    chiaz, before I forget, thanks for the help.....now what next!!!
  • chiazchiaz
    edited August 2009
    There are definitely still signs of infection; but before I come up with the fix I will need to know some things first.

    Do you have any idea what this folder is/contains?
    c:\program files\the program

    And this registry file?
    C:\052909.reg

    =================================================

    Please go to http://virusscan.jotti.org , click on Browse, and upload the following files for analysis: You will only be able to have one file scanned at a time.

    c:\documents and settings\Mike\Application Data\Ahead\socks1.exe
    c:\documents and settings\Mike\Application Data\ArcSoft\lego.exe
    c:\documents and settings\Mike\Application Data\Apple Computer\nomad.exe
    c:\documents and settings\Mike\Application Data\AdobeUM\rengo.dll
    c:\documents and settings\Mike\Application Data\Corel\msgdi.dll
    c:\documents and settings\Mike\Application Data\CyberLink\kern.dll
    c:\documents and settings\Mike\Application Data\Adobe\shalom.exe


    Then click Submit. Allow the files to be scanned individually. Now please Copy/Paste the results here for me to see, as well as provide me answers to the 2 questions above.

    If Jotti is busy, please go to http://www.virustotal.com.
  • deion21deion21
    edited August 2009
    c:\program files\the program is just the name i renamed MBAM. I have no idea what C:\052909.reg is. Shoudl I delete it?
  • chiazchiaz
    edited August 2009
    Yes, delete it please and carry on with the Jotti scans.
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\Ahead\socks1.exe
    Is this what you need?

    File socks1.exe received on 2009.07.24 05:06:10 (UTC)
    Current status: finished
    Result: 3/40 (7.50%)
    compress-icon.pngCompact
    [URL="javascript:window.print()"]Print results[/URL] print-icon.png


    AntivirusVersionLast UpdateResulta-squared4.5.0.242009.07.23-AhnLab-V35.0.0.22009.07.24-AntiVir7.9.0.2282009.07.23-Antiy-AVL2.0.3.72009.07.24-Authentium5.1.2.42009.07.24W32/Heuristic-CO2!EldoradoAvast4.8.1335.02009.07.23-AVG8.5.0.3872009.07.23-BitDefender7.22009.07.24-CAT-QuickHeal10.002009.07.23-ClamAV0.94.12009.07.24-Comodo17492009.07.24-DrWeb5.0.0.121822009.07.24-eSafe7.0.17.02009.07.23-eTrust-Vet31.6.66372009.07.24-F-Prot4.4.4.562009.07.23W32/Heuristic-CO2!EldoradoF-Secure8.0.14470.02009.07.23-Fortinet3.120.0.02009.07.24-GData192009.07.24-IkarusT3.1.1.64.02009.07.23-Jiangmin11.0.8002009.07.23-K7AntiVirus7.10.8002009.07.23-Kaspersky7.0.0.1252009.07.24-McAfee56862009.07.23-McAfee+Artemis56862009.07.23-McAfee-GW-Edition6.8.52009.07.24Heuristic.LooksLike.Win32.SuspiciousPE.P!80Microsoft1.49032009.07.23-NOD3242722009.07.24-Norman6.01.092009.07.22-nProtect2009.1.8.02009.07.24-PCTools4.4.2.02009.07.23-Prevx3.02009.07.24-Rising21.39.40.002009.07.24-Sophos4.44.02009.07.24-Sunbelt3.2.1858.22009.07.23-Symantec1.4.4.122009.07.24-TheHacker6.3.4.3.3732009.07.24-TrendMicro8.950.0.10942009.07.23-VBA323.12.10.92009.07.24-ViRobot2009.7.23.18492009.07.23-VirusBuster4.6.5.02009.07.23-Additional informationFile size: 422 bytesMD5 : 8c2a7a62a031961dcccc90637a7c40cbSHA1 : 8fa5d2cb1184bd20e41a1609f268de35c8604682SHA256: 04c179d3859b2a6c98d83a568944c719a92140f83c7a9ab0d17804ed8dbe8f9eTrID : File type identification
    Generic Win/DOS Executable (49.9%)
    DOS Executable Generic (49.8%)
    Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)ssdeep: 3:MpPqt/wlEh/jFkjXFeyxi4slltlml2mzlXlbp/stMlHvlt/9vl7//llrllTll/ly:MxlEh/jKjXFeyclltA96ibtwPEiD : -packers (Kaspersky): PE_PatchCWSandbox: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=8c2a7a62a031961dcccc90637a7c40cbRDS : NSRL Reference Data Set
    -
  • chiazchiaz
    edited August 2009
    Yes, how about the other 6 files?

    Actually just the URLs linking to the various result pages will do.
  • deion21deion21
    edited August 2009
    just wanted to make sure I was doing it correctly. I will get the others shortly
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\ArcSoft\lego.exe
    analisis/da06b133bf5ca3cd2053b366fc4ad9c341238dba06fb8b0c99a2cebe044a83f2-1243899196
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\Apple Computer\nomad.exe
    http://www.virustotal.com/analisis/e6379bc5819b7bb9b0cec9b392a3478e1a41143d71ea7b4af183b996b687062d-1251249438
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\AdobeUM\rengo.dll
    analisis/33bd273604e8deb38eac4c8d0afd17fc7b5a39e4d29194733b7959ee90affd04-1243899492
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\Corel\msgdi.dll
    analisis/527edb3d96f78699ce50c9c2c2251c92025a7f8217a29a6f9fe9e4a92329c3ce-1243869988
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\CyberLink\kern.dll
    analisis/b65ecd60c457a529c49e491aeeeb7e96eb91f8b0084585cc7b005889d4bf586c-1243870003
  • deion21deion21
    edited August 2009
    c:\documents and settings\Mike\Application Data\Adobe\shalom.exe
    analisis/45b7150b8bf5052267b83a1241f7f554ffd6339e501e341cffe9a63265d4b31e-1243869944
  • deion21deion21
    edited August 2009
    I am able to run MBAM now.....would you lik eme to do that as well, since I could not do it at the beginning?
  • chiazchiaz
    edited August 2009
    Yes, please do.
  • deion21deion21
    edited August 2009
    MBAM is now done....

    What next
  • chiazchiaz
    edited August 2009
    Please navigate to and delete the following files:
    c:\documents and settings\Mike\Application Data\Ahead\socks1.exe
    c:\documents and settings\Mike\Application Data\Corel\msgdi.dll

    Leave them in your Recycle Bin first.


    How's your PC running now? Let's have you go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.
  • deion21deion21
    edited August 2009
    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-08-29 00:45:42
    PROTECTIONS: 1
    MALWARE: 66
    SUSPECTS: 1
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    AVG Anti-Virus Free 8.5 Yes Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00032745 adware/sahagent Adware No 0 Yes No c:\windows\downloaded program files\sporder_.dll
    00047879 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ODUB0LYZ\image[1].0tm
    00048250 Adware/IST.ISTBar Adware No 1 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZVLJ79OW\codec_v2[1].htm
    00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\pageid=84816394[1].htm
    00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\W1YRC1UR\search[1].htm
    00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\STU7W9AB\welcometoatlanta[1].htm
    00048251 Adware/WUpd Adware No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Local Settings\Temporary Internet Files\Content.IE5\WLKJ83GV\search[2].htm
    00136827 Adware/SAHAgent Adware No 0 Yes No C:\WINDOWS\system32\xmltok.dll
    00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@trafficmp[2].txt
    00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@casalemedia[2].txt
    00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@doubleclick[2].txt
    00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atdmt[1].txt
    00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@247realmedia[2].txt
    00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@fastclick[2].txt
    00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@tribalfusion[2].txt
    00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@mediaplex[2].txt
    00148840 Cookie/Pollstar TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@pollstar[2].txt
    00148914 Cookie/Tucows TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@tucows[1].txt
    00149116 Cookie/Ccbill TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ccbill[1].txt
    00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@belnk[1].txt
    00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@revenue[2].txt
    00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@dist.belnk[1].txt
    00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@com[1].txt
    00167647 Cookie/Yadro TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@yadro[2].txt
    00167650 Cookie/GangbangSquad TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gangbangsquad[1].txt
    00167677 Cookie/WebPower TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@webpower[2].txt
    00167690 Cookie/Rightmedia TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rightmedia[2].txt
    00167714 Cookie/64.62.232 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@64.62.232[2].txt
    00167738 Cookie/fe.lea.lycos TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@fe.lea.lycos[1].txt
    00167744 Cookie/GoStats TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@gostats[1].txt
    00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@toplist[1].txt
    00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statcounter[1].txt
    00167761 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@counter8.sextracker[1].txt
    00167776 Cookie/Kount TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@kount[1].txt
    00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ad.yieldmanager[1].txt
    00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@apmebf[2].txt
    00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@burstnet[1].txt
    00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@serving-sys[1].txt
    00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bs.serving-sys[2].txt
    00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@www.burstbeacon[2].txt
    00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adtech[1].txt
    00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@advertising[2].txt
    00169286 Cookie/Sextracker TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@sextracker[2].txt
    00170087 Cookie/Hbmediapro TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@adopt.hbmediapro[1].txt
    00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@statse.webtrendslive[2].txt
    00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@ads.pointroll[2].txt
    00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@overture[1].txt
    00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@questionmarket[1].txt
    00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@zedo[2].txt
    00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@bluestreak[2].txt
    00173545 Cookie/Rn11 TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@rn11[2].txt
    00173992 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@c5.zedo[1].txt
    00184086 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@image.checkmystats.com[2].txt
    00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adrevolver[2].txt
    00186561 Cookie/Banner TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@banner[2].txt
    00187951 Cookie/seeqA TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@www.seeq[2].txt
    00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@go[1].txt
    00196960 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ath.belnk[2].txt
    00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@searchportal.information[1].txt
    00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@ct.360i[1].txt
    00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Carly\Desktop\Administrator\Cookies\administrator@atwola[1].txt
    00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@atwola[1].txt
    00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@cgi-bin[1].txt
    00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\WINDOWS\system32\drivers\hhtioto.sys
    01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@enhance[2].txt
    01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP1\A0000045.dll
    01281813 Adware/AntivirusXPPro Adware No 0 Yes No C:\Qoobox\Quarantine\C\Documents and Settings\Mike\Application Data\Google\Shell32.dll.vir
    01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Mike\Cookies\mike@adserver.easyad[1].txt
    01690516 Spyware/Virtumonde Spyware No 1 Yes No C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_UAClvdwmxuhnkvoafd_.sys.zip[UAClvdwmxuhnkvoafd.sys]
    02515974 Adware/PrivacyCenter Adware No 0 Yes No C:\RECYCLER\S-1-5-21-484763869-2147189391-682003330-1005\Dc2.exe
    02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{02B53434-2A06-4576-BABD-60A14277FCE5}\RP0\A0000007.sys
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location
    ;===================================================================================================================================================================================
    No C:\WINDOWS\system32\xmlparse.dll
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description
    ;===================================================================================================================================================================================
    211784 HIGH MS09-032
    211781 HIGH MS09-029
    210625 HIGH MS09-026
    210624 HIGH MS09-025
    210621 HIGH MS09-022
    210618 HIGH MS09-019
    208380 HIGH MS09-015
    208379 HIGH MS09-014
    208378 HIGH MS09-013
    208377 HIGH MS09-012
    206981 HIGH MS09-007
    206980 HIGH MS09-006
    204670 HIGH MS09-001
    203806 HIGH MS08-078
    203508 HIGH MS08-073
    203505 HIGH MS08-071
    202465 HIGH MS08-068
    201683 HIGH MS08-067
    201258 HIGH MS08-066
    201256 HIGH MS08-064
    201255 HIGH MS08-063
    201253 HIGH MS08-061
    201250 HIGH MS08-058
    209275 HIGH MS08-049
    209273 HIGH MS08-045
    196455 MEDIUM MS08-037
    194862 HIGH MS08-032
    194861 HIGH MS08-031
    194860 HIGH MS08-030
    191618 HIGH MS08-025
    191617 HIGH MS08-024
    191616 HIGH MS08-023
    191614 HIGH MS08-021
    191613 HIGH MS08-020
    187735 HIGH MS08-010
    187733 HIGH MS08-008
    184380 MEDIUM MS08-002
    184379 MEDIUM MS08-001
    ;===================================================================================================================================================================================
  • chiazchiaz
    edited August 2009
    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below.

    First return to Jotti/VirusTotal and upload the following file for analysis:
    C:\WINDOWS\system32\xmlparse.dll

    Post the links to the results later.

    =============

    Now,
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    Open *notepad* and copy/paste the text in the quotebox below into it:
    File::
    c:\windows\downloaded program files\sporder_.dll
    C:\WINDOWS\system32\xmltok.dll
    C:\WINDOWS\system32\drivers\hhtioto.sys
    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.

    CFScript.gif
    Refering to the picture above, drag CFScript.txt into ComboFix.exe

    When finished, it shall produce a log for you at C:\ComboFix.txt
    Please copy and paste the ComboFix.txt in your next reply please, along with the VirusTotal/Jotti results.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*
  • deion21deion21
    edited August 2009
    C:\WINDOWS\system32\xmlparse.dll
    http://virusscan.jotti.org/en/scanresult/68675ac976f8a087f2f38078e9bdddf56cc57828
  • chiazchiaz
    edited August 2009
    Thank you, have you started on the CFScript yet?

    If no, then don't proceed with that first and post back here.

    If you already have, then post the ComboFix.txt in your reply.
  • deion21deion21
    edited August 2009
    i was doing it as you posted. Here is it

    ComboFix 09-08-29.01 - Mike 08/29/2009 18:01.2.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.512.304 [GMT -7:00]
    Running from: c:\documents and settings\Mike\Desktop\test.exe
    Command switches used :: c:\documents and settings\Mike\Desktop\CFScript.txt
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    c:\documents and settings\Mike\My Documents\ZbThumbnail.info
    .
    ((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-30 )))))))))))))))))))))))))))))))
    .
    2009-08-29 01:40 . 2008-06-20 00:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
    2009-08-29 01:40 . 2009-08-29 01:40
    d
    w- c:\program files\Panda Security
    2009-08-21 23:10 . 2009-08-21 23:10
    d
    w- c:\documents and settings\Mike\Application Data\Malwarebytes
    2009-08-20 23:35 . 2009-08-03 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-20 23:35 . 2009-08-20 23:35
    d
    w- c:\program files\the program
    2009-08-20 23:35 . 2009-08-20 23:35
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-20 23:35 . 2009-08-03 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-19 04:57 . 2009-08-19 04:57
    d
    w- c:\program files\Trend Micro
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-29 01:39 . 2006-01-10 21:19
    d
    w- c:\documents and settings\Mike\Application Data\Corel
    2009-08-29 01:38 . 2004-08-14 15:43
    d
    w- c:\documents and settings\Mike\Application Data\Ahead
    2009-08-25 21:53 . 2005-01-13 03:40
    d
    w- c:\program files\Lexmark X1100 Series
    2009-08-19 04:42 . 2009-05-26 19:01
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-06-01 06:31 . 2009-06-01 06:31 16141 ----a-w- c:\documents and settings\Mike\Application Data\ArcSoft\lego.exe
    2009-06-01 06:31 . 2009-06-01 06:31 145131 ----a-w- c:\documents and settings\Mike\Application Data\Apple Computer\nomad.exe
    2009-06-01 06:31 . 2009-06-01 06:31 13221 ----a-w- c:\documents and settings\Mike\Application Data\AdobeUM\rengo.dll
    2009-06-01 06:31 . 2009-06-01 06:31 10121 ----a-w- c:\documents and settings\Mike\Application Data\CyberLink\kern.dll
    2009-06-01 06:31 . 2009-06-01 06:31 11232 ----a-w- c:\documents and settings\Mike\Application Data\Adobe\shalom.exe
    .
    ((((((((((((((((((((((((((((( [EMAIL="SnapShot@2009-08-21_22.53.26"]SnapShot@2009-08-21_22.53.26[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-04-17 15:59 . 2009-04-17 15:59 128256 c:\windows\Downloaded Program Files\as2stubie.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
    "PSDrvCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-02-23 377856]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-12-06 282624]
    "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
    c:\documents and settings\Mike\Start Menu\Programs\Startup\
    CorelCENTRAL Alarms.LNK - c:\program files\Corel\WordPerfect Office 2000\programs\alarm.exe [2006-1-10 249856]
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\WS_FTP Pro\\wsftppro.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\MSN Messenger\\livecall.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "%windir%\\system32\\drivers\\svchost.exe"=
    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/28/2009 6:40 PM 28544]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 1:44 PM 24652]
    S3 ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;ab3af53c-334c-4d2f-bfc0-ed6cf9421d00;\??\d:\cds300\cds300.dll --> d:\cds300\cds300.dll [?]
    --- Other Services/Drivers In Memory ---
    *NewlyCreated* - PAVBOOT
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.google.ca/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    Trusted Zone: aol.com\free
    DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} - hxxp://mlslink.mlxchange.com/Control/MultiSelectComboBox.cab
    DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} - hxxp://mlslink.mlxchange.com/Control/MLXClientUtils.cab
    DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://mlslink.mlxchange.com/4.2.04.18/Control/IRCSharc.cab
    .
    **************************************************************************
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-29 18:06
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    DLLs Loaded Under Running Processes
    - - - - - - - > 'winlogon.exe'(632)
    c:\windows\system32\NavLogon.dll
    .
    Completion time: 2009-08-30 18:09
    ComboFix-quarantined-files.txt 2009-08-30 01:09
    ComboFix2.txt 2009-08-21 22:56
    Pre-Run: 40,859,291,648 bytes free
    Post-Run: 40,806,207,488 bytes free
    105
Sign In or Register to comment.